PT-2022-13297 · Snipe-It · Snipe-It

Name of the Vulnerable Software and Affected Versions: Snipe-IT versions prior to 5.3.11 Description: The issue concerns improper privilege management, allowing an unprivileged user to create maintenance for an asset. This can be exploited due to missing authorization in the software. Version...

CVE-2022-0579

Missing Authorization in Packagist snipe/snipe-it prior to 5.3.9...

CVE-2022-0579

Missing Authorization in Packagist snipe/snipe-it prior to 5.3.9...

CVE-2022-0579 Missing Authorization in snipe/snipe-it

Missing Authorization in Packagist snipe/snipe-it prior to 5.3.9...

CVE-2022-0579

The CVE-2022-0579 entry concerns Snipe-IT (Packagist snipe/snipe-it) before version 5.3.9. Several connected sources confirm an improper privilege management flaw that allows a user without access to the supplier module to view supplier content, indicating a privilege-related exposure rather than...

CVE-2022-0579 Missing Authorization in snipe/snipe-it

Missing Authorization in Packagist snipe/snipe-it prior to 5.3.9...

Upcoming Speaking Engagements

This is a current list of where and when I am scheduled to speak: I’m speaking at IT-S Now 2022 in Vienna on June 2, 2022. I’m speaking at the 14th International Conference on Cyber Conflict, CyCon 2022, in Tallinn, Estonia on June 3, 2022. I’m speaking at the RSA Conference 2022 in San Francisco...

CVE-2022-0569

Observable Discrepancy in Packagist snipe/snipe-it prior to v5.3.9...

CVE-2022-0569

Observable Discrepancy in Packagist snipe/snipe-it prior to v5.3.9...

Buffer overflow

Observable Discrepancy in Packagist snipe/snipe-it prior to v5.3.9...

Persistence – Notepad++ Plugins

It is not uncommon a windows environment especially dedicated servers which are managed by developers or IT staff to have installed the Notepad++ text editor.… Continue reading - Persistence - Notepad++ Plugins...

Persistence – Notepad++ Plugins

It is not uncommon a windows environment especially dedicated servers which are managed by developers or IT staff to have installed the Notepad++ text editor.… Continue reading - Persistence - Notepad++ Plugins...

Snipe-IT 信息泄露漏洞

Snipe-IT is an open source IT asset/license management system. snipe-it suffers from an information disclosure vulnerability that stems from the existence of two different responses for unregistered and registered email addresses in the password reset page. An attacker could use this vulnerabilit...

snipe-it 安全漏洞

Snipe-IT is an open source IT asset/license management system. security vulnerability exists in Packagist snipe/snipe-it versions prior to 5.3.9, which stems from improper privilege management. No details of the vulnerability are currently available...

GLPI Cross-Site Scripting Vulnerability (CNVD-2022-11518)

GLPI is an open source IT and asset management software for individual developers. The software provides a full-featured IT resource management interface that you can use to build a database to fully manage IT computers, monitors, servers, printers, network devices, phones, even toner cartridges...

CVE-2022-0569 Observable Discrepancy in snipe/snipe-it

Observable Discrepancy in Packagist snipe/snipe-it prior to v5.3.9...

CVE-2022-0569

CVE-2022-0569 affects snipe/snipe-it, prior to v5.3.9, with an information-disclosure flaw caused by differences in password-reset responses that can enumerate registered user emails. Impact is information disclosure (email enumeration) and potential brute-force risk implied by exposed email list...

CVE-2022-0569 Observable Discrepancy in snipe/snipe-it

Observable Discrepancy in Packagist snipe/snipe-it prior to v5.3.9...

The CIA Has Secretly Run a ‘Bulk Collection’ Program

Plus: Vulnerability fixes, the return of EARN IT, and more of the week’s top security news...

Improper Privilege Management in snipe/snipe-it

Description It was found that if a user is not having access to supplier module, he can access and view the supplier content. Proof of Concept 1. Create two users, one admin and one normal user 2. A normal user is not having access to the supplier module. 3. But by enumeration the normal user vie...