CVE-2019-1000001: Insufficiently Protected Credentials

TeamPass version 2.1.27 and earlier contains a Storing Passwords in a Recoverable Format vulnerability in Shared password vaults that can result in all shared passwords are recoverable server side. This attack appears to be exploitable via any vulnerability that can bypass authentication or role...

PT-2019-11255

Name of the Vulnerable Software and Affected Versions: TeamPass versions 2.1.27 and earlier Description: The issue allows for the recovery of shared passwords on the server side due to passwords being stored in a recoverable format in shared password vaults. This can be exploited through any...

Cross-site Request Forgery (CSRF)

TeamPass is vulnerable to cross-site request forgery CSRF attacks. The library does not generate session tokens for users, meaning a user can pass a malicious request as another user...

Authorization Bypass

TeamPass is vulnerable to authorization bypass. The application does not properly check if a user has the proper permissions to access an item, allowing a malicious user to modify or delete multiple attributes of an item by modifying requests sent to the application...

Remote Code Execution (RCE) Through Arbitrary File Upload

nilsteampassnet/teampass is vulnerable to remote code execution RCE attacks. A malicious user can modify the the parameters in a HTTP request to upload.files.php to upload an arbitrary file that when accessed on the server is executed...

Authorization Bypass

TeamPass is vulnerable to authorization bypass. The application does not properly enforce user role permissions, allowing a malicious user to modify or delete another user's role in the application...

Authorization Bypass

TeamPass is vulnerable to authorization bypass. The library does not properly check if a user has the proper permissions to modify the attributes of other users, allowing a malicious user to delete or modify another user's account...

Cross-site Scripting (XSS)

nilsteampassnet/teampass is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary webscript through the URL value of item object or the log history of a user...

TeamPass upload.files.php file arbitrary file upload vulnerability

TeamPass is a dedicated password manager for Apache, MySQL and PHP. An arbitrary file upload vulnerability exists in versions of TeamPass prior to 2.1.27.9. A remote attacker can exploit this vulnerability by tampering with the parameters in a request sent to the upload.files.php file to upload...

TeamPass users.series.php Access Control Vulnerability

TeamPass is a dedicated password manager for Apache, MySQL and PHP. An access control vulnerability exists in versions prior to TeamPass 2.1.27.9 that stems from the program failing to properly enforce administrator access control. An attacker can exploit this vulnerability by obtaining...

TeamPass items.series.php Access Control Vulnerability

TeamPass is a dedicated password manager for Apache, MySQL and PHP. An access control vulnerability exists in versions prior to TeamPass 2.1.27.9 that stems from the program failing to properly enforce item access control. An attacker can exploit the vulnerability by tampering with requests to...

TeamPass < 2.1.27.4 SQLi Vulnerability

TeamPass is prone to an SQL injection SQLi vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:teampass:teampass";...

TeamPass roles.queries.php Access Control Vulnerability

TeamPass is a dedicated password manager for Apache, MySQL and PHP. An access control vulnerability exists in versions prior to TeamPass 2.1.27.9 that stems from the program failing to properly enforce administrator access control. An attacker can exploit the vulnerability by gaining administrato...

TeamPass < 2.1.27.9 Multiple Vulnerabilities (Nov 2017)

TeamPass is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:teampass:teampass"; ifdescription...

Multiple Cross-Site Scripting Vulnerabilities in TeamPass

TeamPass is a dedicated password manager for Apache, MySQL and PHP. Multiple cross-site scripting vulnerabilities exist in versions of TeamPass prior to 2.1.27.9. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML with the help of an item's URL value or user l...

Improper access control

TeamPass before 2.1.27.9 does not properly enforce manager access control when requesting users.queries.php. It is then possible for a manager user to delete an arbitrary user including admin, or modify attributes of any arbitrary user except administrator. To exploit the vulnerability, an...

Directory traversal

TeamPass before 2.1.27.9 does not properly enforce item access control when requesting items.queries.php. It is then possible to copy any arbitrary item into a directory controlled by the attacker, edit any item within a read-only directory, delete an arbitrary item, delete the file attachments o...

Improper access control

TeamPass before 2.1.27.9 does not properly enforce manager access control when requesting roles.queries.php. It is then possible for a manager user to modify any arbitrary roles within the application, or delete any arbitrary role. To exploit the vulnerability, an authenticated attacker must have...

Cross site scripting

Multiple stored cross-site scripting XSS vulnerabilities in TeamPass before 2.1.27.9 allow authenticated remote attackers to inject arbitrary web script or HTML via the 1 URL value of an item or 2 user log history. To exploit the vulnerability, the attacker must be first authenticated to the...

CVE-2017-15053

TeamPass before 2.1.27.9 does not properly enforce manager access control when requesting roles.queries.php. It is then possible for a manager user to modify any arbitrary roles within the application, or delete any arbitrary role. To exploit the vulnerability, an authenticated attacker must have...