CVE-2022-32061

An arbitrary file upload vulnerability in the Select User function under the People Menu component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file...

CVE-2022-32061

An arbitrary file upload vulnerability in the Select User function under the People Menu component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file...

CVE-2022-32061

An arbitrary file upload vulnerability in the Select User function under the People Menu component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file...

CVE-2022-32060

An arbitrary file upload vulnerability in the Update Branding Settings component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file...

CVE-2022-32060

An arbitrary file upload vulnerability in the Update Branding Settings component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file...

Design/Logic Flaw

An arbitrary file upload vulnerability in the Select User function under the People Menu component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file...

Design/Logic Flaw

An arbitrary file upload vulnerability in the Update Branding Settings component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file...

CVE-2022-32061

An arbitrary file upload vulnerability in the Select User function under the People Menu component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file...

CVE-2022-32061

CVE-2022-32061 affects Snipe-IT v6.0.2: the vulnerability is an arbitrary file upload in the Select User function under the People Menu component, enabling an attacker to execute arbitrary code via a crafted file. The connected sources confirm the affected product and the basic impact but do not ...

CVE-2022-32060

An arbitrary file upload vulnerability in the Update Branding Settings component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file...

Snipe-IT 跨站脚本漏洞

Snipe-IT is an open source IT asset/license management system. A security vulnerability exists in Snipe-IT v6.0.2, which can be exploited by an attacker to execute arbitrary code due to a malicious file that can be uploaded on the People menu page...

PT-2022-21083 · Snipe-It · Snipe-It

Name of the Vulnerable Software and Affected Versions: Snipe-IT version 6.0.2 Description: The issue allows attackers to execute arbitrary code via a crafted file, exploiting an arbitrary file upload vulnerability in the Update Branding Settings component. Recommendations: For Snipe-IT version...

Snipe-IT 跨站脚本漏洞

Snipe-IT is an open source IT asset/license management system. A security vulnerability exists in Snipe-IT version v6.0.2, which originates from a malicious file that can be uploaded on the Update Branding Settings page and can be exploited by an attacker to execute arbitrary code...

The vulnerability of the password reset function of the Snipe-IT asset management system allows a hacker to obtain a password reset token and access the account.

The vulnerability of the password reset function in the Snipe-IT asset management system is related to incorrect elimination of certain elements in the output data. Exploiting this vulnerability can allow a malicious actor to obtain a password reset token and access to the account by sending a...

CVE-2022-1380

Stored Cross Site Scripting vulnerability in Item name parameter in GitHub repository snipe/snipe-it prior to v5.4.3. The vulnerability is capable of stolen the user Cookie...

GHSA-FX98-8W93-4MXR Snipe-IT XSS Vulnerability

Snipe-IT before 4.6.14 has XSS, as demonstrated by logmeta values and the user's last name in the API...

Improper Neutralization of Input During Web Page Generation in Select2

In Select2 through 4.0.5, as used in Snipe-IT and other products, rich selectlists allow XSS. This affects use cases with Ajax remote data loading when HTML templates are used to display listbox data...

Snipe-IT XSS Vulnerability

Snipe-IT before 4.6.14 has XSS, as demonstrated by logmeta values and the user's last name in the API...

Able to create an user with a long password as well as long username

Issue Description: Any admin may able to create and allocate user the credentials but when admin creates a user account where as the fields with the first name , last name and password has no defined length limit where as this scenario causes the application level DOS to the snipe-it What's the...

Host Header Injection

snipe/snipe-it is vulnerable to host header injection. An attacker is able to reset the password and take over an user account by luring the victim to an attacker controlled server via a maliciously crafted password request link...