69 matches found
OPENSUSE-SU-2026:11798-1 go-passbolt-cli-0.5.2-1.1 on GA media
These are all security issues fixed in the go-passbolt-cli-0.5.2-1.1 package on the GA media of openSUSE Tumbleweed...
Passbolt Login Panel Detection
Passbolt login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Passbolt login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Passbolt Login Panel Detection', 'description':...
EUVD-2022-4256
Malicious code in bioql PyPI...
EUVD-2025-7821
Malicious code in bioql PyPI...
EUVD-2024-1067
Malicious code in bioql PyPI...
EUVD-2024-31382
Malicious code in bioql PyPI...
CVE-2024-33670
Passbolt API before 4.6.2 allows HTML injection in a URL parameter, resulting in custom content being displayed when a user visits the crafted URL. Although the injected content is not executed as JavaScript due to Content Security Policy CSP restrictions, it may still impact the appearance and...
CVE-2024-33669
An issue was discovered in Passbolt Browser Extension before 4.6.2. It can send multiple requests to HaveIBeenPwned while a password is being typed, which results in an information leak. This allows an attacker capable of observing Passbolt's HTTPS queries to the Pwned Password API to more easily...
CVE-2017-1000442
Passbolt API version 1.6.4 and older are vulnerable to a XSS in the url field on the password workspace...
CVE-2025-27913
Passbolt API before 5, if the server is misconfigured with an incorrect installation process and disregarding of Health Check results, can send email messages with a domain name taken from an attacker-controlled HTTP Host header...
CVE-2025-27913
Passbolt API before 5, if the server is misconfigured with an incorrect installation process and disregarding of Health Check results, can send email messages with a domain name taken from an attacker-controlled HTTP Host header...
CVE-2025-27913
Passbolt API before 5, if the server is misconfigured with an incorrect installation process and disregarding of Health Check results, can send email messages with a domain name taken from an attacker-controlled HTTP Host header...
CVE-2025-27913
Passbolt API before 5, if the server is misconfigured with an incorrect installation process and disregarding of Health Check results, can send email messages with a domain name taken from an attacker-controlled HTTP Host header...
Passbolt security vulnerabilities
Passbolt is an open source password manager from the French company Passbolt. A security vulnerability exists in versions prior to Passbolt 5, which stems from a server misconfiguration that could result in the sending of e-mail with an attacker-controlled HTTP Host header domain...
PT-2025-10631
Name of the Vulnerable Software and Affected Versions Passbolt API versions prior to 5 Description The issue arises when the server is misconfigured, specifically with an incorrect installation process and disregard of Health Check results. In such cases, the Passbolt API can send email messages...
CVE-2025-27913: Use of Less Trusted Source
Passbolt API before 5, if the server is misconfigured with an incorrect installation process and disregarding of Health Check results, can send email messages with a domain name taken from an attacker-controlled HTTP Host header...
CVE-2025-27913
Passbolt API before 5, if the server is misconfigured with an incorrect installation process and disregarding of Health Check results, can send email messages with a domain name taken from an attacker-controlled HTTP Host header...
CVE-2025-27913
Passbolt API before 5, if the server is misconfigured with an incorrect installation process and disregarding of Health Check results, can send email messages with a domain name taken from an attacker-controlled HTTP Host header...
CVE-2025-27913
The Passbolt API (versions prior to 5 ) is vulnerable to a Host Header Injection flaw (CWE-348) when the server is misconfigured. This occurs if the installation process is incorrect and Health Check results are disregarded, allowing an attacker to control the HTTP Host header . Consequently, the...
