Tienner

**Name of the Vulnerable Software and Affected Versions** Snipe-IT versions prior to 8.6.0 **Description** A user possessing `users.edit` and API permissions can escalate their privileges by sending a PATCH request to the '/api/v1/users/{their own id}' endpoint. This allows the user to grant themselves various permissions, such as `assets.view`, `assets.create`, `reports.view`, and import capabilities, although they cannot grant themselves admin or superuser status. **Recommendations** Update to version 8.6.0.

**Name of the Vulnerable Software and Affected Versions** Poweradmin versions prior to 4.2.4 Poweradmin versions prior to 4.3.3 Poweradmin version 4.4.0 **Description** The log export functionality is susceptible to CSV Injection (Formula Injection), which occurs when user-controlled data is written to exported CSV files without sanitizing formula trigger characters such as `=`, `+`, `-`, and `@`. Specifically, the `username` field is written verbatim to the output. When an administrator opens the resulting CSV file in spreadsheet applications like Microsoft Excel, LibreOffice Calc, or Google Sheets, any formula stored in a username is executed. This can facilitate phishing attacks against administrators or lead to data exfiltration using functions like `=IMPORTXML()`. The issue exists in the following controllers: - `lib/Application/Controller/ListLogUsersController.php` - `lib/Application/Controller/ListLogZonesController.php` - `lib/Application/Controller/ListLogGroupsController.php` - `lib/Application/Controller/ListLogApiController.php` Additionally, PHP deprecation warnings may be emitted into the HTTP response body, exposing internal file paths. **Recommendations** Update to version 4.2.4. Update to version 4.3.3. At the moment, there is no information about a newer version that contains a fix for this vulnerability.