555 matches found
CVE-2017-15053
TeamPass before 2.1.27.9 does not properly enforce manager access control when requesting roles.queries.php. It is then possible for a manager user to modify any arbitrary roles within the application, or delete any arbitrary role. To exploit the vulnerability, an authenticated attacker must have...
CVE-2017-15052
TeamPass before 2.1.27.9 does not properly enforce manager access control when requesting users.queries.php. It is then possible for a manager user to delete an arbitrary user including admin, or modify attributes of any arbitrary user except administrator. To exploit the vulnerability, an...
CVE-2017-15051
Multiple stored cross-site scripting XSS vulnerabilities in TeamPass before 2.1.27.9 allow authenticated remote attackers to inject arbitrary web script or HTML via the 1 URL value of an item or 2 user log history. To exploit the vulnerability, the attacker must be first authenticated to the...
CVE-2017-15051
Summary: CVE-2017-15051 affects TeamPass prior to 2.1.27.9 with multiple stored XSS vulnerabilities. An authenticated attacker can inject script/html via (1) an item URL value or (2) user log history, potentially affecting administrators when they view logs. Root cause: stored XSS in these fields...
CVE-2017-15054
TeamPass before version 2.1.27.9 is affected by an arbitrary file upload vulnerability in upload.files.php. An authenticated attacker can tamper with request parameters to select a branch, upload an arbitrary file, and access that file to execute code on the server (Remote Command Execution). Aff...
CVE-2017-15052
CVE-2017-15052 affects TeamPass prior to 2.1.27.9. An authenticated manager can bypass access control in requests to delete or modify users via users.queries.php by tampering parameters (e.g., changing the id in delete_user). The root cause is improper enforcement of manager-level permissions, al...
CVE-2017-15053
TeamPass
CVE-2017-15055
TeamPass before 2.1.27.9 does not properly enforce item access control when requesting items.queries.php. It is then possible to copy any arbitrary item into a directory controlled by the attacker, edit any item within a read-only directory, delete an arbitrary item, delete the file attachments o...
CVE-2017-15055
CVE-2017-15055 relates to TeamPass before 2.1.27.9, where item access control is not properly enforced in items.queries.php. An authenticated attacker can tamper with requests (e.g., changing item_id in copy_item) to copy, edit, delete arbitrary items, delete attachments, copy passwords to the cl...
Cross-site Scripting (XSS)
nilsteampassnet/teampass is susceptible to cross-site scripting XSS attacks. The attack can be launched by injecting malicious code via /sources/folders.queries.php...
CVE-2017-15278
Cross-Site Scripting XSS was discovered in TeamPass before 2.1.27.9. The vulnerability exists due to insufficient filtration of data in /sources/folders.queries.php. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website...
CVE-2017-15278
Cross-Site Scripting XSS was discovered in TeamPass before 2.1.27.9. The vulnerability exists due to insufficient filtration of data in /sources/folders.queries.php. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website...
Cross site scripting
Cross-Site Scripting XSS was discovered in TeamPass before 2.1.27.9. The vulnerability exists due to insufficient filtration of data in /sources/folders.queries.php. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website...
CVE-2017-15278
Cross-Site Scripting XSS was discovered in TeamPass before 2.1.27.9. The vulnerability exists due to insufficient filtration of data in /sources/folders.queries.php. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website...
CVE-2017-15278
CVE-2017-15278 affects TeamPass versions prior to 2.1.27.9. The vulnerability is a cross-site scripting (XSS) issue caused by insufficient filtration of data in the code path /sources/folders.queries.php, allowing an attacker to inject arbitrary HTML/script in a user’s browser when visiting the v...
TeamPass Cross-Site Scripting Vulnerability (CNVD-2017-30335)
TeamPass is a dedicated password manager for Apache, MySQL and PHP. A cross-site scripting vulnerability exists in versions prior to TeamPass 2.1.27.9 that stems from the program failing to adequately filter data. A remote attacker can exploit this vulnerability to execute arbitrary HTML or scrip...
Cross-site Scripting (XSS)
nilsteampassnet/teampass is susceptible to cross-site scripting XSS attacks. The attacks can be launched due to not sanitizing values in users.queries.php...
TeamPass SQL Injection Vulnerability (CNVD-2017-11316)
TeamPass is a dedicated password manager for Apache, MySQL and PHP. A SQL injection vulnerability exists in the users.queries.php file in versions of TeamPass prior to 2.1.27.4. A remote attacker can exploit this vulnerability to execute arbitrary SQL commands...
SQL Injection
Teampass is vulnerable to SQL Injection. A malicious user can inject and execute arbitrary sql through the users.queries.php page due to the lack of sanitization of input parameters...