snipe/snipe-it (Packagist)
Advisories
82
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 8.7.0 or later clears every advisory below that has a fix.
Upgrade commands
composer
composer require snipe/snipe-it:^8.7.0Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-396x-xmvh-p563 Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API |
Medium EPSS 0.24% |
< 8.7.0 | 8.7.0 |
| GHSA-p9h3-gvpq-5539 Snipe-IT: Stored XSS via Custom Field name in asset-list column headers |
High EPSS 0.36% |
< 8.7.0 | 8.7.0 |
| GHSA-hxcx-9h4f-42xx Snipe-IT: 2FA bypass via the API token flow |
High EPSS 0.33% |
< 8.7.0 | 8.7.0 |
| GHSA-c8qc-wf67-342w Snipe-IT: Stored DOM XSS via table selected-count IDs |
Medium EPSS 0.21% |
< 8.6.2 | 8.6.2 |
| GHSA-r9r3-g9fp-3q4q Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GET |
Medium EPSS 0.34% |
< 8.6.3 | 8.6.3 |
| GHSA-3hgv-jr5j-cg9x Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover |
Medium EPSS 0.29% |
< 8.6.3 | 8.6.3 |
| GHSA-c6w2-j4wq-mvwg Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode |
High EPSS 0.30% |
< 8.6.3 | 8.6.3 |
| GHSA-35cr-9hqq-p2mg Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint |
Medium EPSS 0.34% |
< 8.6.2 | 8.6.2 |
| GHSA-w7qw-5wfv-gwx9 Snipe-IT has CSS Injection via `header_color` Setting |
Medium EPSS 0.32% |
< 8.6.2 | 8.6.2 |
| GHSA-8frh-vhgh-64cf Snipe-IT has incorrect permission for legacy license checkin API |
Medium EPSS 0.33% |
< 8.6.2 | 8.6.2 |
| GHSA-5wx7-xq8j-v4qm Snipe-IT's import created_by can be overwritten |
Medium EPSS 0.34% |
< 8.6.1 | 8.6.1 |
| GHSA-xr9m-gphc-9p63 Snipe-IT has a path traversal vulnerability via CSV import `image` field |
Medium EPSS 0.59% |
< 8.6.2 | 8.6.2 |
| GHSA-jhph-5q74-pmfx Snipe-IT vulnerable to stored XSS via inline-served attachment |
High EPSS 0.44% |
< 8.6.2 | 8.6.2 |
| GHSA-fc33-6w3q-538h Snipe-IT has an authorization bypass on print inventory page |
Medium EPSS 0.34% |
< 8.6.1 | 8.6.1 |
| GHSA-wg2f-x2c2-c4rp Snipe-IT has an Open Redirect After User Edit |
Medium EPSS 0.31% |
< 8.6.2 | 8.6.2 |
| GHSA-whrx-mmgr-gpcf Snipe-IT has CSV formula injection in Activity Report export |
High EPSS 0.43% |
< 8.6.2 | 8.6.2 |
| GHSA-j5g3-42wp-gqm3 Snipe-IT has an Improper Privilege Management issue |
Medium EPSS 0.54% |
< 8.6.0 | 8.6.0 |
| GHSA-575r-357h-fhch Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API update |
High EPSS 0.38% |
< 8.6.2 | 8.6.2 |
| GHSA-crv3-j83j-f3r6 Snipe-IT has missing object-level authorization in Kits API |
Medium EPSS 0.29% |
< 8.6.2 | 8.6.2 |
| GHSA-53jc-27pc-x8r8 Snipe-IT Vulnerable to Unauthorized Asset Request Cancellation via Unguarded cancel_by_admin Parameter |
Medium EPSS 0.34% |
< 8.6.0 | 8.6.0 |
| GHSA-c6f4-wj38-m3g3 Snipe-IT vulnerable to directory traversal in displaySig |
Medium EPSS 0.48% |
< 8.5.0 | 8.5.0 |
| GHSA-8w8c-8mx9-52cw Snipe-IT's API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation |
Medium EPSS 0.33% |
< 8.6.2 | 8.6.2 |
| GHSA-r52f-r9v5-66xr Snipe-IT vulnerable to stored XSS via Markdown custom field |
Medium EPSS 0.29% |
< 8.6.2 | 8.6.2 |
| GHSA-vgx7-c78r-69w9 Snipe-IT has an authorization bypass on bulk editing users |
High EPSS 0.44% |
< 8.6.2 | 8.6.2 |
| GHSA-pwpj-p52h-q484 Snipe-IT API Vulnerable to Cross-Tenant Accessory Injection |
High EPSS 0.39% |
< 8.6.2 | 8.6.2 |
