Advisories · Technology
grokability snipe-it.
Every CVE that names grokability snipe-it among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.7 High
Snipe-IT before 8.5.0 SAML Assertion Replay via Race Condition
- grokability snipe-it
- Authentication bypass
- CVSS 8.2 High
Snipe-IT before 8.6.3 LDAP StartTLS Downgrade via connectToLdap()
- grokability snipe-it
- Weak cryptography or TLS
- CVSS 9.2 CriticalCritical · CVSS 9+
Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback
- grokability snipe-it
- Broken access control
- CVSS 5.3 Medium
Snipe-IT before 8.7.0 Missing Encryption via Api AssetsController store
- grokability snipe-it
- Weak cryptography or TLS
- CVSS 5.1 Medium
Snipe-IT before 8.7.0 SSRF Port Scanning via Webhook Testing Endpoint
- grokability snipe-it
- Information disclosure
- CVSS 5.3 Medium
Snipe-IT before 8.7.2 Authorization Bypass via Predefined Kit Checkout
- grokability snipe-it
- Broken access control
- CVSS 5.3 Medium
Snipe-IT before 8.7.0 Broken Access Control via AssetModelPolicy
- grokability snipe-it
- Broken access control
- CVSS 5.3 Medium
Snipe-IT 8.6.3 Broken Access Control via Kit Update Endpoints
- grokability snipe-it
- Broken access control
- CVSS 5.1 Medium
Snipe-IT 8.6.3 Stored XSS via Department Names
- grokability snipe-it
- Cross-site scripting (XSS)
- CVSS 8.3 High
Snipe-IT before 8.7.0 Server-Side Request Forgery via employee_num
- grokability snipe-it
- Server-side request forgery (SSRF)
- CVSS 8.6 High
Snipe-IT before 8.7.0 Authentication Bypass via SAML Username Collation
- grokability snipe-it
- CWE-178
- CVSS 5.3 Medium
Snipe-IT before 8.7.0 Audit Log Misattribution via Consumables Checkout
- grokability snipe-it
- CWE-282
- CVSS 5.3 Medium
Snipe-IT before 8.7.0 Improper Input Validation via API Checkout
- grokability snipe-it
- CWE-20
- CVSS 5.3 Medium
Snipe-IT before 8.7.0 Cross-Company Read via requested-assets
- grokability snipe-it
- Information disclosure
- CVSS 7.1 High
Snipe-IT 8.6.3 Race Condition via Consumable Checkout
- grokability snipe-it
- Race condition
- CVSS 7.1 High
Snipe-IT 8.6.3 Authorization Bypass via Asset Update Endpoint
- grokability snipe-it
- Broken access control
- CVSS 7.1 High
Snipe-IT 8.6.4 before 8.7.0 Permission Bypass via assigned components
- grokability snipe-it
- Broken access control
- CVSS 5.1 Medium
snipe-it 7.0.12 through 8.6.3 Authorization Bypass via Importer
- grokability snipe-it
- Broken access control
- CVSS 8.6 High
Snipe-IT before 8.7.0 Authentication Bypass via API Middleware
- grokability snipe-it
- Broken access control
- CVSS 5.3 Medium
snipe-it 8.6.3 before 8.7.0 Authorization Bypass via print endpoints
- grokability snipe-it
- Broken access control
- CVSS 5.3 Medium
snipe-it 8.2.0 before 8.7.0 Authentication Bypass via activated flag
- grokability snipe-it
- Broken access control
- CVSS 7.1 High
Snipe-IT before 8.7.0 Missing Authorization via asset-history CSV importer
- grokability snipe-it
- Broken access control
- CVSS 7.1 High
Snipe-IT before 8.7.0 License Key Exposure via CSV Export
- grokability snipe-it
- CWE-204
- CVSS 7.1 High
Snipe-IT before 8.7.0 Information Disclosure via Custom Fields
- grokability snipe-it
- Broken access control
- CVSS 5.3 Medium
Snipe-IT 8.5.0 through 8.6.3 Open Redirect via SAML RelayState
- grokability snipe-it
- Open redirect
- CVSS 5.3 Medium
