Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
GHSA-396x-xmvh-p563
  • Packagist/snipe/snipe-it
 Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API 24 Sep
  • Fix available
  • Severity - 8.7 (High)
GHSA-p9h3-gvpq-5539
  • Packagist/snipe/snipe-it
 Snipe-IT: Stored XSS via Custom Field name in asset-list column headers 24 Sep
  • Fix available
  • Severity - 8.1 (High)
GHSA-hxcx-9h4f-42xx
  • Packagist/snipe/snipe-it
 Snipe-IT: 2FA bypass via the API token flow 24 Sep
  • Fix available
  • Severity - 8.6 (High)
GHSA-j5g3-42wp-gqm3
  • Packagist/snipe/snipe-it
 Snipe-IT has an Improper Privilege Management issue 28 Aug
  • Fix available
  • Severity - 7.0 (High)
GHSA-575r-357h-fhch
  • Packagist/snipe/snipe-it
 Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API update 28 Aug
  • Fix available
  • Severity - 7.7 (High)
GHSA-35cr-9hqq-p2mg
  • Packagist/snipe/snipe-it
 Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint 28 Aug
  • Fix available
  • Severity - 5.0 (Medium)
GHSA-w7qw-5wfv-gwx9
  • Packagist/snipe/snipe-it
 Snipe-IT has CSS Injection via `header_color` Setting 28 Aug
  • Fix available
  • Severity - 6.2 (Medium)
GHSA-8frh-vhgh-64cf
  • Packagist/snipe/snipe-it
 Snipe-IT has incorrect permission for legacy license checkin API 28 Aug
  • Fix available
  • Severity - 5.3 (Medium)
GHSA-crv3-j83j-f3r6
  • Packagist/snipe/snipe-it
 Snipe-IT has missing object-level authorization in Kits API 28 Aug
  • Fix available
  • Severity - 5.3 (Medium)
GHSA-53jc-27pc-x8r8
  • Packagist/snipe/snipe-it
 Snipe-IT Vulnerable to Unauthorized Asset Request Cancellation via Unguarded cancel_by_admin Parameter 28 Aug
  • Fix available
  • Severity - 5.3 (Medium)
GHSA-5wx7-xq8j-v4qm
  • Packagist/snipe/snipe-it
 Snipe-IT's import created_by can be overwritten 28 Aug
  • Fix available
  • Severity - 5.7 (Medium)
GHSA-c6f4-wj38-m3g3
  • Packagist/snipe/snipe-it
 Snipe-IT vulnerable to directory traversal in displaySig 28 Aug
  • Fix available
  • Severity - 7.1 (High)
GHSA-8w8c-8mx9-52cw
  • Packagist/snipe/snipe-it
 Snipe-IT's API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation 28 Aug
  • Fix available
  • Severity - 4.3 (Medium)
GHSA-xr9m-gphc-9p63
  • Packagist/snipe/snipe-it
 Snipe-IT has a path traversal vulnerability via CSV import `image` field 28 Aug
  • Fix available
  • Severity - 0.0 (None)
GHSA-jhph-5q74-pmfx
  • Packagist/snipe/snipe-it
 Snipe-IT vulnerable to stored XSS via inline-served attachment 28 Aug
  • Fix available
  • Severity - 6.2 (Medium)
GHSA-r52f-r9v5-66xr
  • Packagist/snipe/snipe-it
 Snipe-IT vulnerable to stored XSS via Markdown custom field 28 Aug
  • Fix available
  • Severity - 4.8 (Medium)
Load more...