564 matches found
CVE-2024-50703
TeamPass before 3.1.3.1 does not properly prevent a user from acting with the privileges of a different userid...
CVE-2024-50703
TeamPass (open-source password manager) before version 3.1.3.1 is affected by CVE-2024-50703. The issue allows a user to act with the privileges of a different user_id due to improper prevention of privilege escalation. Affected component/condition: user-session/privilege checks in TeamPass prior...
CVE-2024-50701
TeamPass before 3.1.3.1, when retrieving information about access rights for a folder, does not properly check whether a folder is in a user's allowed folders list that has been defined by an admin...
CVE-2024-50702
TeamPass before 3.1.3.1 does not properly check whether a mailme aka actionmail operation is on behalf of an administrator or manager...
Cross-site Scripting (XSS)
nilsteampassnet/teampass is vulnerable to Cross-site Scripting XSS. The vulnerability exists at Search page due to lack of user-input sanitization in the pages/item component which allows an attacker to inject and execute arbitrary javascript or html codes...
Remote Code Execution (RCE)
nilsteampassnet/teampass is vulnerable to Remote Code Execution RCE. The vulnerability exists due to lack of restrictions of certain input fields which are directly inserted into a tp.config.php which allows an attacker to inject and execute malicious PHP code...
Cross-site Scripting (XSS)
nilsteampassnet/teampass is vulnerable to Cross-site Scripting XSS. The vulnerability exists due to lack of sanitization in many configuration fields which allows an attacker to inject and execute arbitrary javascript or html codes...
Cross-site Scripting (XSS)
nilsteampassnet/teampass is vulnerable to Cross-site Scripting XSS attacks. The vulnerability exists because the folder name outputs are not properly encoded which allows an attacker to inject and execute arbitrary html code...
Cross-site Scripting (XSS)
nilsteampassnet/teampass is vulnerable to Cross-site Scripting XSS. The vulnerability exists because the library does not properly encode or escape outputs, allowing an attacker to inject and execute malicious javascript through the index.php?page=folders endpoint when creating a new folder...
Improper Access Control
nilsteampassnet/teampass is vulnerable to Improper Access Control. A remote authenticated attacker is able to gain access to read the information of other users via guessing and editing the ID on the request, resulting in disclosure of sensitive information...
Cross-Site Scripting (XSS)
nilsteampassnet/teampass is vulnerable to Cross-Site Scripting XSS attacks. The library does not properly escape the special characters before it output to the front end in the user profile form, which allows an attacker to inject and execute malicious javascript on victim's browser via the store...
Cross-Site Scripting (XSS)
nilsteampassnet/teampass is vulnerable to Cross-Site Scripting XSS attacks. The library does not properly escape the user input before it outputs to the front end, allowing an attacker to inject malicious code as rename payload for the folder of a victim...
Cross-site Scripting (XSS)
nilsteampassnet/teampass is vulnerable to Cross-site Scripting XSS. The vulnerability exists because the name and lastname fields are not properly sanitized in the users.js.php, which allows an attacker to inject and execute malicious javascript...
TeamPass cross-site scripting vulnerability (CNVD-2023-67077)
TeamPass is an open source password manager. TeamPass 3.0.10 prior to the version of the cross-site scripting vulnerability , the vulnerability stems from the Default session expiration time function of the user-supplied data lack of effective filtering and escaping , the vulnerability can be...
GHSA-524R-W8FX-HQG3 TeamPass Cross-site Scripting vulnerability
Cross-site Scripting XSS - Generic in GitHub repository nilsteampassnet/teampass prior to 3.0.10...
TeamPass Cross-site Scripting vulnerability
Cross-site Scripting XSS - Generic in GitHub repository nilsteampassnet/teampass prior to 3.0.10...
CVE-2023-3565
Cross-site Scripting XSS - Generic in GitHub repository nilsteampassnet/teampass prior to 3.0.10...
TeamPass 跨站脚本漏洞
TeamPass is an open source password manager. TeamPass 3.0.10 prior to the version of the cross-site scripting vulnerability , the vulnerability stems from the Default session expiration time function of the user-supplied data lack of effective filtering and escaping , the vulnerability can be...
CVE-2023-3565
CVE-2023-3565 corresponds to a Cross-site Scripting (XSS) vulnerability in TeamPass (nilsteampassnet/teampass) prior to version 3.0.10. Multiple connected records confirm the issue as a generic XSS condition in the GitHub repo, with remediation guidance to upgrade to 3.0.10 or newer. Some sources...