Improper Access Control in snipe/snipe-it

Description All bulk actions bulk-edit / bulk-delete / form info in asset models do not have access control checks Proof of concept 1: Grant view to Asset Models 2: UI for bulk-edit and bulk-delete is still enabled, proceed. 3: You may bulk-delete / edit any asset model Impact This vulnerability ...

BMC Community Track-It! 代码问题漏洞

BMC Community Track-It! is an It helpdesk software from BMC Community USA. It is used for help desks and helpdesks with asset management. A code issue vulnerability exists in BMC Community Track-It! that stems from the handling of email attachments that exist. The issue is caused due to a lack of...

BMC Track-It! Unrestricted File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of BMC Track-It!. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of email attachments. The issue results from the lack of proper validation of...

PT-2022-10384 · Bmc · Bmc Track-It!

Name of the Vulnerable Software and Affected Versions: BMC Track-It! affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of BMC Track-It!. Authentication is required to exploit this issue. The specific flaw exists...

BMC Community Track-It! 授权问题漏洞

BMC Community Track-It! is an It helpdesk software from BMC Community USA. It is used for help desks and helpdesks with asset management. An authorization issue vulnerability exists in BMC Community Track-It! that originates in the GetData endpoint. The issue is caused due to a lack of...

PT-2022-10383 · Bmc · Bmc Track-It!

Name of the Vulnerable Software and Affected Versions: BMC Track-It! affected versions not specified Description: This issue allows remote attackers to disclose sensitive information on affected installations of BMC Track-It!. Authentication is required to exploit this issue. The specific flaw...

GHSA-4W23-C97G-FQ5V snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)

snipe-it is vulnerable to Cross-Site Request Forgery CSRF...

snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)

snipe-it is vulnerable to Cross-Site Request Forgery CSRF...

CVE-2021-43779

GLPI is an open source IT Asset Management, issue tracking system and service desk system. The GLPI addressing plugin in versions 2.9.1 suffers from authenticated Remote Code Execution vulnerability, allowing access to the server's underlying operating system using command injection abuse of...

CVE-2021-43779

GLPI is an open source IT Asset Management, issue tracking system and service desk system. The GLPI addressing plugin in versions 2.9.1 suffers from authenticated Remote Code Execution vulnerability, allowing access to the server's underlying operating system using command injection abuse of...

Remote code execution

GLPI is an open source IT Asset Management, issue tracking system and service desk system. The GLPI addressing plugin in versions 2.9.1 suffers from authenticated Remote Code Execution vulnerability, allowing access to the server's underlying operating system using command injection abuse of...

CVE-2021-43779

GLPI is an open source IT Asset Management, issue tracking system and service desk system. The GLPI addressing plugin in versions 2.9.1 suffers from authenticated Remote Code Execution vulnerability, allowing access to the server's underlying operating system using command injection abuse of...

CVE-2021-43779

CVE-2021-43779 affects GLPI with the addressing plugin in versions

showdoc Cross-site Request Forgery Vulnerability (CNVD-2022-02730)

showdoc is an open source tool ideal for IT teams to share documents online. showdoc suffers from a cross-site request forgery vulnerability, which stems from a WEB application that does not sufficiently validate that the request is from a trusted user. An attacker could use this vulnerability to...

Log4j “Log4Shell” RCE explained (CVE-2021-44228)

Hello everyone! I decided to make a separate episode about Log4Shell. Of course, there have already been many reviews of this vulnerability. But I do it primarily for myself. It seems to me that serious problems with Log4j and similar libraries will be with us for a long time. Therefore, it would...

Mitigating Log4Shell and Other Log4j-Related Vulnerabilities

Summary The Cybersecurity and Infrastructure Security Agency CISA, the Federal Bureau of Investigation FBI, National Security Agency NSA, Australian Cyber Security Centre ACSC, Canadian Centre for Cyber Security CCCS, the Computer Emergency Response Team New Zealand CERT NZ, the New Zealand...

Why I’m Proud to Protect Billions of People Worldwide

I decided to pursue a career in IT after working as a support engineer for internal employees as part of my very first job. It immediately opened my eyes to something that I found as interesting as I did shocking: Lots of people don’t understand information security — and what’s more, they don’t...

snipe-it cross-site request forgery vulnerability (CNVD-2022-08728)

Snipe-IT is an open source IT asset/license management system. snipe-it is vulnerable to cross-site request forgery, no details of the vulnerability are provided...

Qualys Integrates with Shodan to Help Map the External Attack Surface

Qualys CyberSecurity Asset Management CSAM now natively integrates with Shodan to enable cybersecurity teams to identify all assets visible on the internet, including previously unknown and potential security issues… before attackers find them. Your attack surface is dynamic. Assets come and go,...

Cross-Site Request Forgery (CSRF)

snipe/snipe-it is vulnerable to cross-site request forgery. The vulnerability exists in the getRequestAsset in the ViewAssetsController.php, allowing an attacker to disrupt request tracking by sending the malicious HTML...