| GHSA-6mmj-jhqj-6c6q Snipe-IT's S3 signature image retrieval lacks authorization before temporary URL |
Medium EPSS 0.28% |
< 8.5.1 | 8.5.1 |
| GHSA-x667-r589-43m7 Snipe-IT has Improper Authorization in File Deletion (IDOR) |
Medium EPSS 0.37% |
< 8.4.1 | 8.4.1 |
| GHSA-hf68-g98v-wp9g Snipe-IT Vulnerable to Privilege Escalation via Missing admin Permission Check in User Creation |
High EPSS 0.35% |
< 8.6.0 | 8.6.0 |
| GHSA-33g4-646g-qwmm Snipe-IT has Multi-Tenancy Bypass via Bulk Asset Update |
Medium EPSS 0.33% |
< 8.4.2 | 8.4.2 |
| GHSA-6x4j-8954-5hxm Snipe-IT has a 2FA reset privilege bypass |
Medium EPSS 0.27% |
< 8.5.0 | 8.5.0 |
| GHSA-p68w-rgmg-3c2v Snipe-IT Vulnerable to User Account Escalation via CSV Import |
Medium EPSS 0.49% |
< 8.6.0 | 8.6.0 |
| GHSA-mr8g-2mj4-pcq2 Snipe-IT's TOTP is Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor` |
Medium EPSS 0.40% |
< 8.6.0 | 8.6.0 |
| GHSA-52fw-7fw2-fmv5 Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment |
Medium EPSS 0.31% |
< 8.6.0 | 8.6.0 |
| GHSA-f3c5-6cw8-fg57 Snipe-IT's selectlist visibility is too permissive |
Medium EPSS 0.39% |
< 8.5.1 | 8.5.1 |
| GHSA-6f75-x745-xcpr Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users |
High EPSS 0.24% |
< 8.6.0 | 8.6.0 |
| GHSA-mghp-5cq4-v6mg Snipe-IT has an open redirect vulnerability |
High EPSS 0.16% |
< 8.4.1 | 8.4.1 |
| GHSA-hq28-crg7-95pr Snipe-IT has Privilege Escalation via API Permissions Assignment |
High EPSS 0.32% |
< 8.4.1 | 8.4.1 |
| GHSA-r42m-953q-6vjx Snipe-IT has Stored XSS via Component Checkout Notes (v8.4.0) |
Medium EPSS 0.22% |
< 8.4.1 | 8.4.1 |
| GHSA-xg82-2hrv-hf64 Snipe-IT has insecure permissions in file uploads |
Critical EPSS 0.60% |
< 8.4.1 | 8.4.1 |
| GHSA-5448-v74m-7mv7 Snipe-IT has sensitive user attributes related to account privileges that are insufficiently protected against mass assignment |
High EPSS 0.48% |
< 8.3.7 | 8.3.7 |
| GHSA-4g25-wj72-chxg Snipe-IT allows stored XSS via the Locations "Country" field |
Medium EPSS 0.19% |
< 8.3.4 | 8.3.4 |
| GHSA-fww5-m9wc-jcjc Snipe-IT is vulnerable to stored cross-site scripting |
Medium EPSS 0.17% |
< 8.3.4 | 8.3.4 |
| GHSA-8x9v-8qgj-945x Snipe-IT has Cross-site Scripting vulnerability in CSV import workflow |
Medium EPSS 0.25% |
<= 8.3.4 | No fix yet |
| GHSA-phwj-fgch-xvrj Snipe-IT allows unsafe deserialization |
High EPSS 0.38% |
< 8.1.18 | 8.1.18 |
| GHSA-c9wp-pr7f-hfqm Snipe-IT allows XSS |
Medium EPSS 0.26% |
< 8.1.18 | 8.1.18 |
| GHSA-h3vp-qwmx-5j25 Grokability Snipe-IT has incorrect authorization for accessing asset information |
Low EPSS 1.30% |
< 8.1.0 | 8.1.0 |
| GHSA-hw9x-8m75-4vjq Cross Site Scripting vulnerability in Snipe-IT |
High EPSS 0.43% |
<= 7.0.13 | No fix yet |
| GHSA-57qh-vmjr-5jxg Snipe-IT remote code execution |
Medium EPSS 0.99% |
< 7.0.10 | 7.0.10 |
| GHSA-544r-fc65-v832 Snipe-IT allows users to promote or demote themselves or other users |
High EPSS 0.41% |
< 6.4.2 | 6.4.2 |
| GHSA-33vj-r6p6-x4p8 Cross-Site Request Forgery (CSRF) in snipe/snipe-it |
High EPSS 0.30% |
< 6.2.3 | 6.2.3 |
| GHSA-rr5c-69c9-gj9f Cross-site Scripting in snipe/snipe-it |
Medium EPSS 0.61% |
< 6.2.2 | 6.2.2 |
| GHSA-363q-j92x-7543 Snipe-IT vulnerable to Cross Site Scripting for View Assigned Assets |
Medium EPSS 0.51% |
< 6.0.14 | 6.0.14 |
| GHSA-qqv9-gqh5-7h99 Snipe-IT allows attackers to check whether a user account exists |
Medium EPSS 0.68% |
