Vulnerabilities Detected in TeamPass Repository

[thevietronin]

Hi @nilsteampassnet, I have identified several high vulnerabilities in the TeamPass repository. I would like to know the appropriate process to submit a detailed report for these issues. Additionally, I would appreciate guidance on how to request a CVE (Common Vulnerabilities and Exposures) identifier for these vulnerabilities. Thank you so much!

[corentin-soriano]

@tvnnn Are these vulnerabilities still present on 3.1.2?
https://github.com/nilsteampassnet/TeamPass/releases/tag/3.1.2

[thevietronin]

Hi @corentin-soriano, these vulnerabilities are still present in version 3.1.2. I discovered them just a few hours ago.

[corentin-soriano]

@tvnnn you can send them to Nils: nils@teampass.net
Can you also send me a copy? corentin.soriano@maincare.fr

[thevietronin]

@corentin-soriano Sure, I will send each email containing the details of each vulnerability i’ve found. I will also send any additional vulnerabilities I discover in the latest version in the future.

[corentin-soriano]

Thank you!

[otsmr]

Hey @corentin-soriano and @nilsteampassnet :), I also found a vulnerability (tested against the master branch) and informed you about it by email (29.10 and 05.11), but haven't received any reply yet, so I wanted to ask if the emails are being checked and if you could give a short feedback? Thank you very much :)

[corentin-soriano]

It was in spams folder...

I'll look this week.
Thanks for reporting this!

[nilsteampassnet]

Didn't received it on my side.
@corentin-soriano can you forward it to me please