CVE-2024-33669

An issue was discovered in Passbolt Browser Extension before 4.6.2. It can send multiple requests to HaveIBeenPwned while a password is being typed, which results in an information leak. This allows an attacker capable of observing Passbolt's HTTPS queries to the Pwned Password API to more easily...

PT-2024-25428 · Passbolt · Passbolt Api

Name of the Vulnerable Software and Affected Versions: Passbolt API versions prior to 4.6.2 Description: The issue allows HTML injection in a URL parameter, resulting in custom content being displayed when a user visits the crafted URL. Although the injected content is not executed as JavaScript...

CVE-2024-33669

An issue was discovered in Passbolt Browser Extension before 4.6.2. It can send multiple requests to HaveIBeenPwned while a password is being typed, which results in an information leak. This allows an attacker capable of observing Passbolt's HTTPS queries to the Pwned Password API to more easily...

CVE-2024-33670

Passbolt API before 4.6.2 allows HTML injection in a URL parameter, resulting in custom content being displayed when a user visits the crafted URL. Although the injected content is not executed as JavaScript due to Content Security Policy CSP restrictions, it may still impact the appearance and...

Solving Your Teams Secure Collaboration Challenges

In today's interconnected world, where organisations regularly exchange sensitive information with customers, partners and employees, secure collaboration has become increasingly vital. However, collaboration can pose a security risk if not managed properly. To ensure that collaboration remains...

GHSA-J2FP-9WP5-MG66 Passbolt API is vulnerable to XSS in the url field on the password workspace grid and sidebar

Passbolt API version 1.6.4 and older are vulnerable to a XSS in the url field on the password workspace...

Passbolt API is vulnerable to XSS in the url field on the password workspace grid and sidebar

Passbolt API version 1.6.4 and older are vulnerable to a XSS in the url field on the password workspace...

Remote code execution

More info at https://www.passbolt.com/incidents/20190211multiplevulnerabilities...

E-mail HTML injection

More info at https://www.passbolt.com/incidents/20190211multiplevulnerabilities...

Remote code execution

More info at https://www.passbolt.com/incidents/20190211multiplevulnerabilities...

Passbolt Cross-Site Scripting Vulnerability

Passbolt API is an open source team password manager. A cross-site scripting vulnerability exists in the url field of the password workspace in Passbolt API versions 1.6.4 and earlier. A remote attacker could exploit this vulnerability to execute code, alter or delete resources...

Default credentials

Passbolt API version 1.6.4 and older are vulnerable to a XSS in the url field on the password workspace...

CVE-2017-1000442

Passbolt API version 1.6.4 and older are vulnerable to a XSS in the url field on the password workspace...

CVE-2017-1000442

Passbolt API version 1.6.4 and older are vulnerable to a XSS in the url field on the password workspace...

CVE-2017-1000442

CVE-2017-1000442 affects Passbolt API (version 1.6.4 and earlier) and is due to a cross-site scripting (XSS) vulnerability in the url field within the password workspace. The issue allows XSS via the URL input in the affected component; under CVSS3, the base score is 5.4 (MEDIUM) with network as ...

CVE-2017-1000442

Passbolt API version 1.6.4 and older are vulnerable to a XSS in the url field on the password workspace...

Stored XSS on first/last name during setup

More info at https://www.passbolt.com/incidents/20190807multiplevulnerabilities...