Records7All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high5CVSS 7.0–8.9
Exploited now
Passwork records in CISA KEVNo Passwork vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsPriority MEDIUM 41
Passwork On-Premise Edition before 4.6.13 allows migration/uploadExportFile Directory Traversal (to upload files).
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01502 · Published 2022-03-23 · No fix listed CWE-22
Priority LOW 38
Passwork On-Premise Edition before 4.6.13 allows CSRF via the groups, password, and history subsystems.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00417 · Published 2022-03-23 · No fix listed CWE-352
Priority LOW 36
Passwork before 6.2.0 allows remote authenticated users to bypass 2FA by sending all one million of the possible 6-digit codes.
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.00632 · Published 2023-12-26 · No fix listed CWE-863
Priority LOW 33
The PassWork extension 5.0.9 for Chrome and other browsers allows an attacker to obtain the cleartext master password.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00441 · Published 2022-11-07 · No fix listed CWE-312
Priority LOW 33
The PassWork extension 5.0.9 for Chrome and other browsers allows an attacker to obtain cleartext cached credentials.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00441 · Published 2022-11-07 · No fix listed CWE-312
Priority LOW 28
Passwork On-Premise Edition before 4.6.13 has multiple XSS issues.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00568 · Published 2022-03-23 · No fix listed CWE-79
Priority LOW 22
Passwork On-Premise Edition before 4.6.13 allows migration/downloadExportFile Directory Traversal (to read files).
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00953 · Published 2022-03-23 · No fix listed CWE-22
THREATIST.IORead the docs