Snipeitapp Snipe-IT

Cross-site Scripting (XSS) - Generic in snipe/snipe-it

Snipe-IT 8.5.0 through 8.6.3 Open Redirect via SAML RelayState

Snipe-IT: Open Redirect After User Edit

Snipe-IT v8.3.4 (build 20218) contains a reflected cross-site scripting (XSS) vulnerability in the CSV Import workflow. When an invalid CSV file is uploaded, the application returns a progress_message value that is rendered as raw HTML in the admin interface. An attacker can intercept and modify the POST /livewire/update request to inject arbitrary HTML or JavaScript into the progress_message. Because the server accepts the modified input without sanitization and reflects it back to the user, arbitrary JavaScript executes in the browser of any authenticated admin who views the import page. NOTE: this is disputed by the Supplier because the report only demonstrates that an authenticated user can choose to conduct a man-in-the-middle attack against himself.

Cross-site Scripting (XSS) - Stored in snipe/snipe-it

Snipe-IT: TOTP Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor`

snipe-it before 8.7.0 SSRF via IPv6 transition address bypass

Snipe-IT: Import created_by can be overwritten

Cross-site Scripting (XSS) - Stored in snipe/snipe-it

Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment

Cross-site Scripting (XSS) - Generic in snipe/snipe-it

Snipe-IT before 6.0.14 is vulnerable to Cross Site Scripting (XSS) for View Assigned Assets.

snipe-it 8.2.0 before 8.7.0 Authentication Bypass via activated flag

Snipe-IT: Improper Authorization in File Deletion (IDOR)

Snipe-IT before 8.7.0 Improper Input Validation via API Checkout

Snipe-IT Checkout Request Cancellation IDOR

Snipe-IT: Stored XSS via Markdown custom field

Snipe-IT: Missing object-level authorization in Kits API

Snipe-IT 4.2.0 through 8.6.3 Permission Bypass via OAuth

Snipe-IT before 8.7.2 Authorization Bypass via Predefined Kit Checkout

Snipe-IT 8.6.3 Stored XSS via Department Names

snipe-it before 8.7.0 Authorization Bypass via Pivot-Only User

Snipe-IT 8.6.3 Broken Access Control via Kit Update Endpoints

snipe-it before 8.7.0 Authorization Bypass via Asset Audit Endpoints

Snipe-IT: XSS vulnerability in component notes

Snipe-IT before 8.3.4 allows stored XSS via the Locations "Country" field, enabling a low-privileged authenticated user to inject JavaScript that executes in another user's session.

Snipe-IT before 8.3.4 allows stored XSS, allowing a low-privileged authenticated user to inject JavaScript that executes in an administrator's session, enabling privilege escalation.

Observable Discrepancy in snipe/snipe-it

Generation of Error Message Containing Sensitive Information in snipe/snipe-it

Snipe-IT through 6.0.14 allows attackers to check whether a user account exists because of response variations in a /password/reset request.

Snipe-IT before 8.7.0 Authorization Bypass via Bulk Restore

snipe-it 8.6.3 before 8.7.0 Authorization Bypass via print endpoints

Snipe-IT: Unauthorized Asset Request Cancellation via Unguarded cancel_by_admin Parameter

Snipe-IT before 8.7.0 Cross-Company Read via requested-assets

Snipe-IT: Incorrect permission for legacy license checkin API

snipe-it before 8.7.0 Checkout Request Counter Integrity Failure

Snipe-IT before 8.7.0 Authorization Bypass via Asset Acceptance Report

snipe-it before 8.7.0 Missing Authorization via barcode endpoint

snipe-it before 8.7.0 Business Logic Bypass via asset_model endpoint

Snipe-IT before 8.7.0 Audit Log Misattribution via Consumables Checkout