snipe/snipe-it vulnerabilities (Packagist)
81 vulnerabilities.
-
snipe/snipe-itPackagist Snipe-IT: Stored XSS via Custom Field name in asset-list column headers 8.1 High -
snipe/snipe-itPackagist Snipe-IT: 2FA bypass via the API token flow 8.6 High -
snipe/snipe-itPackagist Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API 8.7 High -
snipe/snipe-itPackagist Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover 7.1 High -
snipe/snipe-itPackagist Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode 7.6 High -
snipe/snipe-itPackagist Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GET 4.3 Medium -
snipe/snipe-itPackagist Snipe-IT: Stored DOM XSS via table selected-count IDs 6.3 Medium -
snipe/snipe-itPackagist Snipe-IT: CSS Injection via `header_color` Setting 6.2 Medium -
snipe/snipe-itPackagist Snipe-IT: Import created_by can be overwritten 5.7 Medium -
snipe/snipe-itPackagist Snipe-IT: Path traversal vulnerability via CSV import `image` field 6.5 Medium -
snipe/snipe-itPackagist Snipe-IT: Open Redirect After User Edit 6.1 Medium -
snipe/snipe-itPackagist Snipe-IT: Incorrect permission for legacy license checkin API 5.3 Medium -
snipe/snipe-itPackagist Snipe-IT: CSV formula injection in Activity Report export 4.8 Medium -
snipe/snipe-itPackagist Snipe-IT: Stored XSS via inline-served attachment 6.2 Medium -
snipe/snipe-itPackagist Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint 5.0 Medium -
snipe/snipe-itPackagist Snipe-IT: Authorization bypass on print inventory page 4.3 Medium -
snipe/snipe-itPackagist Snipe-IT: Stored XSS via Markdown custom field 4.8 Medium -
snipe/snipe-itPackagist Snipe-IT: Authorization bypass on bulk editing users 7.1 High -
snipe/snipe-itPackagist Snipe-IT: API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation 4.3 Medium -
snipe/snipe-itPackagist Snipe-IT: Unauthorized Asset Request Cancellation via Unguarded cancel_by_admin Parameter 5.3 Medium -
snipe/snipe-itPackagist Snipe-IT: Missing object-level authorization in Kits API 5.3 Medium -
snipe/snipe-itPackagist Snipe-IT: Improper Privilege Management 7.0 High -
snipe/snipe-itPackagist Snipe-IT: Cross-company asset maintenance re-parenting via API update 7.7 High -
snipe/snipe-itPackagist Snipe-IT: Directory traversal in displaySig 7.1 High -
snipe/snipe-itPackagist Snipe-IT: Cross-Tenant Accessory Injection in Snipe-IT API 8.5 High -
snipe/snipe-itPackagist Snipe-IT's S3 signature image retrieval lacks authorization before temporary URL 1.3 Low -
snipe/snipe-itPackagist Snipe-IT: Improper Authorization in File Deletion (IDOR) 5.4 Medium -
snipe/snipe-itPackagist Snipe-IT: Privilege Escalation via Missing admin Permission Check in User Creation 4.9 Medium -
snipe/snipe-itPackagist Snipe-IT: Multi-Tenancy Bypass via Bulk Asset Update 6.3 Medium -
snipe/snipe-itPackagist Snipe-IT: 2FA reset privilege bypass 5.8 Medium -
snipe/snipe-itPackagist Snipe-IT: User Account Escalation via CSV Import 6.5 Medium -
snipe/snipe-itPackagist Snipe-IT: TOTP Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor` 5.9 Medium -
snipe/snipe-itPackagist Snipe-IT's selectlist visibility is too permissive 4.9 Medium -
snipe/snipe-itPackagist Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment 5.5 Medium -
snipe/snipe-itPackagist Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users 7.1 High -
snipe/snipe-itPackagist Snipe-IT: Open redirect vulnerability 5.9 Medium -
snipe/snipe-itPackagist Snipe-IT: Privilege Escalation via API Permissions Assignment 8.7 High -
snipe/snipe-itPackagist Snipe-IT: XSS vulnerability in component notes 4.8 Medium -
snipe/snipe-itPackagist Snipe-IT has insecure permissions in file uploads 9.8 Critical -
snipe/snipe-itPackagist Snipe-IT < 8.3.7 Mass Assignment Vulnerability Leading to Privilege Escalation 8.7 High -
snipe/snipe-itPackagist Snipe-IT allows stored XSS via the Locations "Country" field 5.4 Medium -
snipe/snipe-itPackagist Snipe-IT is vulnerable to stored cross-site scripting 5.4 Medium -
snipe/snipe-itPackagist Snipe-IT has Cross-site Scripting vulnerability in CSV import workflow 6.1 Medium -
snipe/snipe-itPackagist Snipe-IT allows unsafe deserialization 6.8 Medium -
snipe/snipe-itPackagist Snipe-IT allows XSS 6.4 Medium -
snipe/snipe-itPackagist Grokability Snipe-IT has incorrect authorization for accessing asset information 5.0 Medium -
snipe/snipe-itPackagist Cross Site Scripting vulnerability in Snipe-IT 8.7 High -
snipe/snipe-itPackagist Snipe-IT remote code execution 6.6 Medium -
snipe/snipe-itPackagist Broken Function Level Authorization (BFLA) in snipe/snipe-it 7.6 High -
snipe/snipe-itPackagist Cross-Site Request Forgery (CSRF) in snipe/snipe-it 6.3 Medium - Show olderLoading…