20 matches found
EUVD-2025-7821
Malicious code in bioql PyPI...
EUVD-2022-4256
Malicious code in bioql PyPI...
EUVD-2024-1067
Malicious code in bioql PyPI...
CVE-2024-33670
Passbolt API before 4.6.2 allows HTML injection in a URL parameter, resulting in custom content being displayed when a user visits the crafted URL. Although the injected content is not executed as JavaScript due to Content Security Policy CSP restrictions, it may still impact the appearance and...
CVE-2025-27913
Passbolt API before 5, if the server is misconfigured with an incorrect installation process and disregarding of Health Check results, can send email messages with a domain name taken from an attacker-controlled HTTP Host header...
CVE-2025-27913
Passbolt API before 5, if the server is misconfigured with an incorrect installation process and disregarding of Health Check results, can send email messages with a domain name taken from an attacker-controlled HTTP Host header...
CVE-2025-27913
Passbolt API before 5, if the server is misconfigured with an incorrect installation process and disregarding of Health Check results, can send email messages with a domain name taken from an attacker-controlled HTTP Host header...
CVE-2025-27913
Passbolt API before 5, if the server is misconfigured with an incorrect installation process and disregarding of Health Check results, can send email messages with a domain name taken from an attacker-controlled HTTP Host header...
CVE-2025-27913
Passbolt API before 5, if the server is misconfigured with an incorrect installation process and disregarding of Health Check results, can send email messages with a domain name taken from an attacker-controlled HTTP Host header...
CVE-2025-27913
CVE-2025-27913 concerns Passbolt API prior to version 5. The description in multiple sources states that a server misconfiguration during installation (and disregard of Health Check results) allows emails to be sent with a domain name taken from an attacker-controlled HTTP Host header. The CVSS d...
CVE-2024-33670
Passbolt API before 4.6.2 allows HTML injection in a URL parameter, resulting in custom content being displayed when a user visits the crafted URL. Although the injected content is not executed as JavaScript due to Content Security Policy CSP restrictions, it may still impact the appearance and...
CVE-2024-33670
Passbolt API before 4.6.2 allows HTML injection in a URL parameter, resulting in custom content being displayed when a user visits the crafted URL. Although the injected content is not executed as JavaScript due to Content Security Policy CSP restrictions, it may still impact the appearance and...
PT-2024-25428 · Passbolt · Passbolt Api
Name of the Vulnerable Software and Affected Versions: Passbolt API versions prior to 4.6.2 Description: The issue allows HTML injection in a URL parameter, resulting in custom content being displayed when a user visits the crafted URL. Although the injected content is not executed as JavaScript...
Passbolt API is vulnerable to XSS in the url field on the password workspace grid and sidebar
Passbolt API version 1.6.4 and older are vulnerable to a XSS in the url field on the password workspace...
GHSA-J2FP-9WP5-MG66 Passbolt API is vulnerable to XSS in the url field on the password workspace grid and sidebar
Passbolt API version 1.6.4 and older are vulnerable to a XSS in the url field on the password workspace...
Passbolt Cross-Site Scripting Vulnerability
Passbolt API is an open source team password manager. A cross-site scripting vulnerability exists in the url field of the password workspace in Passbolt API versions 1.6.4 and earlier. A remote attacker could exploit this vulnerability to execute code, alter or delete resources...
Default credentials
Passbolt API version 1.6.4 and older are vulnerable to a XSS in the url field on the password workspace...
CVE-2017-1000442
Passbolt API version 1.6.4 and older are vulnerable to a XSS in the url field on the password workspace...
CVE-2017-1000442
Passbolt API version 1.6.4 and older are vulnerable to a XSS in the url field on the password workspace...
CVE-2017-1000442
Passbolt API version 1.6.4 and older are vulnerable to a XSS in the url field on the password workspace...