PT-2024-33: Business logic vulnerability in Passwork

The vulnerability was identified in Passwork version 6.4.0. The application's logic requires the user to perform a correct sequence of actions to implement the functionality. The vulnerability in the business logic can be exploited by an attacker to gain access to the application's functionality...

PT-2024-32: Stored Cross-Site Scripting (Stored XSS) in Passwork

The vulnerability was identified in Passwork version 6.4.0. The application does not process the data received from the user, which is necessary for safety use during web page formation. Discovered vulnerability allows an attacker to execute arbitrary JavaScript code in victim's browser...

PT-2024-31

Name of the Vulnerable Software and Affected Versions Passwork affected versions not specified Description The issue is related to the lack of protection of the web page structure in the password manager. This could allow a remote attacker to conduct a cross-site scripting XSS attack...

PT-2024-29

Name of the Vulnerable Software and Affected Versions Passwork affected versions not specified Description The issue is related to incorrect restriction of the path name to a directory with limited access in the password manager. An attacker, acting remotely, can exploit this to gain unauthorized...