CVE Vulnerability Catalog

In Snipe-IT master-branch builds after 8.6.3 (not in any tagged release), the FMCS location-scoping mismatch report export does not apply CSV formula escaping, unlike other exports. An authenticated user can place a spreadsheet formula in text fields that gets executed when the CSV is opened in spreadsheet applications.

Snipe-IT 8.6.3 and earlier contain a race condition in asset checkout paths. Two concurrent checkout requests for the same available asset can both commit, producing duplicate history rows and events, corrupting audit trail and reporting. Requires authenticated session with assets.checkout permission and precise timing. Fixed in 8.7.0.

Snipe-IT versions before 8.7.0 fail to properly scope asset acceptance report queries by company, allowing authenticated reports.view users to read pending acceptances across all companies. Attackers can access the unaccepted_assets report page or CSV export to disclose cross-company inventory details and assignee names.

Snipe-IT through 8.6.3 does not neutralize formula elements in the 'unaccepted assets' acceptance report CSV export. The report is built manually and does not apply League\Csv\EscapeFormula. An authenticated low-privilege user can place a formula in text fields that gets executed when the CSV is opened in spreadsheet applications.

Snipe-IT versions before 8.7.0 fail to sanitize the category EULA text field before rendering it in checkout confirmation emails. Attackers with low-privilege permissions can inject markdown image syntax or raw HTML img tags pointing to local files or remote URLs, which the mail auto-embed library resolves server-side and returns as email attachments, exfiltrating sensitive files like .env credentials and enabling SSRF attacks.

Snipe-IT before 8.7.0 fails to check the return value of Storage::delete() in UploadedFilesController, allowing deletion requests to report success while files remain on disk. Administrators see success but physical files persist and remain accessible to those with filesystem or backup access.

Snipe-IT 8.6.3 and earlier do not check the return value of Storage::put() when writing signature and acceptance PDF files. On silent write failures, execution continues and marks acceptance as complete even though evidence files were never stored, yielding incomplete compliance artifacts. Fixed in 8.7.0.

PocketMine-MP versions before 5.39.2 fail to limit JSON payload size in ModalFormResponsePacket handling, allowing authenticated players to cause denial of service. Attackers can send modal form response packets with massive JSON arrays to exhaust server memory and CPU resources.

PocketMine-MP versions before 5.39.2 fail to validate entity despawn state when processing attack packets. Attackers can exploit a race condition by attacking a disconnecting player to trigger multiple death handlers, causing duplication of inventory items and experience.

PocketMine-MP versions before 5.39.2 contain a network amplification vulnerability in ActorEventPacket handling that allows clients to trigger consuming animations for all visible players. Attackers can send crafted ActorEventPacket messages to spam animation events to other clients and waste server CPU and memory resources.

PocketMine-MP before 5.41.1 contains a denial of service vulnerability in LoginPacket processing where large or complex structures in unknown clientData JWT properties cause excessive logging without sanitization. Attackers can send crafted LoginPackets with deeply nested or massive object structures to trigger out-of-memory conditions and crash the server.

PocketMine-MP versions before 5.42.1 contain a denial of service vulnerability in the LoginPacket handler that allows remote attackers to flood warning messages by injecting numerous junk properties into the clientData JWT. Attackers can craft malicious login packets with excessive unknown properties to waste server CPU time and degrade performance.

PocketMine-MP versions before 5.43.1 fail to properly validate the Certificate field during offline login authentication. Unauthenticated players can trigger an uninitialized property access error that crashes the server.

PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with STATUS_COMPLETED status during resource pack handling. Malicious clients can send batches of these packets to repeatedly trigger pre-spawn progression, creating duplicate Player objects and amplifying memory consumption and network traffic.

Chainlit through 2.12.0 fails to validate the client-supplied socket.io sessionId parameter, allowing unauthenticated attackers to traverse filesystem paths by injecting absolute or relative path sequences. Attackers can craft malicious sessionId values that escape the upload directory and recursively delete arbitrary directories accessible to the service process.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain an Improper Sanitization of Custom Special Characters vulnerability. An unauthenticated attacker with remote access could exploit this to perform script injection.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain an Improper Neutralization of Escape, Meta, or Control Sequences vulnerability. An unauthenticated attacker with remote access could exploit this to launch phishing attacks.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain an Improper Encoding or Escaping of Output vulnerability. An unauthenticated attacker with remote access could exploit this to launch phishing attacks.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain a Use of Hard-coded Credentials vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain a Use of Hard-coded Credentials vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure.