Skip to content
OpenAdvisories

Vendor

snipe

28 known vulnerabilities.

Products

snipe/snipe-it 26 snipe-it 2
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 7.6
    CVE-2024-5685

    Broken Function Level Authorization (BFLA) in snipe/snipe-it

    Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1.

    snipe snipe-it snipe/snipe-it Packagist
  • High 8.8
    CVE-2022-23064

    Snipe-IT - Host Header Injection

    In Snipe-IT, versions v3.0-alpha to v5.3.7 are vulnerable to Host Header Injection. By sending a specially crafted host header in the reset password request, it is possible to send password reset links to users which once clicked lead to an attacker controlle…

    snipe snipe-it snipe/snipe-it Packagist
  • High 7.4
    CVE-2022-1155

    Old sessions are not blocked by the login enable function. in snipe/snipe-it

    Old sessions are not blocked by the login enable function. in GitHub repository snipe/snipe-it prior to 5.3.10.

    snipe snipe/snipe-it snipe/snipe-it Packagist
  • High 8.0
    CVE-2021-3961

    Cross-site Scripting (XSS) - Stored in snipe/snipe-it

    snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

    snipe snipe/snipe-it snipe/snipe-it Packagist