819 matches found
PT-2022-4504 · Snipe-It · Snipe-It
Name of the Vulnerable Software and Affected Versions: snipe-it versions prior to 6.0.11 Description: The issue is related to a Cross-site Scripting XSS - Stored vulnerability. It exists due to inadequate protection of the web page structure, allowing a remote attacker to conduct an inter-site...
Snipe-IT 跨站脚本漏洞
Snipe-IT is an open source IT asset/license management system. A cross-site scripting vulnerability exists in Snipe-IT versions prior to v6.0.11, which originates from a user with Super Administrator privileges being able to implement cross-site scripting via a Markdown Input field...
Session Fixation
snipe/snipe-it is vulnerable to session fixation. The vulnerability exists in passwordsave function in ProfileController.php due to not logging the user out of other devices when changing the password which allows the attacker to submit an old password session link to access the system...
Insufficient Session Expiration in snipe/snipe-it
Session Fixation in GitHub repository snipe/snipe-it prior to version 6.0.10. The session is not invalidated after a password change...
CVE-2022-2997
Session Fixation in GitHub repository snipe/snipe-it prior to 6.0.10...
CVE-2022-2997
Session Fixation in GitHub repository snipe/snipe-it prior to 6.0.10...
Session fixation
Session Fixation in GitHub repository snipe/snipe-it prior to 6.0.10...
CVE-2022-2997 Session Fixation in snipe/snipe-it
Session Fixation in GitHub repository snipe/snipe-it prior to 6.0.10...
CVE-2022-2997
CVE-2022-2997 affects the Snipe-IT project (snipe/snipe-it) prior to 6.0.10. Root cause: a session-fixation issue where the session is not invalidated after a password change. Impact: could enable unauthorized access to user accounts if exploited. Remediation: upgrade to version 6.0.10 or later; ...
CVE-2022-2997 Session Fixation in snipe/snipe-it
Session Fixation in GitHub repository snipe/snipe-it prior to 6.0.10...
PT-2022-19934 · Snipe · Snipe-It
Name of the Vulnerable Software and Affected Versions: snipe/snipe-it versions prior to 6.0.10 Description: The issue concerns a session fixation problem where the session is not invalidated after a password change. This could potentially allow unauthorized access to user accounts. Recommendation...
Snipe-IT 授权问题漏洞
Session is a new type of encrypted private messenger open-sourced by Oxen. An authorization issue vulnerability exists in Snipe-IT versions prior to 6.0.10, which stems from the fact that sessions do not expire after a password change...
Session Fixation
Description The session is not invalidated after a password change. Proof of Concept Open Snipe-IT in the browser and login. Do the same in a private window such that there are two sessions. Change the password in one of the two sessions and observe that the second session is not invalidated...
Remote Code Execution
snipe/snipe-it is vulnerable to remote code execution. The vulnerability exists in the Select User function under the People Menu component which allows an attacker with admin privileges to inject remote code to a user via maliciously crafted pdf files...
Arbitrary File Upload
snipe/snipe-it is vulnerable to arbitrary file upload. The vulnerability exists in the store function in AcceptanceController.php due to improper validation of the update branding settings component, allowing an attacker to inject and execute arbitrary code through a maliciously crafted file...
GHSA-XWQX-X38C-CW95 Snipe-IT 6.0.2 vulnerable to Cross-site Scripting
An arbitrary file upload vulnerability in the Select User function under the People Menu component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file...
GHSA-W82X-XJJR-CJR5 Snipe-IT 6.0.2 vulnerable to Cross-site Scripting via arbitrary file upload in Update Branding Settings
An arbitrary file upload vulnerability in the Update Branding Settings component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file...
Snipe-IT 6.0.2 vulnerable to Cross-site Scripting via arbitrary file upload in Update Branding Settings
An arbitrary file upload vulnerability in the Update Branding Settings component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file...
Snipe-IT 6.0.2 vulnerable to Cross-site Scripting
An arbitrary file upload vulnerability in the Select User function under the People Menu component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file...