CVE-2024-50702

TeamPass before 3.1.3.1 does not properly check whether a mailme aka actionmail operation is on behalf of an administrator or manager...

PT-2024-34393 · Teampass · Teampass

Name of the Vulnerable Software and Affected Versions: TeamPass versions prior to 3.1.3.1 Description: The issue arises from the software not properly checking if a mail me also known as action mail operation is performed on behalf of an administrator or manager. This lack of verification can lea...

CVE-2024-50703

TeamPass (open-source password manager) before version 3.1.3.1 is affected by CVE-2024-50703. The issue allows a user to act with the privileges of a different user_id due to improper prevention of privilege escalation. Affected component/condition: user-session/privilege checks in TeamPass prior...

CVE-2024-50703

TeamPass before 3.1.3.1 does not properly prevent a user from acting with the privileges of a different userid...

CVE-2024-50701

TeamPass before 3.1.3.1, when retrieving information about access rights for a folder, does not properly check whether a folder is in a user's allowed folders list that has been defined by an admin...

PT-2024-34392 · Teampass · Teampass

Name of the Vulnerable Software and Affected Versions: TeamPass versions prior to 3.1.3.1 Description: The issue arises when retrieving information about access rights for a folder. TeamPass does not properly check whether a folder is in a user's allowed folders list that has been defined by an...

TeamPass 安全漏洞

TeamPass is an open source password manager from the individual developer Nils Laumaillé. A security vulnerability exists in versions prior to TeamPass 3.1.3.1, which stems from the inability to properly check whether a folder is located in an administrator-defined list of user-allowed folders wh...

CVE-2024-50702

TeamPass before 3.1.3.1 does not properly check whether a mailme aka actionmail operation is on behalf of an administrator or manager...

PT-2024-34394 · Teampass · Teampass

Name of the Vulnerable Software and Affected Versions: TeamPass versions prior to 3.1.3.1 Description: The issue allows a user to act with the privileges of a different user id. This is due to the software not properly preventing such actions. Recommendations: For versions prior to 3.1.3.1, updat...

TeamPass 安全漏洞

TeamPass is an open source password manager from the individual developer Nils Laumaillé. A security vulnerability exists in versions prior to TeamPass 3.1.3.1, which stems from an inability to properly prevent users from acting with different userid privileges...

TeamPass 安全漏洞

TeamPass is an open source password manager from the individual developer Nils Laumaillé. A security vulnerability exists in versions prior to TeamPass 3.1.3.1, which stems from an inability to properly check if the mailme operation represents an administrator...

CVE-2024-50702

Summary: CVE-2024-50702 affects TeamPass prior to 3.1.3.1. The vulnerability arises from improper authorization checks in the mail_me/action_mail operation, allowing an unauthorized actor to perform actions intended for administrators or managers. Documents consistently describe this as an author...

CVE-2024-50703

TeamPass before 3.1.3.1 does not properly prevent a user from acting with the privileges of a different userid...

CVE-2024-50702

TeamPass before 3.1.3.1 does not properly check whether a mailme aka actionmail operation is on behalf of an administrator or manager...

CVE-2024-50701

TeamPass before 3.1.3.1, when retrieving information about access rights for a folder, does not properly check whether a folder is in a user's allowed folders list that has been defined by an admin...

Cross-site Scripting (XSS)

nilsteampassnet/teampass is vulnerable to Cross-site Scripting XSS. The vulnerability exists at Search page due to lack of user-input sanitization in the pages/item component which allows an attacker to inject and execute arbitrary javascript or html codes...

Remote Code Execution (RCE)

nilsteampassnet/teampass is vulnerable to Remote Code Execution RCE. The vulnerability exists due to lack of restrictions of certain input fields which are directly inserted into a tp.config.php which allows an attacker to inject and execute malicious PHP code...

Cross-site Scripting (XSS)

nilsteampassnet/teampass is vulnerable to Cross-site Scripting XSS. The vulnerability exists due to lack of sanitization in many configuration fields which allows an attacker to inject and execute arbitrary javascript or html codes...

Cross-site Scripting (XSS)

nilsteampassnet/teampass is vulnerable to Cross-site Scripting XSS attacks. The vulnerability exists because the folder name outputs are not properly encoded which allows an attacker to inject and execute arbitrary html code...

Cross-site Scripting (XSS)

nilsteampassnet/teampass is vulnerable to Cross-site Scripting XSS. The vulnerability exists because the library does not properly encode or escape outputs, allowing an attacker to inject and execute malicious javascript through the index.php?page=folders endpoint when creating a new folder...