PT-2020-17292 · Logmein · Logmein Lastpass Password Manager

Name of the Vulnerable Software and Affected Versions: LogMein LastPass Password Manager version 4.8.11.2403 Description: An issue was discovered in the LogMein LastPass Password Manager app for iOS, where the PIN authentication for unlocking can be bypassed by forcing the authentication result t...

Malicious Package

Overview bosh-lastpassplugin is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using...

CVE-2013-5114

LastPass prior to 2.5.1 allows secure wipe bypass...

CVE-2013-5113

LastPass prior to 2.5.1 has an insecure PIN implementation...

Information disclosure

LastPass prior to 2.5.1 has an insecure PIN implementation...

Design/Logic Flaw

LastPass prior to 2.5.1 allows secure wipe bypass...

CVE-2013-5113

LastPass prior to 2.5.1 has an insecure PIN implementation...

CVE-2013-5113

CVE-2013-5113 concerns LastPass versions prior to 2.5.1 and an insecure PIN implementation. The vulnerability affects PIN handling in the affected LastPass release(s) and has associated CVSS scores indicating low (2.0) and medium (3.1) impact metrics in different schemes, with local/physical expo...

CVE-2013-5114

The core CVE-2013-5114 issue is described across multiple connected sources as affecting LastPass before version 2.5.1 and enabling a secure wipe bypass. The available documents confirm the affected software/version and the impact (bypass of secure wipe), but do not provide technical details on r...

CVE-2013-5114

LastPass prior to 2.5.1 allows secure wipe bypass...

CVE-2013-5113: Insufficiently Protected Credentials

LastPass prior to 2.5.1 has an insecure PIN implementation...

CVE-2013-5114: Improper Authentication

LastPass prior to 2.5.1 allows secure wipe bypass...

LastPass Fixes Bug That Leaks Credentials

LastPass has patched a bug that could potentially allow malicious websites to access a web user’s credentials from a previously visited site. Tavis Ormandy, a vulnerability researcher from Google Project Zero, discovered the flaw in the LastPass password manager and published it on the project’s...

LastPass Credential Leak From Previous Site Vulnerability

LastPass suffers from an issue where bypassing dopopupregister leaks credentials from the previous site. lastpass: bypassing dopopupregister leaks credentials from previous site I noticed that you can create a popup without calling dopopupregister by iframing popupfilltab.html i.e. via...

CVE-2019-16371

LogMeIn LastPass before 4.33.0 allows attackers to construct a crafted web site that captures the credentials for a victim's account on a previously visited web site, because dopopupregister can be bypassed via clickjacking...

CVE-2019-16371

LogMeIn LastPass before 4.33.0 allows attackers to construct a crafted web site that captures the credentials for a victim's account on a previously visited web site, because dopopupregister can be bypassed via clickjacking...

Design/Logic Flaw

LogMeIn LastPass before 4.33.0 allows attackers to construct a crafted web site that captures the credentials for a victim's account on a previously visited web site, because dopopupregister can be bypassed via clickjacking...

CVE-2019-16371

LogMeIn LastPass before 4.33.0 allows attackers to construct a crafted web site that captures the credentials for a victim's account on a previously visited web site, because dopopupregister can be bypassed via clickjacking...

CVE-2019-16371

CVE-2019-16371 affects LogMeIn LastPass prior to version 4.33.0. The issue arises from a vulnerability where a crafted website can bypass do_popupregister via clickjacking, enabling credential harvesting for accounts on previously visited sites. This is documented across multiple sources (NVD and...

CVE-2019-16371: Improper Restriction of Rendered UI Layers or Frames

LogMeIn LastPass before 4.33.0 allows attackers to construct a crafted web site that captures the credentials for a victim's account on a previously visited web site, because dopopupregister can be bypassed via clickjacking...