CVE-2024-5685 | High | 7.6 | 2024-06-14 | Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call… |
CVE-2023-5511 | High | 8.8 | 2023-10-11 | Cross-Site Request Forgery (CSRF) in GitHub repository snipe/snipe-it prior to v.6.2.3. |
CVE-2023-5452 | Medium | 5.4 | 2023-10-06 | Cross-site Scripting (XSS) - Stored in GitHub repository snipe/snipe-it prior to v6.2.2. |
CVE-2022-3173 | Medium | 4.3 | 2022-09-17 | Improper Authentication in GitHub repository snipe/snipe-it prior to 6.0.10. |
CVE-2022-3035 | Medium | 4.8 | 2022-08-29 | Cross-site Scripting (XSS) - Stored in GitHub repository snipe/snipe-it prior to v6.0.11. |
CVE-2022-2997 | High | 8.0 | 2022-08-25 | Session Fixation in GitHub repository snipe/snipe-it prior to 6.0.10. |
CVE-2022-23064 | High | 8.8 | 2022-05-02 | In Snipe-IT, versions v3.0-alpha to v5.3.7 are vulnerable to Host Header Injection. By sending a specially crafted host header in the reset password request, i… |
CVE-2022-1511 | Medium | 6.5 | 2022-04-28 | Missing Authorization in GitHub repository snipe/snipe-it prior to 5.4.4. |
CVE-2022-1445 | Medium | 5.4 | 2022-04-24 | Stored Cross Site Scripting vulnerability in the checked_out_to parameter in GitHub repository snipe/snipe-it prior to 5.4.3. The vulnerability is capable of s… |
CVE-2022-1380 | Medium | 5.4 | 2022-04-16 | Stored Cross Site Scripting vulnerability in Item name parameter in GitHub repository snipe/snipe-it prior to v5.4.3. The vulnerability is capable of stolen th… |
CVE-2022-1155 | High | 7.4 | 2022-03-30 | Old sessions are not blocked by the login enable function. in GitHub repository snipe/snipe-it prior to 5.3.10. |
CVE-2022-0622 | Medium | 5.3 | 2022-02-17 | Generation of Error Message Containing Sensitive Information in Packagist snipe/snipe-it prior to 5.3.11. |
CVE-2022-0611 | Medium | 6.3 | 2022-02-16 | Missing Authorization in Packagist snipe/snipe-it prior to 5.3.11. |
CVE-2022-0579 | Medium | 6.5 | 2022-02-14 | Missing Authorization in Packagist snipe/snipe-it prior to 5.3.9. |
CVE-2022-0569 | Medium | 5.3 | 2022-02-14 | Observable Discrepancy in Packagist snipe/snipe-it prior to v5.3.9. |
CVE-2022-0178 | Medium | 6.3 | 2022-01-13 | Missing Authorization vulnerability in snipe snipe/snipe-it.This issue affects snipe/snipe-i before 5.3.8. |
CVE-2022-0179 | Medium | 5.4 | 2022-01-12 | snipe-it is vulnerable to Missing Authorization |
CVE-2021-4130 | High | 8.8 | 2021-12-18 | snipe-it is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-4108 | Medium | 6.1 | 2021-12-14 | snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2021-4089 | Medium | 4.3 | 2021-12-10 | snipe-it is vulnerable to Improper Access Control |
CVE-2021-4075 | High | 7.2 | 2021-12-06 | snipe-it is vulnerable to Server-Side Request Forgery (SSRF) |
CVE-2021-4018 | Medium | 5.4 | 2021-12-01 | snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2021-3961 | Medium | 5.4 | 2021-11-19 | snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2021-3938 | Medium | 5.4 | 2021-11-13 | snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2021-3931 | Medium | 4.3 | 2021-11-13 | snipe-it is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-3879 | Medium | 5.4 | 2021-10-19 | snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2021-3863 | Medium | 6.1 | 2021-10-19 | snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2021-3858 | High | 8.8 | 2021-10-19 | snipe-it is vulnerable to Cross-Site Request Forgery (CSRF) |