Page 7 of 37 results (0.003 seconds)

CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1

CVE-2015-7563 – TeamPass 2.1.24 - Multiple Vulnerabilities

https://notcve.org/view.php?id=CVE-2015-7563

Cross-site request forgery (CSRF) vulnerability in TeamPass 2.1.24 and earlier allows remote attackers to hijack the authentication of an authenticated user. Vulnerabilidad (CSRF) en TeamPass 2.1.24 y versiones anteriores permite a atacantes remotos a secuestrar la autenticación de un usuario autenticado. • https://www.exploit-db.com/exploits/39559 https://github.com/nilsteampassnet/TeamPass/pull/1140 • CWE-352: Cross-Site Request Forgery (CSRF) •

CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1

CVE-2015-7562 – TeamPass 2.1.24 - Multiple Vulnerabilities

https://notcve.org/view.php?id=CVE-2015-7562

Multiple cross-site scripting (XSS) vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) label value of an item or (2) name of a role. Múltiples vulnerabilidades (XSS) en TeamPass 2.1.24 y anteriores permiten a atacantes remotos inyectar secuencias de comandos web o HTLM a través del (1) valor de etiqueta o (2) nombre de una función. • https://www.exploit-db.com/exploits/39559 https://github.com/nilsteampassnet/TeamPass/pull/1140 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 7.5EPSS: 1%CPEs: 13EXPL: 1

CVE-2014-3772

https://notcve.org/view.php?id=CVE-2014-3772

TeamPass before 2.1.20 allows remote attackers to bypass access restrictions via a request to index.php followed by a direct request to a file that calls the session_start function before checking the CPM key, as demonstrated by a request to sources/upload/upload.files.php. TeamPass anterior a 2.1.20 permite a atacantes remotos evadir las restricciones de acceso a través de una solicitud en index.php seguida por una solicitud directa en un fichero que llama la función session_start antes de comprobar la clave CPM, tal y como fue demostrado por una solicitud en sources/upload/upload.files.php. • http://teampass.net/installation/2.1.20-released.html http://www.openwall.com/lists/oss-security/2014/05/18/2 http://www.openwall.com/lists/oss-security/2014/05/19/5 https://github.com/nilsteampassnet/TeamPass/commit/7715512f2bd5659cc69e063a1c513c19e384340f • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 7.5EPSS: 1%CPEs: 13EXPL: 1

CVE-2014-3771

https://notcve.org/view.php?id=CVE-2014-3771

TeamPass before 2.1.20 allows remote attackers to bypass access restrictions via the language file path in a (1) request to index.php or (2) "change_user_language" request to sources/main.queries.php. TeamPass anterior a 2.1.20 permite a atacantes remotos evadir las restricciones de acceso a través de la ruta del fichero de idiomas en (1) una solicitud en index.php o (2) una solicitud 'change_user_language' en sources/main.queries.php. • http://teampass.net/installation/2.1.20-released.html http://www.openwall.com/lists/oss-security/2014/05/18/2 http://www.openwall.com/lists/oss-security/2014/05/19/5 https://github.com/nilsteampassnet/TeamPass/commit/fd549b245c0f639a8d47bf4f74f92c37c053706f • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 4.3EPSS: 0%CPEs: 13EXPL: 2

CVE-2014-3774

https://notcve.org/view.php?id=CVE-2014-3774

Multiple cross-site scripting (XSS) vulnerabilities in items.php in TeamPass before 2.1.20 allow remote attackers to inject arbitrary web script or HTML via the group parameter, which is not properly handled in a (1) hid_cat or (2) open_folder form element, or (3) id parameter, which is not properly handled in the open_id form element. Múltiples vulnerabilidades de XSS en items.php en TeamPass anterior a 2.1.20 permiten a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro group, el cual no se maneja debidamente en un elemento de formulario (1) hid_cat o (2) open_folder o (3) el parámetro id, el cual no se maneja debidamente en el elemento de formulario open_id. • http://teampass.net/installation/2.1.20-released.html http://www.openwall.com/lists/oss-security/2014/05/18/2 http://www.openwall.com/lists/oss-security/2014/05/19/5 https://github.com/nilsteampassnet/TeamPass/commit/8820c8934d9ba0508ac345e73ad0be29049ec6de https://github.com/nilsteampassnet/TeamPass/commit/fd549b245c0f639a8d47bf4f74f92c37c053706f • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •