Skip to content
OpenAdvisories

Vendor

pglombardo

7 known vulnerabilities.

Products

PasswordPusher 7
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 6.9
    CVE-2026-62382 Scanner template

    PasswordPusher before v2.9.6 Authentication Bypass via Null Comparison

    PasswordPusher versions v1.45.11 through v2.9.5 contain an improper authorization vulnerability in the push deletion logic. The ownership check compares @push.user against current_user; for an anonymously created push both values are nil, and Ruby evaluates n…

    pglombardo PasswordPusher
  • Medium 6.5
    CVE-2026-41308

    Password Pusher: JSON API `/p.json` file upload alias bypasses file-push authentication

    Password Pusher is an open source application to communicate sensitive information over the web. Prior to versions 1.69.3 and 2.4.2, a security issue in OSS PasswordPusher allowed unauthenticated creation of file-type pushes through a generic JSON API create …

    pglombardo PasswordPusher
  • Medium 5.7
    CVE-2024-56733

    Password Pusher Allows Session Token Interception Leading to Potential Hijacking

    Password Pusher is an open source application to communicate sensitive information over the web. A vulnerability has been reported in versions 1.50.3 and prior where an attacker can copy the session cookie before a user logs out, potentially allowing session …

    pglombardo PasswordPusher pwpush RubyGems
  • Medium 5.3
    CVE-2024-52796

    Password Pusher's rate limiter can be bypassed by forging proxy headers

    Password Pusher, an open source application to communicate sensitive information over the web, comes with a configurable rate limiter. In versions prior to v1.49.0, the rate limiter could be bypassed by forging proxy headers allowing bad actors to send unlimi…

    pglombardo PasswordPusher pwpush RubyGems