CVE-2014-3771

TeamPass before 2.1.20 allows remote attackers to bypass access restrictions via the language file path in a 1 request to index.php or 2 "changeuserlanguage" request to sources/main.queries.php...

CVE-2014-3772

TeamPass before 2.1.20 allows remote attackers to bypass access restrictions via a request to index.php followed by a direct request to a file that calls the sessionstart function before checking the CPM key, as demonstrated by a request to sources/upload/upload.files.php...

CVE-2014-3774

Multiple cross-site scripting XSS vulnerabilities in items.php in TeamPass before 2.1.20 allow remote attackers to inject arbitrary web script or HTML via the group parameter, which is not properly handled in a 1 hidcat or 2 openfolder form element, or 3 id parameter, which is not properly handle...

CVE-2014-3771

The provided documents confirm CVE-2014-3771 affects TeamPass before 2.1.20, where an attacker can bypass access restrictions by manipulating the language file path via (1) index.php or (2) the change_user_language request to sources/main.queries.php. This is a remote, unauthenticated vector that...

CVE-2014-3773

CVE-2014-3773 concerns TeamPass prior to version 2.1.20, with multiple SQL injection vulnerabilities exposed through various parameters in the web interface. The affected components include sources/main.queries.php (login-related actions: send_pw_by_email, generate_new_password) and data handling...

CVE-2014-3774

CVE-2014-3774 refers to multiple stored XSS vulnerabilities in TeamPass before 2.1.20 affecting items.php. The vulnerabilities allow remote attackers to inject arbitrary script/HTML via the group parameter (affecting hid_cat/open_folder forms) or the id parameter (open_id form). The issue is tied...

CVE-2014-3773

Multiple SQL injection vulnerabilities in TeamPass before 2.1.20 allow remote attackers to execute arbitrary SQL commands via the login parameter in a 1 sendpwbyemail or 2 generatenewpassword action in sources/main.queries.php; iDisplayStart parameter to 3 datatable.logs.php or 4 a file in...

CVE-2014-3772

TeamPass before 2.1.20 is affected by CVE-2014-3772, a remote‑code access bypass. The flaw occurs when a request to index.php is followed by a direct request to a file that calls session_start before the CPM key is validated (illustrated by sources/upload/upload.files.php). This allows an attacke...

PT-2014-5489

Name of the Vulnerable Software and Affected Versions TeamPass versions prior to 2.1.20 Description The issue allows remote attackers to bypass access restrictions. This can be achieved by sending a request to "index.php" followed by a direct request to a file that calls the session start functio...

PT-2014-5488

Name of the Vulnerable Software and Affected Versions TeamPass versions prior to 2.1.20 Description The issue allows remote attackers to bypass access restrictions. This can be achieved via the language file path in a request to "index.php" or a "change user language" request to...

PT-2014-5490

Name of the Vulnerable Software and Affected Versions TeamPass versions prior to 2.1.20 Description The issue allows remote attackers to execute arbitrary SQL commands via several parameters, including the login parameter in send pw by email or generate new password actions, iDisplayStart and...

PT-2014-5491

Name of the Vulnerable Software and Affected Versions TeamPass versions prior to 2.1.20 Description The issue allows remote attackers to inject arbitrary web script or HTML via the group parameter, which is not properly handled in a 1 hid cat or 2 open folder form element, or 3 id parameter, whic...

CVE-2014-3773: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in TeamPass before 2.1.20 allow remote attackers to execute arbitrary SQL commands via the login parameter in a 1 sendpwbyemail or 2 generatenewpassword action in sources/main.queries.php; iDisplayStart parameter to 3 datatable.logs.php or 4 a file in...

CVE-2014-3771: Undefined Security Weakness

TeamPass before 2.1.20 allows remote attackers to bypass access restrictions via the language file path in a 1 request to index.php or 2 "changeuserlanguage" request to sources/main.queries.php...

CVE-2014-3774: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in items.php in TeamPass before 2.1.20 allow remote attackers to inject arbitrary web script or HTML via the group parameter, which is not properly handled in a 1 hidcat or 2 openfolder form element, or 3 id parameter, which is not properly handle...

CVE-2014-3772: Undefined Security Weakness

TeamPass before 2.1.20 allows remote attackers to bypass access restrictions via a request to index.php followed by a direct request to a file that calls the sessionstart function before checking the CPM key, as demonstrated by a request to sources/upload/upload.files.php...

CVE-2012-2234

Cross-site scripting XSS vulnerability in sources/users.queries.php in TeamPass before 2.1.6 allows remote authenticated users to inject arbitrary web script or HTML via the login parameter in an addnewuser action...

Cross site scripting

Cross-site scripting XSS vulnerability in sources/users.queries.php in TeamPass before 2.1.6 allows remote authenticated users to inject arbitrary web script or HTML via the login parameter in an addnewuser action...

CVE-2012-2234

Cross-site scripting XSS vulnerability in sources/users.queries.php in TeamPass before 2.1.6 allows remote authenticated users to inject arbitrary web script or HTML via the login parameter in an addnewuser action...

CVE-2012-2234

CVE-2012-2234 corresponds to a Cross‑Site Scripting (XSS) flaw in TeamPass prior to 2.1.6, exposed in sources/users.queries.php during the add_new_user action. The vulnerability allows remote authenticated users to inject arbitrary web script or HTML by manipulating the login parameter, with the ...