CVE-2023-1463 Authorization Bypass Through User-Controlled Key in nilsteampassnet/teampass

Authorization Bypass Through User-Controlled Key in GitHub repository nilsteampassnet/teampass prior to 3.0.0.23...

TeamPass <= 2.1.26 XSS Vulnerability - Active Check

TeamPass is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:teampass:teampass"...

The vulnerability of the TeamPass password manager, related to improper external management of the username or file path, allows attackers to delete any files they desire.

The vulnerability of the TeamPass password manager is related to improper external management of the username or file path. Exploiting this vulnerability allows a malicious actor to delete any files at will...

TeamPass < 3.0 XSS Vulnerability

TeamPass is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:teampass:teampass"...

TeamPass < 3.0.0.22 Arbitrary File Deletion Vulnerability

TeamPass is prone to an arbitrary file deletion vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:teampass:teampass"...

TeamPass < 3.0.0.23 Multiple Vulnerabilities

TeamPass is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:teampass:teampass"; ifdescription...

Arbitrary File Write

nilsteampassnet/teampass is vulnerable to External Control Of File Name. The vulnerability is due to a lack of santization in the path element, which allows an attacker to write arbitrary files outside the expected directory...

CVE-2023-1070 External Control of File Name or Path in nilsteampassnet/teampass

External Control of File Name or Path in GitHub repository nilsteampassnet/teampass prior to 3.0.0.22...

TeamPass 安全漏洞

TeamPass is an open source password manager from the individual developer Nils Laumaillé. A security vulnerability exists in versions prior to TeamPass 3.0.0.22, which stems from a security issue in the teampass-seckey.txt file...

CVE-2023-1070 External Control of File Name or Path in nilsteampassnet/teampass

External Control of File Name or Path in GitHub repository nilsteampassnet/teampass prior to 3.0.0.22...

PT-2023-1646 · Teampass · Teampass

Name of the Vulnerable Software and Affected Versions: TeamPass versions prior to 3.0.0.22 Description: The issue is related to external control of file name or path in the TeamPass password manager, which can be exploited by a remote attacker to delete arbitrary files. Recommendations: For...

Arbitrary txt files deletion (authenticated)

Description The file sources/export.queries.php can be exploited by any authenticated user to remove arbitrary txt files. If the system administrator configured the base path for the teampass-seckey.txt to be /var/teampass, as shown in the official example, it is possible to remove it causing a...

SQL injection in API authorization check

Description TeamPass /authorize API endpoint is vulnerable to SQL injection in the login field. It is possible to forge an arbitrary Blowfish hash and use it in the query to bypass the password verification check. Using the same query it is possible to define an arbitrary apikey value too: "login...

The vulnerability of the TeamPass password manager, related to security configuration errors, allows a hacker to execute arbitrary PHP code.

The vulnerability of the TeamPass password manager is related to security configuration errors. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary PHP code...

The vulnerability of the TeamPass password manager, related to security configuration errors, allows a hacker to delete any accessible file on the server.

The vulnerability of the TeamPass password manager is related to security configuration errors. Exploiting this vulnerability could allow a malicious actor, operating remotely, to delete any accessible files on the server...

The vulnerability of the TeamPass password manager, related to security configuration errors, allows a hacker to access information from the database.

The vulnerability of the TeamPass password manager is related to security configuration errors. Exploiting this vulnerability could allow a malicious actor, operating remotely, to obtain information from the database...

TeamPass Cross-site Scripting (XSS) vulnerability

TeamPass 2.1.27.36 allows XSS by setting a crafted password for an item in a folder, and then sharing that item with an admin. The crafted password is exploitable when viewing the change history, or the previous used password field...

GHSA-RPMR-FWH5-24FM TeamPass Cross-site Scripting (XSS) vulnerability

TeamPass 2.1.27.36 allows XSS by setting a crafted password for an item in a folder, and then sharing that item with an admin. The crafted password is exploitable when viewing the change history, or the previous used password field...

TeamPass files are available without authentication

TeamPass 2.1.27.36 allows an unauthenticated attacker to retrieve files from the TeamPass web root. This may include backups or LDAP debug files...

TeamPass PHP arbitrary file include vulnerability

TeamPass 2.1.27.36 allows any authenticated TeamPass user to trigger a PHP file include vulnerability via a crafted HTTP request with sources/users.queries.php newValue directory traversal...