Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 82
Reset filtersSnipe-IT's S3 signature image retrieval lacks authorization before temporary URL
Snipe-IT has Improper Authorization in File Deletion (IDOR)
Snipe-IT Vulnerable to Privilege Escalation via Missing admin Permission Check in User Creation
Snipe-IT has Multi-Tenancy Bypass via Bulk Asset Update
Snipe-IT has a 2FA reset privilege bypass
Snipe-IT Vulnerable to User Account Escalation via CSV Import
Snipe-IT's TOTP is Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor`
Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users
Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment
Snipe-IT's selectlist visibility is too permissive
Snipe-IT has an open redirect vulnerability
Snipe-IT has insecure permissions in file uploads
Snipe-IT has Privilege Escalation via API Permissions Assignment
Snipe-IT has Stored XSS via Component Checkout Notes (v8.4.0)
Snipe-IT has sensitive user attributes related to account privileges that are insufficiently protected against mass assignment
Snipe-IT allows stored XSS via the Locations "Country" field
Snipe-IT is vulnerable to stored cross-site scripting
Snipe-IT has Cross-site Scripting vulnerability in CSV import workflow
Snipe-IT allows unsafe deserialization
Snipe-IT allows XSS
Grokability Snipe-IT has incorrect authorization for accessing asset information
Cross Site Scripting vulnerability in Snipe-IT
Snipe-IT remote code execution
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.