<= 6.0.14 | No fix yet |
| GHSA-fhvv-p968-6vvj Snipe-IT vulnerable to Improper Authentication |
Medium EPSS 0.91% |
< 6.0.10 | 6.0.10 |
| GHSA-rff2-vqm3-jpv5 snipe-it vulnerable to cross-site scripting (XSS) |
Medium EPSS 0.74% |
< 6.0.11 | 6.0.11 |
| GHSA-cmxc-9ghj-jp87 Insufficient Session Expiration in snipe/snipe-it |
Medium EPSS 0.93% |
< 6.0.10 | 6.0.10 |
| GHSA-xwqx-x38c-cw95 Snipe-IT 6.0.2 vulnerable to Cross-site Scripting |
Medium EPSS 0.68% |
<= 6.0.2 | No fix yet |
| GHSA-w82x-xjjr-cjr5 Snipe-IT 6.0.2 vulnerable to Cross-site Scripting via arbitrary file upload in Update Branding Settings |
Medium EPSS 1.19% |
<= 6.0.2 | No fix yet |
| GHSA-fx98-8w93-4mxr Snipe-IT XSS Vulnerability |
Medium EPSS 0.85% |
< 4.6.14 | 4.6.14 |
| GHSA-9vh6-qfv6-vcqp snipe-IT vulnerable to host header injection |
High EPSS 1.32% |
>= 3.0-alpha, < 5.3.8 | 5.3.8 |
| GHSA-p2vw-f87c-q597 Improper Access Control in snipe/snipe-it |
Medium EPSS 1.06% |
< 5.4.4 | 5.4.4 |
| GHSA-hpx4-xjp7-m4vr Stored cross-site scripting in Snipe-IT |
Medium EPSS 0.78% |
< 5.4.3 | 5.4.3 |
| GHSA-p885-prv3-m4xv Cross-site Scripting in snipe-it |
Medium EPSS 0.85% |
< 5.4.3 | 5.4.3 |
| GHSA-636j-7x7r-gvw2 Old sessions not blocked by login enable function in Snipe-IT |
High EPSS 0.99% |
>= 6.0.0-RC-1, < 6.0.0-RC-6 | 6.0.0-RC-6 |
| GHSA-636j-7x7r-gvw2 Old sessions not blocked by login enable function in Snipe-IT |
High EPSS 0.99% |
< 5.4.2 | 5.4.2 |
| GHSA-pwwm-pwx2-2hw7 Generation of Error Message Containing Sensitive Information in Snipe-IT |
Medium EPSS 0.99% |
< 5.3.11 | 5.3.11 |
| GHSA-j57w-3c39-gpp5 Improper Privilege Management in Snipe-IT |
High EPSS 1.20% |
< 5.3.11 | 5.3.11 |
| GHSA-qpv2-jxc7-3638 Exposure of Sensitive Information in snipe/snipe-it |
Medium EPSS 1.04% |
< 5.3.10 | 5.3.10 |
| GHSA-v6vg-pxvv-g5cq Improper Privilege Management in Snipe-IT |
Medium EPSS 1.05% |
< 5.3.9 | 5.3.9 |
| GHSA-xc47-3rch-cv57 Improper Access Control in snipe-it |
Medium EPSS 0.59% |
< 5.3.8 | 5.3.8 |
| GHSA-w3v3-cxq5-9vr4 Incorrect Default Permissions and Improper Access Control in snipe-it |
Medium EPSS 0.64% |
< 5.3.7 | 5.3.7 |
| GHSA-4w23-c97g-fq5v snipe-it is vulnerable to Cross-Site Request Forgery (CSRF) |
High EPSS 0.48% |
< 5.3.6 | 5.3.6 |
| GHSA-9vwf-54m9-gc4f snipe-it is vulnerable to Improper Access Control |
Medium EPSS 0.72% |
< 5.3.4 | 5.3.4 |
| GHSA-rxch-gp62-574w snipe-it is vulnerable to Cross-site Scripting |
Medium EPSS 0.79% |
< 5.3.5 | 5.3.5 |
| GHSA-553q-hpvp-q8pc Server-Side Request Forgery in snipe/snipe-it |
High EPSS 0.92% |
< 6.0.0-GM | 6.0.0-GM |
| GHSA-5fh3-25xr-g85h snipe-it is vulnerable to Cross-site Scripting |
Medium EPSS 0.66% |
< 5.3.3 | 5.3.3 |
| GHSA-c65v-p733-9796 Cross-site Scripting in snipe/snipe-it |
High EPSS 0.76% |
< 5.3.2 | 5.3.2 |
| GHSA-2cqg-q7jm-j35c snipe-it is vulnerable to Cross-site Scripting |
Low EPSS 0.54% |
< 5.4.0 | 5.4.0 |
| GHSA-533p-cp2g-99wp snipe-it is vulnerable to Cross-Site Request Forgery (CSRF) |
Medium EPSS 0.44% |
<= 5.3.1 | No fix yet |
| GHSA-5rg2-6qr5-2xp8 Cross-site Scripting in snipe-it |
Medium EPSS 0.79% |
< 5.3.0 | 5.3.0 |
| GHSA-g92x-8m54-p89v Cross-Site Request Forgery in snipe-it |
Medium EPSS 0.54% |
< 5.3.0 | 5.3.0 |
| GHSA-9g3v-j3cr-6fc6 Cross-site Scripting in snipe-it |
Medium EPSS 0.83% |
< 5.3.0 | 5.3.0 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor