Jeroen Pinoy

MISP Overmind: Stored Cross-Site Scripting via Unescaped Object Names in Statistics Legends

Path traversal in Pandora archive extractor allows arbitrary file writes outside the extraction directory in pandora analysis

Flowintel Login Email Validation Bypass Allows Log Injection via Crafted Email Input

Flowintel Fails to Invalidate Active Sessions After Password Change

Flowintel HTML Injection in MISP Case History Timeline via Crafted Object Attributes

Flowintel Missing Authorization Allows Regular API Users to View Other Users’ Task Assignments

Flowintel Organization Administrator Can Reset Full Administrator Password and Escalate Privileges

Flowintel Missing Task-to-Case Authorization Allows Cross-Case Task Modification

Flowintel Stored XSS in Calendar via Malicious Case Title

Flowintel Stored XSS in Case Notes via Malicious Mermaid Diagram Content