21 results · Clear filters · Feed
-
Medium 4.3
TeamPass does not properly check whether a folder is in a user's allowed folders list
TeamPass before 3.1.3.1, when retrieving information about access rights for a folder, does not properly check whether a folder is in a user's allowed folders list that has been defined by an admin.
-
Medium 5.4
TeamPass privileges issue
TeamPass before 3.1.3.1 does not properly prevent a user from acting with the privileges of a different user_id.
-
Medium 5.4
TeamPass mail_me operation authorization issue
TeamPass before 3.1.3.1 does not properly check whether a mail_me (aka action_mail) operation is on behalf of an administrator or manager.
-
Medium 5.2
Cross-site Scripting (XSS) - Generic in nilsteampassnet/teampass
Cross-site Scripting (XSS) - Generic in GitHub repository nilsteampassnet/teampass prior to 3.0.10.
-
Medium 5.3
Exposure of Sensitive Information to an Unauthorized Actor in nilsteampassnet/teampass
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository nilsteampassnet/teampass prior to 3.0.10.
-
Medium 6.2
Improper Access Control in nilsteampassnet/teampass
Improper Access Control in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
-
Medium 6.1
Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampass
Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
-
Medium 5.4CVE-2023-2516 Public exploit
Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampass
Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.7.
-
Medium 5.8
Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampass
Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.3.
-
Medium 6.3
Authorization Bypass Through User-Controlled Key in nilsteampassnet/teampass
Authorization Bypass Through User-Controlled Key in GitHub repository nilsteampassnet/teampass prior to 3.0.0.23.
-
Medium 6.1
Cross-site Scripting in teampass
Teampass 2.1.26 allows reflected XSS via the index.php PATH_INFO.
-
Medium 5.4
TeamPass Stored Cross-site Scripting
TeamPass 2.1.27.36 allows Stored XSS at the Search page by setting a crafted password for an item in any folder.
-
Medium 5.4
TeamPass Stored Cross-site Scripting
TeamPass 2.1.27.36 allows Stored XSS by setting a crafted Knowledge Base label and adding any available item.
-
Medium 6.1
TeamPass Stored Cross-site Scripting
TeamPass 2.1.27.36 allows Stored XSS by placing a payload in the username field during a login attempt. When an administrator looks at the log of failed logins, the XSS payload will be executed.
-
Medium 5.4
TeamPass Cross-site Scripting (XSS) vulnerability
TeamPass 2.1.27.36 allows Stored XSS by setting a crafted password for an item in a common available folder or sharing the item with an admin. (The crafted password is exploitable when viewing the change history of the item or tapping on the item.)
-
Medium 5.4
TeamPass Cross-site Scripting (XSS)
An issue was discovered in TeamPass 2.1.27.35. From the sources/items.queries.php "Import items" feature, it is possible to load a crafted CSV file with an XSS payload.
-
Medium 5.4
TeamPass stored cross-site scripting (XSS) vulnerability
Multiple stored cross-site scripting (XSS) vulnerabilities in TeamPass before 2.1.27.9 allow authenticated remote attackers to inject arbitrary web script or HTML via the (1) URL value of an item or (2) user log history. To exploit the vulnerability, the atta…
-
Medium 4.9
TeamPass Improper Privilege Management
TeamPass before 2.1.27.9 does not properly enforce manager access control when requesting users.queries.php. It is then possible for a manager user to delete an arbitrary user (including admin), or modify attributes of any arbitrary user except administrator.…
-
Medium 4.9
TeamPass Improper Privilege Management
TeamPass before 2.1.27.9 does not properly enforce manager access control when requesting roles.queries.php. It is then possible for a manager user to modify any arbitrary roles within the application, or delete any arbitrary role. To exploit the vulnerabilit…
-
Medium 5.4
TeamPass Cross-Site Scripting (XSS)
Cross-Site Scripting (XSS) was discovered in TeamPass before 2.1.27.9. The vulnerability exists due to insufficient filtration of data (in /sources/folders.queries.php). An attacker could execute arbitrary HTML and script code in a browser in the context of t…
-
Medium 6.1CVE-2015-7562 Public exploit
TeamPass vulnerable to Cross-site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) label value of an item or (2) name of a role.