Cross-site Scripting (XSS) - Stored in snipe/snipe-it

Description Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a differen...

GHSA-553Q-HPVP-Q8PC Server-Side Request Forgery in snipe/snipe-it

Admin users on the external network can perform blind POST-based SSRF issue requests on behalf of the server into the internal network via the Slack Integration. This vulnerability is capable of port-scanning of the internal network, issue POST requests to web servers on the internal network whic...

Server-Side Request Forgery in snipe/snipe-it

Admin users on the external network can perform blind POST-based SSRF issue requests on behalf of the server into the internal network via the Slack Integration. This vulnerability is capable of port-scanning of the internal network, issue POST requests to web servers on the internal network whic...

CVE-2021-4089

snipe-it is vulnerable to Improper Access Control...

CVE-2021-4089

snipe-it is vulnerable to Improper Access Control...

CVE-2021-4089

snipe-it is vulnerable to Improper Access Control...

Improper access control

snipe-it is vulnerable to Improper Access Control...

CVE-2021-4089 Improper Access Control in snipe/snipe-it

snipe-it is vulnerable to Improper Access Control...

CVE-2021-4089

Snipe-IT is affected by an Improper Access Control vulnerability (CVE-2021-4089) affecting versions prior to 5.3.4. The issue arises because regular users with DENY to all models permissions can still view model data via the /models/{id}/clone endpoint due to missing authorize('view') checks. Imp...

Snipe-IT 访问控制错误漏洞

Snipe-IT is an open source IT asset/license management system. snipe-it is vulnerable to an access control error, and no details of the vulnerability are currently available...

PT-2021-23007 · Snipe-It · Snipe-It

Name of the Vulnerable Software and Affected Versions: snipe-it versions prior to 5.3.4 Description: The issue is related to Improper Access Control. Regular users with DENY set to all models permissions can still view model information via the "/models/id/clone" endpoint due to no authorize'view...

Improper Access Control in snipe/snipe-it

Description Regular users with DENY set to all models permissions can still view model information via the /models/id/clone endpoint due to no authorize'view' permission being set. Proof of Concept 1: Create regular user and set DENY to all permissions in asset models. 2: Login as the user 3:...

Snipe-IT code issue vulnerability

Snipe-IT is an open source IT asset/license management system. snipe-IT is vulnerable to a code issue that could be exploited by attackers to conduct server-side request forgery SSRF attacks...

Server-Side Request Forgery (SSRF)

snipe/snipe-it is vulnerable to server-side request forgery. An attacker can send requests on behalf of the server into the internal network via slack integration...

CVE-2021-4075

snipe-it is vulnerable to Server-Side Request Forgery SSRF...

CVE-2021-4075

snipe-it is vulnerable to Server-Side Request Forgery SSRF...

CVE-2021-4075

snipe-it is vulnerable to Server-Side Request Forgery SSRF...

Server side request forgery (ssrf)

snipe-it is vulnerable to Server-Side Request Forgery SSRF...

CVE-2021-4075 Server-Side Request Forgery (SSRF) in snipe/snipe-it

snipe-it is vulnerable to Server-Side Request Forgery SSRF...

CVE-2021-4075

CVE-2021-4075 (snipe/snipe-it) is corroborated across multiple sources as a Server-Side Request Forgery (SSRF) issue. The connected advisories identify the vulnerability as exploitable via the Slack integration, enabling blind POST-based SSRF where an attacker with admin access could issue reques...