Jeroen Pinoy

MISP: IDOR via Client-Supplied Report ID in Module Results Processing Allows Reparenting and Overwriting of Other Events' Reports

MISP: HTTP Method Bypass of Login Security Controls (Bruteforce Protection and Email OTP)

MISP Event Report Cross-Event Reparenting via Unscoped UUID Resolution in editReport

MISP Privilege Escalation: Read-Only API Key User Can Regain Full Role via updateLoginTime

MISP Blocklist Workflow Module: Arbitrary Script Execution via Unrestricted File Extension

MISP ObjectReferencesController: Granular Distribution and Sharing Group Restrictions Bypassed When Adding Object References

MISP CSRF vulnerability allows unauthorized attribute modification

Stored Cross-Site Scripting in MISP Galaxy Matrix Statistics via Unescaped Galaxy Name

Path traversal in Pandora archive extractor allows arbitrary file writes outside the extraction directory in pandora analysis

Flowintel Missing Task-to-Case Authorization Allows Cross-Case Task Modification