822 matches found
CVE-2024-5685
Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1...
CVE-2024-5685 Broken Function Level Authorization (BFLA) in snipe/snipe-it
Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1...
CVE-2024-5685 Broken Function Level Authorization (BFLA) in snipe/snipe-it
Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1...
CVE-2024-5685
CVE-2024-5685 affects Snipe-IT (versions v4.6.17–v6.4.1). The root cause is missing authorization checks in the API endpoint that allows users with User:edit and Self:api permissions to modify group memberships, enabling promotion/demotion of users. Remediation: upgrade to v6.4.2 or later (as ref...
CVE-2024-5685 Broken Function Level Authorization (BFLA) in snipe/snipe-it
Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1...
Snipe-IT Security Breach
Snipe-IT is an open source IT asset/license management system. A security vulnerability exists in Snipe-IT versions v4.6.17 through v6.4.1, which stems from an API call that allows users to make changes to group membership to promote or demote themselves or other users...
GHSA-MRQG-MWH7-Q94J Host header injection in the password reset
Summary The password reset functionality sends to the the user requesting a password change an email containing an URL to reset its password. The URL sent contains a unique token, valid during 24 hours, allowing the user to reset its password. This token is highly sensitive ; as an attacker able ...
Host header injection in the password reset
Summary The password reset functionality sends to the the user requesting a password change an email containing an URL to reset its password. The URL sent contains a unique token, valid during 24 hours, allowing the user to reset its password. This token is highly sensitive ; as an attacker able ...
Cross-Site Request Forgery (CSRF)
snipe/snipe-it is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability occurs because the library defaults to using the GET method for the resend remainder acceptance option instead of POST, enabling an attacker to send malicious reminders and perform unauthorized actions...
Cross-Site Request Forgery (CSRF) in snipe/snipe-it
Cross-Site Request Forgery CSRF in GitHub repository snipe/snipe-it prior to v.6.2.3...
CVE-2023-5511
Cross-Site Request Forgery CSRF in GitHub repository snipe/snipe-it prior to v.6.2.3...
Cross site request forgery (csrf)
Cross-Site Request Forgery CSRF in GitHub repository snipe/snipe-it prior to v.6.2.3...
CVE-2023-5511
CVE-2023-5511 : Cross-Site Request Forgery in the GitHub repository snipe/snipe-it prior to v6.2.3. The weakness is triggered by CSRF in the snipe-it web app, with analysis across sources indicating the issue derives from request handling for the resend remainder acceptance option (defaulting to ...
CVE-2023-5511 Cross-Site Request Forgery (CSRF) in snipe/snipe-it
Cross-Site Request Forgery CSRF in GitHub repository snipe/snipe-it prior to v.6.2.3...
CVE-2023-5511 Cross-Site Request Forgery (CSRF) in snipe/snipe-it
Cross-Site Request Forgery CSRF in GitHub repository snipe/snipe-it prior to v.6.2.3...
CVE-2023-5511 Cross-Site Request Forgery (CSRF) in snipe/snipe-it
Cross-Site Request Forgery CSRF in GitHub repository snipe/snipe-it prior to v.6.2.3...
PT-2023-32143 · Unknown · Snipe/Snipe-It
Name of the Vulnerable Software and Affected Versions: snipe/snipe-it versions prior to 6.2.3 Description: The issue is related to Cross-Site Request Forgery CSRF in the GitHub repository snipe/snipe-it. CSRF is a type of attack where an attacker tricks a user into performing unintended actions o...
Cross Site Scripting (XSS)
snipe/snipe-it is vulnerable to Cross Site Scripting XSS. The vulnerability is caused by not sanitizing/escaping asset history values while displaying the values on the browser on the view asset page. An attacker can inject malicious JavaScript while editing assets in the location field leading t...
Snipe-IT Cross-Site Request Forgery Vulnerability
Snipe-IT is an open source IT asset/license management system. A cross-site request forgery vulnerability exists in Snipe-IT versions prior to v.6.2.3, which stems from vulnerability to cross-site request forgery CSRF attacks...