685 matches found
CVE-2020-12478
TeamPass 2.1.27.36 is affected by CVE-2020-12478 due to improper authentication. An unauthenticated attacker can retrieve files from the web root, potentially exposing backups and LDAP debug files and enabling data exposure or unauthorized operations. The connected Nuclei template confirms the vu...
CVE-2020-12479
TeamPass 2.1.27.36 allows any authenticated TeamPass user to trigger a PHP file include vulnerability via a crafted HTTP request with sources/users.queries.php newValue directory traversal...
CVE-2020-12479
VULNERABILITY SUMMARY: TeamPass 2.1.27.36 is affected by a PHP file include (directory traversal) vulnerability triggered through crafted HTTP requests to sources/users.queries.php with the newValue parameter. The issue allows any authenticated TeamPass user to cause inclusion of arbitrary files,...
PT-2020-13138
Name of the Vulnerable Software and Affected Versions TeamPass version 2.1.27.36 Description The issue allows any authenticated TeamPass user to trigger a PHP file include vulnerability via a crafted HTTP request with sources/users.queries.php using newValue directory traversal. Recommendations F...
CVE-2020-12479: Improper Limitation of a Pathname to a Restricted Directory
TeamPass 2.1.27.36 allows any authenticated TeamPass user to trigger a PHP file include vulnerability via a crafted HTTP request with sources/users.queries.php newValue directory traversal...
CVE-2020-12478: Missing Authentication for Critical Function
TeamPass 2.1.27.36 allows an unauthenticated attacker to retrieve files from the TeamPass web root. This may include backups or LDAP debug files...
PT-2020-13137
Name of the Vulnerable Software and Affected Versions TeamPass version 2.1.27.36 Description The issue allows an unauthenticated attacker to retrieve files from the TeamPass web root, potentially including backups or LDAP debug files. Recommendations For TeamPass version 2.1.27.36, restrict acces...
CVE-2020-12477: Incorrect Authorization
The REST API functions in TeamPass 2.1.27.36 allow any user with a valid API token to bypass IP address whitelist restrictions via an X-Forwarded-For client HTTP header to the getIp function...
PT-2020-13136
Name of the Vulnerable Software and Affected Versions TeamPass version 2.1.27.36 Description The issue allows any user with a valid API token to bypass IP address whitelist restrictions. This is achieved via an X-Forwarded-For client HTTP header to the getIp function. Recommendations For TeamPass...
TeamPass Cross-Site Scripting Vulnerability (CNVD-2019-41893)
TeamPass is an open source password manager. TeamPass suffers from a cross-site scripting vulnerability. An attacker can exploit this vulnerability to execute client-side code...
TeamPass Cross-Site Scripting Vulnerability (CNVD-2019-41894)
TeamPass is an open source password manager. TeamPass suffers from a cross-site scripting vulnerability. An attacker can exploit this vulnerability to execute client-side code...
Cross-site Scripting (XSS)
nilsteampassnet/TeamPass is vulnerable to cross-site scripting XSS. The vulnerability exists as the value of password is not sanitized when displayed in a preview from a search result...
Cross-Site Scripting (XSS)
nilsteampassnet/TeamPass is vulnerable to cross-site scripting XSS. The vulnerability exists as the values of label in viewslogs.php is not sanitized...
Cross-Site Scripting (XSS)
nilsteampassnet/TeamPass is vulnerable to cross-site scripting XSS. The vulnerability exists as the values stored in label was not sanitized in a new Knowledge Base item...
CVE-2019-17204
TeamPass 2.1.27.36 allows Stored XSS by setting a crafted Knowledge Base label and adding any available item...
CVE-2019-17205
TeamPass 2.1.27.36 allows Stored XSS by placing a payload in the username field during a login attempt. When an administrator looks at the log of failed logins, the XSS payload will be executed...
CVE-2019-17204
TeamPass 2.1.27.36 allows Stored XSS by setting a crafted Knowledge Base label and adding any available item...
CVE-2019-17205
TeamPass 2.1.27.36 allows Stored XSS by placing a payload in the username field during a login attempt. When an administrator looks at the log of failed logins, the XSS payload will be executed...