Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
31 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
TeamPass before 3.1.3.1 does not properly check whether a mailme (aka actionmail) operation is on behalf of an administrator or manager.
Recommended action: Upgrade to 3.1.3.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
TeamPass before 3.1.3.1 does not properly prevent a user from acting with the privileges of a different userid.
Recommended action: Upgrade to 3.1.3.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
TeamPass before 3.1.3.1, when retrieving information about access rights for a folder, does not properly check whether a folder is in a user's allowed folders list that has been defined by an admin.
Recommended action: Upgrade to 3.1.3.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site Scripting (XSS) - Generic in GitHub repository nilsteampassnet/teampass prior to 3.0.10.
Recommended action: Upgrade to 3.0.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
TeamPass prior to 3.0.10 allows unauthenticated actors to view application-specific and user data and files by viewing an endpoint directory listing.
Recommended action: Upgrade to 3.0.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
TeamPass prior to 3.0.10 is vulnerable to cross-site scripting filter bypass in folder names. This can lead to information disclosure.
Recommended action: Upgrade to 3.0.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Code Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.10.
Recommended action: Upgrade to 3.0.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.10.
Recommended action: Upgrade to 3.0.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In versions of nilsteampassnet/teampass prior to 3.0.9 some user input was not properly sanitized which may have lead to stored cross-site scripting (XSS) vectors in the application.
Recommended action: Upgrade to 3.0.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In versions of nilsteampassnet/teampass prior to 3.0.9 some user input was not properly sanitized which may have lead to stored cross-site scripting (XSS) vectors in the application.
Recommended action: Upgrade to 3.0.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Improper Access Control in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
Recommended action: Upgrade to 3.0.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
Recommended action: Upgrade to 3.0.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
Recommended action: Upgrade to 3.0.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
Recommended action: Upgrade to 3.0.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9. This enables an attacker to inject malicious code into a shared folder, which can then be executed by other users who have access to the folder.
Recommended action: Upgrade to 3.0.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
nilsteampassnet/teampass prior to 3.0.9 is vulnerable to code injection. A malicious user could potentially rename a folder with a payload containing malicious code. This could result in an attack on an admin who edits the folder, as the payload could execute upon the admin's interaction with the folder. This attack could potentially allow the attacker to gain unauthorized access to the admin's system or steal sensitive information, or it could force admin to get redirected to a website controlled by the attacker.
Recommended action: Upgrade to 3.0.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In nilsteampassnet/teampass prior to 3.0.7, if two users have the same folder access, malicious users can create an item where its label field is vulnerable to HTML injection. When other users see that item, it may force them to redirect to the attacker's website or capture their data using a form. The issue is fixed in version 3.0.7.
Recommended action: Upgrade to 3.0.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
nilsteampassnet/teampass prior to version 3.0.7 is vulnerable to cross site scripting (XSS) from item names within a folder.
Recommended action: Upgrade to 3.0.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
nilsteampassnet/teampass prior to 3.0.3 is vulnerable to stored cross-site scripting (XSS) in the description parameter of a folder.
Recommended action: Upgrade to 3.0.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
SQL Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.0.22.
Recommended action: Upgrade to 3.0.0.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Improper Authorization in GitHub repository nilsteampassnet/teampass prior to 3.0.0.23.
Recommended action: Upgrade to 3.0.0.23 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
External Control of File Name or Path in GitHub repository nilsteampassnet/teampass prior to 3.0.0.22.
Recommended action: Upgrade to 3.0.0.23 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Multiple SQL injection vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in an actiononquickicon action to item.query.php or the (2) order or (3) direction parameter in an (a) connectionslogs, (b) errorslogs or (c) accesslogs action to view.query.php.
Recommended action: Upgrade to 2.1.25 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Multiple cross-site scripting (XSS) vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) label value of an item or (2) name of a role.
Recommended action: Upgrade to 2.1.25 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
TeamPass before 2.1.27.5 is vulnerable to a SQL injection in users.queries.php.
Recommended action: Upgrade to 2.1.27.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.