CVE-2022-26980

Teampass 2.1.26 allows reflected XSS via the index.php PATHINFO...

Teampass 跨站脚本漏洞

TeamPass is an open source password manager from the individual developer NILS LAUMAILLÉ Nils Laumaillé. A security vulnerability exists in Teampass 2.1.26, which can be exploited by an attacker via index.php PATHINFO...

The vulnerability of the users.queries.php component of the TeamPass password manager allows a hacker to execute arbitrary SQL commands.

The vulnerability of the users.queries.php component of the TeamPass password manager is related to insufficient protection of the SQL query structure. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary SQL commands...

Missing Authorization in TeamPass

Lack of authorization controls in REST API functions in TeamPass through 2.1.27.36 allows any TeamPass user with a valid API token to become a TeamPass administrator and read/modify all passwords via authenticated api/index.php REST API calls. NOTE: the API is not available by default...

GHSA-GMR7-M73X-6C9Q Missing Authorization in TeamPass

Lack of authorization controls in REST API functions in TeamPass through 2.1.27.36 allows any TeamPass user with a valid API token to become a TeamPass administrator and read/modify all passwords via authenticated api/index.php REST API calls. NOTE: the API is not available by default...

Incorrect Authorization in TeamPass

The REST API functions in TeamPass 2.1.27.36 allow any user with a valid API token to bypass IP address whitelist restrictions via an X-Forwarded-For client HTTP header to the getIp function...

GHSA-FV48-HJHP-94C7 Incorrect Authorization in TeamPass

The REST API functions in TeamPass 2.1.27.36 allow any user with a valid API token to bypass IP address whitelist restrictions via an X-Forwarded-For client HTTP header to the getIp function...

TeamPass Authorization Control Vulnerability

TeamPass is an open source password manager. A security vulnerability exists in the REST API functionality in TeamPass 2.1.27.36 and earlier versions. An attacker can exploit this vulnerability to gain TeamPass administrator privileges and read or change all passwords...

Missing API Authorization Checks

TeamPass has missing API authorization checks. The application does not properly enforce authorization controls in REST API functions, allowing any user with a valid token to act as administrator and to modify another user's passwords using authenticated api/index.php REST API calls...

CVE-2020-11671

Lack of authorization controls in REST API functions in TeamPass through 2.1.27.36 allows any TeamPass user with a valid API token to become a TeamPass administrator and read/modify all passwords via authenticated api/index.php REST API calls. NOTE: the API is not available by default...

CVE-2020-11671

Lack of authorization controls in REST API functions in TeamPass through 2.1.27.36 allows any TeamPass user with a valid API token to become a TeamPass administrator and read/modify all passwords via authenticated api/index.php REST API calls. NOTE: the API is not available by default...

Design/Logic Flaw

Lack of authorization controls in REST API functions in TeamPass through 2.1.27.36 allows any TeamPass user with a valid API token to become a TeamPass administrator and read/modify all passwords via authenticated api/index.php REST API calls. NOTE: the API is not available by default...

CVE-2020-11671

Lack of authorization controls in REST API functions in TeamPass through 2.1.27.36 allows any TeamPass user with a valid API token to become a TeamPass administrator and read/modify all passwords via authenticated api/index.php REST API calls. NOTE: the API is not available by default...

CVE-2020-11671

The CVE-2020-11671 entry concerns TeamPass: lack of authorization controls in REST API functions in TeamPass 2.1.27.36 and earlier allows any user with a valid API token to become an administrator and read/modify all passwords via api/index.php REST API calls. The impact is elevated privileges an...

Local File Inclusion

Teampass is vulnerable to local file inclusion. It does not sanitize the newValue HTTP request provided by the user along with sources/users.queries.php to choose language preferences, allowing a user to include malicious PHP file and to execute directly on the server...

TeamPass Path Traversal Vulnerability

TeamPass is an open source password manager from the developers of NILS LAUMAILL? software. A security vulnerability exists in TeamPass version 2.1.27.36. An attacker can exploit the vulnerability by sending an HTTP request with the 'newValue' parameter to the sources/users.series.php file to...

TeamPass Injection Vulnerability

TeamPass is an open source password manager from the developers of NILS LAUMAILL? software. A security vulnerability exists in TeamPass version 2.1.27.36. An attacker can exploit this vulnerability to retrieve files including backup files or LDAP debug files in the TeamPass web root directory...

TeamPass Information Disclosure Vulnerability

TeamPass is an open source password manager from the developers of NILS LAUMAILL? software. A security vulnerability exists in the REST API functionality in TeamPass version 2.1.27.36. An attacker can exploit the vulnerability to bypass IP address whitelisting restrictions with the help of the...

CVE-2020-12479

TeamPass 2.1.27.36 allows any authenticated TeamPass user to trigger a PHP file include vulnerability via a crafted HTTP request with sources/users.queries.php newValue directory traversal...

CVE-2020-12477

The REST API functions in TeamPass 2.1.27.36 allow any user with a valid API token to bypass IP address whitelist restrictions via an X-Forwarded-For client HTTP header to the getIp function...