Snipeitapp: >> Snipe-It >> 5.3.9 Security Vulnerabilities
Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1.
CVSS Score
7.6
EPSS Score
0.004
Published
2024-06-14
Cross-Site Request Forgery (CSRF) in GitHub repository snipe/snipe-it prior to v.6.2.3.
CVSS Score
6.3
EPSS Score
0.003
Published
2023-10-11
Cross-site Scripting (XSS) - Stored in GitHub repository snipe/snipe-it prior to v6.2.2.
CVSS Score
5.5
EPSS Score
0.005
Published
2023-10-06
Snipe-IT through 6.0.14 allows attackers to check whether a user account exists because of response variations in a /password/reset request.
CVSS Score
5.3
EPSS Score
0.006
Published
2022-12-25
Snipe-IT before 6.0.14 is vulnerable to Cross Site Scripting (XSS) for View Assigned Assets.
CVSS Score
5.4
EPSS Score
0.005
Published
2022-12-25
Improper Authentication in GitHub repository snipe/snipe-it prior to 6.0.10.
CVSS Score
4.3
EPSS Score
0.008
Published
2022-09-17
Cross-site Scripting (XSS) - Stored in GitHub repository snipe/snipe-it prior to v6.0.11.
CVSS Score
5.9
EPSS Score
0.007
Published
2022-08-29
Session Fixation in GitHub repository snipe/snipe-it prior to 6.0.10.
CVSS Score
4.6
EPSS Score
0.009
Published
2022-08-25
Missing Authorization in GitHub repository snipe/snipe-it prior to 5.4.4.
CVSS Score
6.5
EPSS Score
0.01
Published
2022-04-28
Stored Cross Site Scripting vulnerability in the checked_out_to parameter in GitHub repository snipe/snipe-it prior to 5.4.3. The vulnerability is capable of stolen the user Cookie.
CVSS Score
9.0
EPSS Score
0.008
Published
2022-04-24