Skip to content
OpenAdvisories

Package · Packagist

passbolt/passbolt_api

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 5.5
    GHSA-qm5v-pj64-852j

    Passbolt Api Tabnabbing when opening URI with menu "Open URI in a new tab"

    ### Description A user could create and share a resource with a malicious URI. When the victim opens with menu “Open URI in a new tab” function, the malicious page has access to the window.opener object. ### Impact of issue The newly opened malicious page can…

    passbolt/passbolt_api Packagist
  • Medium 4.4
    GHSA-v86m-j5f7-ccwh

    Passbolt Api E-mail HTML injection

    Passbolt sends e-mail to users to warn them about different type of events such as the creation, modification or deletion of a password. Those e-mails may contain user-specified input, such as a password’s title or description. Passbolt does not escape the us…

    passbolt/passbolt_api Packagist
  • Medium 4.3
    CVE-2024-33670

    Passbolt API allows HTML injection

    Passbolt API before 4.6.2 allows HTML injection in a URL parameter, resulting in custom content being displayed when a user visits the crafted URL. Although the injected content is not executed as JavaScript due to Content Security Policy (CSP) restrictions, …

    passbolt/passbolt_api Packagist
  • Medium 5.4
    CVE-2017-1000442

    Passbolt API is vulnerable to XSS in the url field on the password workspace grid and sidebar

    Passbolt API version 1.6.4 and older are vulnerable to a XSS in the url field on the password workspace

    passbolt/passbolt_api Packagist