CVE-2014-3773

Multiple SQL injection vulnerabilities in TeamPass before 2.1.20 allow remote attackers to execute arbitrary SQL commands via the login parameter in a 1 sendpwbyemail or 2 generatenewpassword action in sources/main.queries.php; iDisplayStart parameter to 3 datatable.logs.php or 4 a file in...

CVE-2014-3773

CVE-2014-3773 concerns TeamPass prior to version 2.1.20, with multiple SQL injection vulnerabilities exposed through various parameters in the web interface. The affected components include sources/main.queries.php (login-related actions: send_pw_by_email, generate_new_password) and data handling...

CVE-2014-3771

TeamPass before 2.1.20 allows remote attackers to bypass access restrictions via the language file path in a 1 request to index.php or 2 "changeuserlanguage" request to sources/main.queries.php...

CVE-2014-3772

TeamPass before 2.1.20 allows remote attackers to bypass access restrictions via a request to index.php followed by a direct request to a file that calls the sessionstart function before checking the CPM key, as demonstrated by a request to sources/upload/upload.files.php...

CVE-2014-3772

TeamPass before 2.1.20 is affected by CVE-2014-3772, a remote‑code access bypass. The flaw occurs when a request to index.php is followed by a direct request to a file that calls session_start before the CPM key is validated (illustrated by sources/upload/upload.files.php). This allows an attacke...

PT-2014-5490

Name of the Vulnerable Software and Affected Versions TeamPass versions prior to 2.1.20 Description The issue allows remote attackers to execute arbitrary SQL commands via several parameters, including the login parameter in send pw by email or generate new password actions, iDisplayStart and...

CVE-2014-3772: Undefined Security Weakness

TeamPass before 2.1.20 allows remote attackers to bypass access restrictions via a request to index.php followed by a direct request to a file that calls the sessionstart function before checking the CPM key, as demonstrated by a request to sources/upload/upload.files.php...

CVE-2014-3771: Undefined Security Weakness

TeamPass before 2.1.20 allows remote attackers to bypass access restrictions via the language file path in a 1 request to index.php or 2 "changeuserlanguage" request to sources/main.queries.php...

CVE-2014-3774: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in items.php in TeamPass before 2.1.20 allow remote attackers to inject arbitrary web script or HTML via the group parameter, which is not properly handled in a 1 hidcat or 2 openfolder form element, or 3 id parameter, which is not properly handle...

PT-2014-5488

Name of the Vulnerable Software and Affected Versions TeamPass versions prior to 2.1.20 Description The issue allows remote attackers to bypass access restrictions. This can be achieved via the language file path in a request to "index.php" or a "change user language" request to...

CVE-2014-3773: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in TeamPass before 2.1.20 allow remote attackers to execute arbitrary SQL commands via the login parameter in a 1 sendpwbyemail or 2 generatenewpassword action in sources/main.queries.php; iDisplayStart parameter to 3 datatable.logs.php or 4 a file in...

CVE-2012-2234

Cross-site scripting XSS vulnerability in sources/users.queries.php in TeamPass before 2.1.6 allows remote authenticated users to inject arbitrary web script or HTML via the login parameter in an addnewuser action...

Cross site scripting

Cross-site scripting XSS vulnerability in sources/users.queries.php in TeamPass before 2.1.6 allows remote authenticated users to inject arbitrary web script or HTML via the login parameter in an addnewuser action...

CVE-2012-2234

Cross-site scripting XSS vulnerability in sources/users.queries.php in TeamPass before 2.1.6 allows remote authenticated users to inject arbitrary web script or HTML via the login parameter in an addnewuser action...

CVE-2012-2234

CVE-2012-2234 corresponds to a Cross‑Site Scripting (XSS) flaw in TeamPass prior to 2.1.6, exposed in sources/users.queries.php during the add_new_user action. The vulnerability allows remote authenticated users to inject arbitrary web script or HTML by manipulating the login parameter, with the ...

CVE-2012-2234: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in sources/users.queries.php in TeamPass before 2.1.6 allows remote authenticated users to inject arbitrary web script or HTML via the login parameter in an addnewuser action...

TeamPass 2.1.5 - 'login' HTML Injection

source: https://www.securityfocus.com/bid/53038/info TeamPass is prone to an HTML-injection vulnerability because it fails to sanitize user-supplied input. Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal...

TeamPass 2.1.5 - login HTML Injection

TeamPass 2.1.5 - login HTML Injection source: https://www.securityfocus.com/bid/53038/info TeamPass is prone to an HTML-injection vulnerability because it fails to sanitize user-supplied input. Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially...

Teampass <= v2.1.6 Arbitrary File Upload / Export decrypt passwords

Exploit for php platform in category web applications Vendor or Software Link: https://github.com/nilsteampassnet/TeamPass Version: connect; // Get all accounts $rows = $db-fetchallarray" SELECT i.id AS id, i.restrictedto AS restrictedto, i.perso AS perso, i.label AS label, i.description AS...