- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 42 · 2 critical, 9 high, 10 medium, 1 low
- Registry
- Packagist
Advisories 42
- CVE-2024-50703Medium 5.4
TeamPass before 3.1.3.1 does not properly prevent a user from acting with the privileges of a different user_id.
Affected: fixed in 3.1.3.1.
- CVE-2024-50702Medium 5.4
TeamPass before 3.1.3.1 does not properly check whether a mail_me (aka action_mail) operation is on behalf of an administrator or manager.
Affected: fixed in 3.1.3.1.
- CVE-2024-50701Medium 4.3
TeamPass before 3.1.3.1, when retrieving information about access rights for a folder, does not properly check whether a folder is in a…
Affected: fixed in 3.1.3.1.
- CVE-2023-3565Medium 5.2
Cross-site Scripting (XSS) - Generic in nilsteampassnet/teampass
Affected: fixed in 3.0.10.
- CVE-2023-3553Medium 5.3
Exposure of Sensitive Information to an Unauthorized Actor in nilsteampassnet/teampass
Affected: fixed in 3.0.10.
- CVE-2023-3552High 7.6
Improper Encoding or Escaping of Output in nilsteampassnet/teampass
Affected: fixed in 3.0.10.
- CVE-2023-3551Critical 9.1
Code Injection in nilsteampassnet/teampass
Affected: fixed in 3.0.10.
- CVE-2023-3531High 8.1
Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampass
Affected: fixed in 3.0.10.
- CVE-2023-3191High 8.1
Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampass
Affected: fixed in 3.0.9.
- CVE-2023-3190Low 3.5
Improper Encoding or Escaping of Output in nilsteampassnet/teampass
Affected: fixed in 3.0.9.
- CVE-2023-3095Medium 6.2
Improper Access Control in nilsteampassnet/teampass
Affected: fixed in 3.0.9.
- CVE-2023-3086Critical 9.0
Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampass
Affected: fixed in 3.0.9.
- CVE-2023-3084High 8.1
Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampass
Affected: fixed in 3.0.9.
- CVE-2023-3083Medium 6.1
Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampass
Affected: fixed in 3.0.9.
- CVE-2023-3009High 8.1
Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampass
Affected: fixed in 3.0.9.
Show all 42 advisoriesShow fewer advisories
- CVE-2023-2859High 7.1
Code Injection in nilsteampassnet/teampass
Affected: fixed in 3.0.9.
- CVE-2023-2591High 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in nilsteampassnet/teampass
Affected: fixed in 3.0.7.
- CVE-2023-2516Medium 5.4
Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampass
Affected: fixed in 3.0.7.
- CVE-2023-2021Medium 5.8
Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampass
Affected: fixed in 3.0.3.
- CVE-2023-1545High 7.5
SQL Injection in nilsteampassnet/teampass
Affected: fixed in 3.0.0.22.
- CVE-2023-1463Medium 6.3
Authorization Bypass Through User-Controlled Key in nilsteampassnet/teampass
Affected: fixed in 3.0.0.23.
- CVE-2023-1070High 7.1
External Control of File Name or Path in nilsteampassnet/teampass
Affected: fixed in 3.0.0.23.
- CVE-2022-26980Unrated
Teampass 2.1.26 allows reflected XSS via the index.php PATH_INFO.
Affected: through 2.1.26.
- CVE-2020-11671Unrated
Lack of authorization controls in REST API functions in TeamPass through 2.1.27.36 allows any TeamPass user with a valid API token to…
Affected: through 2.1.27.36.
- CVE-2020-12477Unrated
The REST API functions in TeamPass 2.1.27.36 allow any user with a valid API token to bypass IP address whitelist restrictions via an…
Affected: through 2.1.27.36.
- CVE-2020-12478Unrated
TeamPass 2.1.27.36 allows an unauthenticated attacker to retrieve files from the TeamPass web root.
Affected: versions 2.1.27.36.
- CVE-2020-12479Unrated
TeamPass 2.1.27.36 allows any authenticated TeamPass user to trigger a PHP file include vulnerability via a crafted HTTP request with…
Affected: through 2.1.27.36.
- CVE-2019-17203Unrated
TeamPass 2.1.27.36 allows Stored XSS at the Search page by setting a crafted password for an item in any folder.
Affected: through 2.1.27.36.
- CVE-2019-17204Unrated
TeamPass 2.1.27.36 allows Stored XSS by setting a crafted Knowledge Base label and adding any available item.
Affected: through 2.1.27.36.
- CVE-2019-17205Unrated
TeamPass 2.1.27.36 allows Stored XSS by placing a payload in the username field during a login attempt.
Affected: through 2.1.27.36.
- CVE-2019-16904Unrated
TeamPass 2.1.27.36 allows Stored XSS by setting a crafted password for an item in a common available folder or sharing the item with an…
Affected: through 2.1.27.36.
- CVE-2019-12950Unrated
An issue was discovered in TeamPass 2.1.27.35.
Affected: through 2.1.27.35.
- CVE-2019-1000001Unrated
TeamPass version 2.1.27 and earlier contains a Storing Passwords in a Recoverable Format vulnerability in Shared password vaults that can…
Affected: through 2.1.27.
- CVE-2017-15055Unrated
TeamPass before 2.1.27.9 does not properly enforce item access control when requesting items.queries.php.
Affected: fixed in 2.1.27.9.
- CVE-2017-15054Unrated
An arbitrary file upload vulnerability, present in TeamPass before 2.1.27.9, allows remote authenticated users to upload arbitrary files…
Affected: fixed in 2.1.27.9.
- CVE-2017-15053Unrated
TeamPass before 2.1.27.9 does not properly enforce manager access control when requesting roles.queries.php.
Affected: fixed in 2.1.27.9.
- CVE-2017-15052Unrated
TeamPass before 2.1.27.9 does not properly enforce manager access control when requesting users.queries.php.
Affected: fixed in 2.1.27.9.
- CVE-2017-15051Unrated
Multiple stored cross-site scripting (XSS) vulnerabilities in TeamPass before 2.1.27.9 allow authenticated remote attackers to inject…
Affected: fixed in 2.1.27.9.
- CVE-2017-15278Unrated
Cross-Site Scripting (XSS) was discovered in TeamPass before 2.1.27.9.
Affected: fixed in 2.1.27.9.
- CVE-2017-9436Unrated
TeamPass before 2.1.27.4 is vulnerable to a SQL injection in users.queries.php.
Affected: fixed in 2.1.27.5.
- CVE-2015-7564Unrated
Multiple SQL injection vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to execute arbitrary SQL commands via the (1)…
Affected: fixed in 2.1.25.
- CVE-2015-7562Unrated
Multiple cross-site scripting (XSS) vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to inject arbitrary web script…
Affected: fixed in 2.1.25.