Snipeitapp Snipe-IT

Snipe-IT 8.6.3 Authorization Bypass via Asset Update Endpoint

Snipe-IT before 8.7.0 Information Disclosure via Custom Fields

Snipe-IT 8.6.4 before 8.7.0 Permission Bypass via assigned components

Snipe-IT before 8.7.0 Missing Authorization via asset-history CSV importer

Snipe-IT 8.6.3 Race Condition via Consumable Checkout

Snipe-IT: Open redirect vulnerability

Snipe-IT: Improper Privilege Management

snipe-it before 8.7.0 Data Loss via Failed Image Write

Snipe-IT before 8.7.0 Database Wipe via Invalid Backup Archive

Cross-site Scripting (XSS) - Stored in snipe/snipe-it

Snipe-IT before 7.0.10 allows remote code execution (associated with cookie serialization) when an attacker knows the APP_KEY. This is exacerbated by .env files, available from the product's repository, that have default APP_KEY values.

Missing Authorization in snipe/snipe-it

Missing Authorization in snipe/snipe-it

Snipe-IT: Path traversal vulnerability via CSV import `image` field

An improper authorization vulnerability in the /api/v1/users/{id} endpoint of Snipe-IT v8.4.0 allows authenticated attackers with the users.edit permission to modify sensitive authentication and account-state fields of other non-admin users via supplying a crafted PUT request.

Snipe-IT before 8.7.0 CSV Formula Injection via Asset Acceptance Report

Snipe-IT's selectlist visibility is too permissive

Snipe-IT before 8.7.0 CSV Formula Injection via Location-Scoping Export

Snipe-IT before 8.7.0 Acceptance Finalization Without Stored Evidence

Cross-site Scripting (XSS) - Stored in snipe/snipe-it

Snipe-IT before 8.1.18 allows XSS.

Cross-site Scripting (XSS) - Stored in snipe/snipe-it

Missing Authorization in snipe/snipe-it

Missing Authorization in snipe/snipe-it

Snipe-IT before 8.7.0 Broken Access Control via AssetModelPolicy

Snipe-IT: CSS Injection via `header_color` Setting

Snipe-IT before 4.6.14 has XSS, as demonstrated by log_meta values and the user's last name in the API.

Cross-site Scripting (XSS) - Generic in snipe/snipe-it

Snipe-IT 8.5.0 through 8.6.3 Open Redirect via SAML RelayState

Snipe-IT: Open Redirect After User Edit

Snipe-IT v8.3.4 (build 20218) contains a reflected cross-site scripting (XSS) vulnerability in the CSV Import workflow. When an invalid CSV file is uploaded, the application returns a progress_message value that is rendered as raw HTML in the admin interface. An attacker can intercept and modify the POST /livewire/update request to inject arbitrary HTML or JavaScript into the progress_message. Because the server accepts the modified input without sanitization and reflects it back to the user, arbitrary JavaScript executes in the browser of any authenticated admin who views the import page. NOTE: this is disputed by the Supplier because the report only demonstrates that an authenticated user can choose to conduct a man-in-the-middle attack against himself.

Cross-site Scripting (XSS) - Stored in snipe/snipe-it

snipe-it before 8.7.0 SSRF via IPv6 transition address bypass

Snipe-IT: Import created_by can be overwritten

Cross-site Scripting (XSS) - Stored in snipe/snipe-it

Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment

Cross-site Scripting (XSS) - Generic in snipe/snipe-it

Snipe-IT before 6.0.14 is vulnerable to Cross Site Scripting (XSS) for View Assigned Assets.

snipe-it 8.2.0 before 8.7.0 Authentication Bypass via activated flag

Snipe-IT before 8.7.0 Improper Input Validation via API Checkout