CVE-2022-44381

Snipe-IT (open source IT asset/license management) up to version 6.0.14 is affected. The vulnerability arises from response variations in the /password/reset endpoint that allow an attacker to determine whether a given user account exists (user enumeration). Impact is limited to information discl...

CSV Injection in CSV files generated by the backend

Description Formula Elements are not sanitized before adding to CSV reports. This leads to CSV formula injection. Proof of Concept Steps to reproduce: 1. Log in to Snipe-IT & create a new Asset with arbitrary values. For the Asset Tag enter =1+1 Screenshot 1 2. Got to Reports - Custom Asset Repor...

Improper Authentication

snipe/snipe-it is vulnerable to improper authentication. A remote authenticated attacker is able to access unauthorized files through the viewKeys function as long as they have the View permission, which exposes confidential information required to create the API keys without the corresponding...

GHSA-FHVV-P968-6VVJ Snipe-IT vulnerable to Improper Authentication

Snipe-IT prior to 6.0.10 is vulnerable to Improper Authentication. A user without the View and Modify License Files permission may access files uploaded to licenses as long as they have the View permission for licenses...

Snipe-IT vulnerable to Improper Authentication

Snipe-IT prior to 6.0.10 is vulnerable to Improper Authentication. A user without the View and Modify License Files permission may access files uploaded to licenses as long as they have the View permission for licenses...

CVE-2022-3173

Improper Authentication in GitHub repository snipe/snipe-it prior to 6.0.10...

CVE-2022-3173

Improper Authentication in GitHub repository snipe/snipe-it prior to 6.0.10...

Authentication flaw

Improper Authentication in GitHub repository snipe/snipe-it prior to 6.0.10...

CVE-2022-3173 Improper Authentication in snipe/snipe-it

Improper Authentication in GitHub repository snipe/snipe-it prior to 6.0.10...

CVE-2022-3173

CVE-2022-3173 affects Snipe-IT prior to 6.0.10. The issue is improper authentication/authorization, allowing a user with only limited license-view permissions to access files uploaded to licenses and, per sources, to create API keys despite lacking permission. Documents indicate a remote authenti...

Snipe-IT 授权问题漏洞

Snipe-IT is an open source IT asset/license management system. An authorization issue vulnerability exists in Snipe-IT versions prior to 6.0.10 that stems from incorrect authentication...

Cross-Site Scripting (XSS)

snipe/snipe-it is vulnerable to cross-site scripting. The vulnerability exists in views/dashboard.blade.php and login.blade.php because the user inputs are not properly escaped which allows a remote attacker to inject and execute malicious code into the system...

GHSA-RFF2-VQM3-JPV5 snipe-it vulnerable to cross-site scripting (XSS)

Cross-site Scripting XSS - Stored in GitHub repository snipe/snipe-it prior to v6.0.11...

snipe-it vulnerable to cross-site scripting (XSS)

Cross-site Scripting XSS - Stored in GitHub repository snipe/snipe-it prior to v6.0.11...

The vulnerability of the IT asset management system snipe-it arises from the lack of measures taken to protect the website structure. This vulnerability allows attackers to carry out XSS attacks.

The vulnerability of the IT asset management system snipe-it exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

CVE-2022-3035

Cross-site Scripting XSS - Stored in GitHub repository snipe/snipe-it prior to v6.0.11...

CVE-2022-3035

Cross-site Scripting XSS - Stored in GitHub repository snipe/snipe-it prior to v6.0.11...

CVE-2022-3035 Cross-site Scripting (XSS) - Stored in snipe/snipe-it

Cross-site Scripting XSS - Stored in GitHub repository snipe/snipe-it prior to v6.0.11...

CVE-2022-3035 Cross-site Scripting (XSS) - Stored in snipe/snipe-it

Cross-site Scripting XSS - Stored in GitHub repository snipe/snipe-it prior to v6.0.11...

CVE-2022-3035

CVE-2022-3035 is a Stored XSS vulnerability affecting Snipe-IT prior to version 6.0.11. Multiple sources (NVD/NVD-listed entry, OSV, Veracode, CVE list) consistently describe Cross-site Scripting in the web app, originating from insufficient escaping/input handling in the UI when processing user ...