pglombardo passwordpusher vulnerabilities, newest first
Filter
By year: all 2026 2025 2024 2023 2022 2021
- 6.3CVE-2026-126400EPSS 0.1%
Password Pusher from 1.49.0 before 2.17.0 contains an IP spoofing vulnerability that allows remote clients to forge the recorded request IP via unanchored trusted-proxy regular expressions. Clients in 110.0.0.0/8 or 210.0.0.0/8, or connect…
- 8.7CVE-2026-87816EPSS 0.4%
PasswordPusher before 2.11.1 contains a time-of-check-to-time-of-use race condition in view limit enforcement that allows unauthenticated attackers to bypass expire_after_views limits. Attackers can send concurrent requests to the show end…
- 6.9CVE-2026-62382ExploitEPSS 1.2%
PasswordPusher versions v1.45.11 through v2.9.5 contain an improper authorization vulnerability in the push deletion logic. The ownership check compares @push.user against current_user; for an anonymously created push both values are nil, …
- 8.7CVE-2026-61458EPSS 0.4%
PasswordPusher before 2.9.2 contains a brute-force vulnerability in the POST /p/:token/access endpoint that lacks route-specific rate limiting and per-push lockout mechanisms. Attackers who know a push token can systematically guess passph…
- 5.7CVE-2024-56733EPSS 0.2%
Password Pusher is an open source application to communicate sensitive information over the web. A vulnerability has been reported in versions 1.50.3 and prior where an attacker can copy the session cookie before a user logs out, potential…
- 5.3CVE-2024-52796EPSS 0.5%
Password Pusher, an open source application to communicate sensitive information over the web, comes with a configurable rate limiter. In versions prior to v1.49.0, the rate limiter could be bypassed by forging proxy headers allowing bad …
- 7.1CVE-2024-51989EPSS 0.4%
Password Pusher is an open source application to communicate sensitive information over the web. A cross-site scripting (XSS) vulnerability was identified in the PasswordPusher application, affecting versions `v1.41.1` through and includin…