685 matches found
CVE-2020-11671
The CVE-2020-11671 entry concerns TeamPass: lack of authorization controls in REST API functions in TeamPass 2.1.27.36 and earlier allows any user with a valid API token to become an administrator and read/modify all passwords via api/index.php REST API calls. The impact is elevated privileges an...
Local File Inclusion
Teampass is vulnerable to local file inclusion. It does not sanitize the newValue HTTP request provided by the user along with sources/users.queries.php to choose language preferences, allowing a user to include malicious PHP file and to execute directly on the server...
PT-2020-12761
Name of the Vulnerable Software and Affected Versions TeamPass versions 2.1.27.36 and earlier Description The issue is related to a lack of authorization controls in REST API functions. This allows any TeamPass user with a valid API token to become a TeamPass administrator and read or modify all...
CVE-2020-11671: Missing Authorization
Lack of authorization controls in REST API functions in TeamPass through 2.1.27.36 allows any TeamPass user with a valid API token to become a TeamPass administrator and read/modify all passwords via authenticated api/index.php REST API calls. NOTE: the API is not available by default...
TeamPass Path Traversal Vulnerability
TeamPass is an open source password manager from the developers of NILS LAUMAILL? software. A security vulnerability exists in TeamPass version 2.1.27.36. An attacker can exploit the vulnerability by sending an HTTP request with the 'newValue' parameter to the sources/users.series.php file to...
TeamPass Injection Vulnerability
TeamPass is an open source password manager from the developers of NILS LAUMAILL? software. A security vulnerability exists in TeamPass version 2.1.27.36. An attacker can exploit this vulnerability to retrieve files including backup files or LDAP debug files in the TeamPass web root directory...
TeamPass Information Disclosure Vulnerability
TeamPass is an open source password manager from the developers of NILS LAUMAILL? software. A security vulnerability exists in the REST API functionality in TeamPass version 2.1.27.36. An attacker can exploit the vulnerability to bypass IP address whitelisting restrictions with the help of the...
CVE-2020-12478
TeamPass 2.1.27.36 allows an unauthenticated attacker to retrieve files from the TeamPass web root. This may include backups or LDAP debug files...
CVE-2020-12479
TeamPass 2.1.27.36 allows any authenticated TeamPass user to trigger a PHP file include vulnerability via a crafted HTTP request with sources/users.queries.php newValue directory traversal...
CVE-2020-12477
The REST API functions in TeamPass 2.1.27.36 allow any user with a valid API token to bypass IP address whitelist restrictions via an X-Forwarded-For client HTTP header to the getIp function...
CVE-2020-12477
The REST API functions in TeamPass 2.1.27.36 allow any user with a valid API token to bypass IP address whitelist restrictions via an X-Forwarded-For client HTTP header to the getIp function...
CVE-2020-12479
TeamPass 2.1.27.36 allows any authenticated TeamPass user to trigger a PHP file include vulnerability via a crafted HTTP request with sources/users.queries.php newValue directory traversal...
CVE-2020-12478
TeamPass 2.1.27.36 allows an unauthenticated attacker to retrieve files from the TeamPass web root. This may include backups or LDAP debug files...
Code injection
TeamPass 2.1.27.36 allows an unauthenticated attacker to retrieve files from the TeamPass web root. This may include backups or LDAP debug files...
Directory traversal
TeamPass 2.1.27.36 allows any authenticated TeamPass user to trigger a PHP file include vulnerability via a crafted HTTP request with sources/users.queries.php newValue directory traversal...
Design/Logic Flaw
The REST API functions in TeamPass 2.1.27.36 allow any user with a valid API token to bypass IP address whitelist restrictions via an X-Forwarded-For client HTTP header to the getIp function...
CVE-2020-12477
The REST API functions in TeamPass 2.1.27.36 allow any user with a valid API token to bypass IP address whitelist restrictions via an X-Forwarded-For client HTTP header to the getIp function...
CVE-2020-12477
The vulnerability CVE-2020-12477 affects TeamPass 2.1.27.36: the REST API allows any user with a valid API token to bypass IP address whitelisting by manipulating the X-Forwarded-For header when calling the getIp function. Multiple connected sources (Red Hat, Veracode, OSV, CNVD/CNVD-2020-27440, ...
