GLPI SQL注入漏洞

GLPI is an open source IT and asset management software for individual developers. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner and ink...

Three Keys to Securing Shadow Data

What is shadow data? Shadow data is any data contained anywhere in your entire data repository that is not visible to the tools you use to monitor and log data access. Shadow data may include: Customer data that DevOps teams copied into an unknown database to test applications they are developing...

Asian Governments and Organizations Targeted in Latest Cyber Espionage Attacks

Government and state-owned organizations in a number of Asian countries have been targeted by a distinct group of espionage hackers as part of an intelligence gathering mission that has been underway since early 2021. "A notable feature of these attacks is that the attackers leveraged a wide rang...

What’s most important for a CISO in API security?

As threats to networks and systems have changed, so have CISOs’ priorities. API security has grown more important with everything as a service and in the cloud. Todays CISOs must ensure they have a plan for protecting APIs. To learn what’s most crucial when protecting APIs, we surveyed CISOs and...

it-pabelick.de Cross Site Scripting vulnerability OBB-2896979

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

New EvilProxy Phishing Service Allowing Cybercriminals to Bypass 2-Factor Security

A new phishing-as-a-service PhaaS toolkit dubbed EvilProxy is being advertised on the criminal underground as a means for threat actors to bypass two-factor authentication 2FA protections employed against online services. "EvilProxy actors are using reverse proxy and cookie injection methods to...

Anonymous hacked Russian Yandex taxi app causing a massive traffic jam

By Waqas Anonymous has confirmed to Hackread.com that the attack on the Yandex Taxi app was carried out in cooperation with the IT Army of Ukraine. This is a post from HackRead.com Read the original post: Anonymous hacked Russian Yandex taxi app causing a massive traffic jam...

Snake Keylogger Returns with New Malspam Campaign Targeting IT Firms

By Waqas The IP addresses used in the attack originated from Vietnam, while the campaign’s primary targets were located in the USA. This is a post from HackRead.com Read the original post: Snake Keylogger Returns with New Malspam Campaign Targeting IT Firms...

Cross-Site Scripting (XSS)

snipe/snipe-it is vulnerable to cross-site scripting. The vulnerability exists in views/dashboard.blade.php and login.blade.php because the user inputs are not properly escaped which allows a remote attacker to inject and execute malicious code into the system...

GHSA-RFF2-VQM3-JPV5 snipe-it vulnerable to cross-site scripting (XSS)

Cross-site Scripting XSS - Stored in GitHub repository snipe/snipe-it prior to v6.0.11...

snipe-it vulnerable to cross-site scripting (XSS)

Cross-site Scripting XSS - Stored in GitHub repository snipe/snipe-it prior to v6.0.11...

The vulnerability of the IT asset management system snipe-it arises from the lack of measures taken to protect the website structure. This vulnerability allows attackers to carry out XSS attacks.

The vulnerability of the IT asset management system snipe-it exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

CVE-2022-3035

Cross-site Scripting XSS - Stored in GitHub repository snipe/snipe-it prior to v6.0.11...

CVE-2022-3035

Cross-site Scripting XSS - Stored in GitHub repository snipe/snipe-it prior to v6.0.11...

CVE-2022-3035

CVE-2022-3035 is a Stored XSS vulnerability affecting Snipe-IT prior to version 6.0.11. Multiple sources (NVD/NVD-listed entry, OSV, Veracode, CVE list) consistently describe Cross-site Scripting in the web app, originating from insufficient escaping/input handling in the UI when processing user ...

CVE-2022-3035 Cross-site Scripting (XSS) - Stored in snipe/snipe-it

Cross-site Scripting XSS - Stored in GitHub repository snipe/snipe-it prior to v6.0.11...

CVE-2022-3035 Cross-site Scripting (XSS) - Stored in snipe/snipe-it

Cross-site Scripting XSS - Stored in GitHub repository snipe/snipe-it prior to v6.0.11...

You’re never going to be able to fix every security vulnerability, but knowing where to start helps

Milpitas, California, August 29, 2022 -- IT security operations, risk management and infrastructure teams face a daily challenge: do more with less. And in the face of increasing threats from cybercriminals and exponentially expanding attack vectors, teams are going to have to turn to intelligent...

PT-2022-4504 · Snipe-It · Snipe-It

Name of the Vulnerable Software and Affected Versions: snipe-it versions prior to 6.0.11 Description: The issue is related to a Cross-site Scripting XSS - Stored vulnerability. It exists due to inadequate protection of the web page structure, allowing a remote attacker to conduct an inter-site...

Snipe-IT 跨站脚本漏洞

Snipe-IT is an open source IT asset/license management system. A cross-site scripting vulnerability exists in Snipe-IT versions prior to v6.0.11, which originates from a user with Super Administrator privileges being able to implement cross-site scripting via a Markdown Input field...