TeamPass < 2.1.25 Multiple Vulnerabilities (Jan 2016)

TeamPass is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:teampass:teampass"; ifdescription...

Sql injection

Multiple SQL injection vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 id parameter in an actiononquickicon action to item.query.php or the 2 order or 3 direction parameter in an a connectionslogs, b errorslogs or c accesslogs acti...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in TeamPass 2.1.24 and earlier allows remote attackers to hijack the authentication of an authenticated user...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 label value of an item or 2 name of a role...

CVE-2015-7562

Multiple cross-site scripting XSS vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 label value of an item or 2 name of a role...

CVE-2015-7564

Multiple SQL injection vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 id parameter in an actiononquickicon action to item.query.php or the 2 order or 3 direction parameter in an a connectionslogs, b errorslogs or c accesslogs acti...

CVE-2015-7562

Multiple cross-site scripting XSS vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 label value of an item or 2 name of a role...

CVE-2015-7563

Cross-site request forgery CSRF vulnerability in TeamPass 2.1.24 and earlier allows remote attackers to hijack the authentication of an authenticated user...

CVE-2015-7564

Multiple SQL injection vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 id parameter in an actiononquickicon action to item.query.php or the 2 order or 3 direction parameter in an a connectionslogs, b errorslogs or c accesslogs acti...

CVE-2015-7563

CVE-2015-7563 is a CSRF vulnerability in TeamPass 2.1.24 and earlier that allows an attacker to hijack an authenticated user’s session and perform unauthorized actions. Public references confirm vulnerable versions up to 2.1.24, with exploitation documented (exploit-db) and remediation noted as u...

CVE-2015-7564

CVE-2015-7564 affects TeamPass versions up to 2.1.24 (and earlier). The vulnerability is a SQL injection in multiple scripts: specifically via the 1) id parameter in item.query.php (action_on_quick_icon) and 2) order or 3) direction parameters in view.query.php under the connections_logs, errors_...

CVE-2015-7562

Multiple cross-site scripting XSS vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 label value of an item or 2 name of a role...

CVE-2015-7564

Multiple SQL injection vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 id parameter in an actiononquickicon action to item.query.php or the 2 order or 3 direction parameter in an a connectionslogs, b errorslogs or c accesslogs acti...

CVE-2015-7563

Cross-site request forgery CSRF vulnerability in TeamPass 2.1.24 and earlier allows remote attackers to hijack the authentication of an authenticated user...

CVE-2015-7562

TeamPass 2.1.24 and earlier are affected by CVE-2015-7562, a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary script or HTML via the label value of an item or the name of a role. The affected component is the TeamPass application (versions up to and includ...

PT-2017-7226

Name of the Vulnerable Software and Affected Versions TeamPass versions 2.1.24 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML via the label value of an item or the name of a role. This can lead to cross-site scripting XSS attacks. Recommendations...

PT-2017-7228

Name of the Vulnerable Software and Affected Versions TeamPass versions 2.1.24 and earlier Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the id parameter in an action on quick icon action to "item.query.php", or the order or direction...

PT-2017-7227

Name of the Vulnerable Software and Affected Versions TeamPass versions 2.1.24 and earlier Description A cross-site request forgery issue allows remote attackers to hijack the authentication of an authenticated user. Recommendations For TeamPass versions 2.1.24 and earlier, update to a version...

CVE-2015-7564: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 id parameter in an actiononquickicon action to item.query.php or the 2 order or 3 direction parameter in an a connectionslogs, b errorslogs or c accesslogs acti...

CVE-2015-7563: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in TeamPass 2.1.24 and earlier allows remote attackers to hijack the authentication of an authenticated user...