CVE-2014-3772

TeamPass before 2.1.20 allows remote attackers to bypass access restrictions via a request to index.php followed by a direct request to a file that calls the sessionstart function before checking the CPM key, as demonstrated by a request to sources/upload/upload.files.php...

CVE-2014-3773

CVE-2014-3773 concerns TeamPass prior to version 2.1.20, with multiple SQL injection vulnerabilities exposed through various parameters in the web interface. The affected components include sources/main.queries.php (login-related actions: send_pw_by_email, generate_new_password) and data handling...

CVE-2014-3772

TeamPass before 2.1.20 is affected by CVE-2014-3772, a remote‑code access bypass. The flaw occurs when a request to index.php is followed by a direct request to a file that calls session_start before the CPM key is validated (illustrated by sources/upload/upload.files.php). This allows an attacke...

CVE-2014-3771

The provided documents confirm CVE-2014-3771 affects TeamPass before 2.1.20, where an attacker can bypass access restrictions by manipulating the language file path via (1) index.php or (2) the change_user_language request to sources/main.queries.php. This is a remote, unauthenticated vector that...

CVE-2014-3771

TeamPass before 2.1.20 allows remote attackers to bypass access restrictions via the language file path in a 1 request to index.php or 2 "changeuserlanguage" request to sources/main.queries.php...

CVE-2014-3773

Multiple SQL injection vulnerabilities in TeamPass before 2.1.20 allow remote attackers to execute arbitrary SQL commands via the login parameter in a 1 sendpwbyemail or 2 generatenewpassword action in sources/main.queries.php; iDisplayStart parameter to 3 datatable.logs.php or 4 a file in...

CVE-2014-3774

CVE-2014-3774 refers to multiple stored XSS vulnerabilities in TeamPass before 2.1.20 affecting items.php. The vulnerabilities allow remote attackers to inject arbitrary script/HTML via the group parameter (affecting hid_cat/open_folder forms) or the id parameter (open_id form). The issue is tied...

CVE-2014-3774

Multiple cross-site scripting XSS vulnerabilities in items.php in TeamPass before 2.1.20 allow remote attackers to inject arbitrary web script or HTML via the group parameter, which is not properly handled in a 1 hidcat or 2 openfolder form element, or 3 id parameter, which is not properly handle...

CVE-2012-2234

Cross-site scripting XSS vulnerability in sources/users.queries.php in TeamPass before 2.1.6 allows remote authenticated users to inject arbitrary web script or HTML via the login parameter in an addnewuser action...

Cross site scripting

Cross-site scripting XSS vulnerability in sources/users.queries.php in TeamPass before 2.1.6 allows remote authenticated users to inject arbitrary web script or HTML via the login parameter in an addnewuser action...

CVE-2012-2234

CVE-2012-2234 corresponds to a Cross‑Site Scripting (XSS) flaw in TeamPass prior to 2.1.6, exposed in sources/users.queries.php during the add_new_user action. The vulnerability allows remote authenticated users to inject arbitrary web script or HTML by manipulating the login parameter, with the ...

CVE-2012-2234

Cross-site scripting XSS vulnerability in sources/users.queries.php in TeamPass before 2.1.6 allows remote authenticated users to inject arbitrary web script or HTML via the login parameter in an addnewuser action...

TeamPass 2.1.5 - login HTML Injection

TeamPass 2.1.5 - login HTML Injection source: https://www.securityfocus.com/bid/53038/info TeamPass is prone to an HTML-injection vulnerability because it fails to sanitize user-supplied input. Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially...

TeamPass 2.1.5 - 'login' HTML Injection

source: https://www.securityfocus.com/bid/53038/info TeamPass is prone to an HTML-injection vulnerability because it fails to sanitize user-supplied input. Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal...

Teampass <= v2.1.6 Arbitrary File Upload / Export decrypt passwords

Exploit for php platform in category web applications Vendor or Software Link: https://github.com/nilsteampassnet/TeamPass Version: connect; // Get all accounts $rows = $db-fetchallarray" SELECT i.id AS id, i.restrictedto AS restrictedto, i.perso AS perso, i.label AS label, i.description AS...