Snipe-IT 4.2.0 through 8.6.3 Permission Bypass via OAuth
- grokability snipe-it
- Broken access control
- CVSS 8.5 High
Snipe-IT before 8.7.0 Authorization Bypass via OAuth Clients
- grokability snipe-it
- Broken access control
- CVSS 5.3 Medium
snipe-it before 8.7.0 Business Logic Bypass via asset_model endpoint
- grokability snipe-it
- Broken access control
- CVSS 5.3 Medium
snipe-it before 8.7.0 Authorization Bypass via Asset Audit Endpoints
- grokability snipe-it
- Broken access control
- CVSS 8.4 High
Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Markdown
- grokability snipe-it
- Path traversal
- CVSS 8.3 High
snipe-it before 8.7.0 Authorization Bypass via API User Create/Update
- grokability snipe-it
- Broken access control
- CVSS 7.0 High
snipe-it before 8.7.0 Data Loss via Failed Image Write
- grokability snipe-it
- CWE-252
- CVSS 6.9 Medium
Snipe-IT before 8.7.0 Database Wipe via Invalid Backup Archive
- grokability snipe-it
- CWE-460
- CVSS 5.3 Medium
snipe-it before 8.7.0 Authorization Bypass via Pivot-Only User
- grokability snipe-it
- Broken access control
- CVSS 7.4 High
Snipe-IT before 8.7.0 Authorization Bypass via Livewire Snapshot Replay
- grokability snipe-it
- Privilege escalation
- CVSS 5.1 Medium
Snipe-IT before 8.7.0 CSV Formula Injection via Location-Scoping Export
- grokability snipe-it
- Other injection
- CVSS 2.1 Low
snipe-it before 8.7.0 Race Condition in Asset Checkout
- grokability snipe-it
- Race condition
- CVSS 5.3 Medium
Snipe-IT before 8.7.0 Authorization Bypass via Asset Acceptance Report
- grokability snipe-it
- Broken access control
- CVSS 5.1 Medium
Snipe-IT before 8.7.0 CSV Formula Injection via Asset Acceptance Report
- grokability snipe-it
- Other injection
- CVSS 8.4 High
Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Category EULA
- grokability snipe-it
- Path traversal
- CVSS 5.1 Medium
Snipe-IT before 8.7.0 Attachment Deletion Reports Success While File Remains
- grokability snipe-it
- CWE-212
- CVSS 2.3 Low
Snipe-IT before 8.7.0 Acceptance Finalization Without Stored Evidence
- grokability snipe-it
- CWE-252
- CVSS 9.3 CriticalCritical · CVSS 9+
Snipe-IT before 8.7.0 CSS Injection via Custom CSS
- grokability snipe-it
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
snipe-it before 8.7.0 Missing Authorization via barcode endpoint
- grokability snipe-it
- Broken access control
- CVSS 5.3 Medium
snipe-it before 8.7.0 Checkout Request Counter Integrity Failure
- grokability snipe-it
- CWE-682
- CVSS 5.9 Medium
snipe-it before 8.7.0 SSRF via IPv6 transition address bypass
- grokability snipe-it
- Server-side request forgery (SSRF)
- CVSS 7.1 High
Snipe-IT before 8.7.1 Denial of Service via Unbounded Note Field
- grokability snipe-it
- Denial of service
- CVSS 8.6 High
Snipe-IT before 8.7.0 Remote Code Execution via Backup Restore
- grokability snipe-it
- Command injection
- CVSS 8.7 High
snipe-it before 8.6.3 Authorization Bypass via Bulk Delete
- grokability snipe-it
- Broken access control
- CVSS 8.4 High
Snipe-IT before 8.6.2 Authorization Bypass via Checkout-Acceptance
- grokability snipe-it
- Broken access control
- CVSS 5.3 Medium
Snipe-IT before 8.7.0 Authorization Bypass via Bulk Restore
- grokability snipe-it
- Broken access control
- CVSS 5.3 Medium
Snipe-IT Checkout Request Cancellation IDOR
- Grokability Snipe-IT
- Broken access control
- CWE-807