5 results · Clear filters · Feed
-
High 7.2
sysPass FileBackupService Authenticated OS Command Injection via Backup Path
sysPass's FileBackupService::doBackupFiles() in lib/SP/Services/Backup/FileBackupService.php around line 388 builds a tar shell command by string-concatenating the backup directory path $this->path directly into the command line ('tar czf ' . $backupFileApp .…
-
High 7.2
sysPass 3.2.11 Authenticated OS Command Injection via Backup Path
sysPass through version 3.2.11 contains an OS command injection vulnerability that allows authenticated administrators to execute arbitrary commands as the web server process user by setting a malicious backup path and triggering a backup. The FileBackupServi…
-
High 7.1
sysPass 3.2.11 Missing Authorization via PublicLinkController Account Decryption
sysPass through version 3.2.11 contains a missing authorization vulnerability that allows authenticated users with the PUBLICLINK_CREATE profile flag to trigger unauthorized decryption and persistent storage of any vault account's password by exploiting the a…
-
High 8.3
sysPass 3.2.11 Missing Object-Level Authorization via JSON-RPC API
sysPass through version 3.2.11 contains a missing object-level authorization vulnerability in the JSON-RPC API that allows API token holders to enumerate account metadata, overwrite passwords, and delete accounts across the entire vault without per-account ac…
-
High 8.1
sysPass 3.2.11 Insecure Direct Object Reference via AccountFileController
sysPass through version 3.2.11 contains an insecure direct object reference vulnerability that allows any authenticated attacker to access account file attachments belonging to accounts they do not have ACL permissions for by exploiting missing authorization …