Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
74 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Snipe-IT prior to 6.0.10 is vulnerable to Improper Authentication. A user without the View and Modify License Files permission may access files uploaded to licenses as long as they have the View permission for licenses.
Recommended action: Upgrade to 6.0.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site Scripting (XSS) - Stored in GitHub repository snipe/snipe-it prior to v6.0.11.
Recommended action: Upgrade to 6.0.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Session Fixation in GitHub repository snipe/snipe-it prior to version 6.0.10. The session is not invalidated after a password change.
Recommended action: Upgrade to 6.0.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Snipe-IT before 4.6.14 has XSS, as demonstrated by logmeta values and the user's last name in the API.
Recommended action: Upgrade to 4.6.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Snipe-IT is a free, open-source IT asset/license management systemIn Snipe-IT, versions v3.0-alpha to v5.3.7 are vulnerable to Host Header Injection. By sending a specially crafted host header in the reset password request, it is possible to send password reset links to users which once clicked lead to an attacker controlled server and thus leading to password reset token leak. This can lead to account take over.
Recommended action: Upgrade to 5.3.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Snipe-IT prior to 5.4.4 is vulnerable to Missing Authorization.
Recommended action: Upgrade to 5.4.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Snipe-IT prior to version 5.4.3 is vulnerable to stored cross-site scripting because the input to the checkedoutto parameter is not escaped. The vulnerability is capable of stealing a user's cookie.
Recommended action: Upgrade to 5.4.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Stored Cross Site Scripting vulnerability in Item name parameter in GitHub repository snipe/snipe-it prior to v5.4.3. The vulnerability is capable of stolen the user Cookie.
Recommended action: Upgrade to 5.4.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Snipe-IT is a FOSS project for asset management in IT Operations. In Snipe-IT versions 5.4.1 and 6.0.0-RC-5 and prior, active sessions are not revoked when a user account is disabled, allowing that user to still access information that they should no longer be able to. Workarounds include using the KillAllSessions console command, clearing the contents of the storage/framework/sessions directory, or changing the cookie name, but all of those options logout ALL users, which could be kind of annoying. This issue is fixed in versions 6.0.0-RC-6 and 5.4.2.
Recommended action: Upgrade to 6.0.0-RC-6 (pre-release) or 5.4.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Snipe-IT prior to version 5.3.11 is vulnerable to Generation of Error Message Containing Sensitive Information.
Recommended action: Upgrade to 5.3.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An unprivileged user of Snipe-IT prior to version 5.3.11 can create maintenance for an asset. Version 5.3.11 contains a patch for this issue.
Recommended action: Upgrade to 5.3.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Observable Discrepancy in Packagist snipe/snipe-it prior to v5.3.10.
Recommended action: Upgrade to 5.3.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Snipe-IT prior to 5.3.9 is vulnerable to improper privilege management. A user who does not have access to the supplier module may view supplier content.
Recommended action: Upgrade to 5.3.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Users with no system permissions are able to see and create personal access tokens
Recommended action: Upgrade to 5.3.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
snipe-it is vulnerable to Improper Access Control/Incorrect Default Permissions.
Recommended action: Upgrade to 5.3.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)
Recommended action: Upgrade to 5.3.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
snipe-it prior to version 5.3.4 is vulnerable to Improper Access Control. Regular users with DENY set to all models permissions can still view model information via the /models/{id}/clone endpoint due to no authorize('view') permission being set.
Recommended action: Upgrade to 5.3.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
Recommended action: Upgrade to 5.3.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
Recommended action: Upgrade to 5.3.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Recommended action: Upgrade to 5.3.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
Recommended action: Upgrade to 5.4.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Recommended action: Upgrade to 5.3.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
snipe-it is vulnerable to Cross-Site Request Forgery (CSRF).
Recommended action: Upgrade to 5.3.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Recommended action: Upgrade to 5.3.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.