Jeroen Pinoy

RansomLook API Key Disclosure Through /admin/apikeys HTML Source

Insecure Flask Secret-Key File Permissions Allow Local Administrator Session Forgery in RansomLook

RansomLook Login Endpoint Allows Timing-Based Username Enumeration and Unthrottled Authentication Attempts

MISP Decaying Model Import Mass Assignment Allows Cross-Organization Model Overwrite and Default Flagging

MISP: JavaScript Injection via Remote Tag ID in Event Preview Inline Handler

MISP TAXII Object Viewer Stored XSS via Unescaped JSON Output

MISP ID Translator: Unescaped Remote Event ID Enables Cross-Site Scripting via Linked Server

MISP Stored XSS via Unescaped Count Field Value in Remote Event Preview Index

MISP Reflected Cross-Site Scripting via Unsanitized Analyst Data Seed Parameter

MISP: Nested Model Alias Key Bypasses Sanitization to Modify Cross-Tenant Rows