PT-2023-19388

Name of the Vulnerable Software and Affected Versions MISP versions 2.4.167 and earlier Description The issue is related to an XSS in authkey add via a Referer field in the app/View/AuthKeys/authkey display.ctp file. Recommendations For MISP versions 2.4.167 and earlier, as a temporary workaround...

Server side request forgery (ssrf)

Proxmox Virtual Environment PVE and Proxmox Mail Gateway PMG are vulnerable to SSRF when proxying HTTP requests between pvepmgproxy and pvepmgdaemon. An attacker with an unprivileged account can craft an HTTP request to achieve SSRF and file disclosure of any files on the server. Also, in Proxmox...

CVE-2022-35508

Proxmox Virtual Environment PVE and Proxmox Mail Gateway PMG are vulnerable to SSRF when proxying HTTP requests between pvepmgproxy and pvepmgdaemon. An attacker with an unprivileged account can craft an HTTP request to achieve SSRF and file disclosure of any files on the server. Also, in Proxmox...

Design/Logic Flaw

The affected ThroughTek P2P products SDKs using versions before 3.1.5, any versions with nossl tag, device firmware not using AuthKey for IOTC conneciton, firmware using AVAPI module without enabling DTLS mechanism, and firmware using P2PTunnel or RDT module do not sufficiently protect data...

CVE-2021-32934

Summary of CVE-2021-32934 : Affects ThroughTek P2P SDKs (versions ≤ 3.1.5, any nossl-tag builds) and certain firmware configurations (no AuthKey for IOTC, AVAPI without DTLS, P2PTunnel/RDT) where data between the local device and ThroughTek servers is not properly protected. This results in clear...

Mandiant Discloses Critical Vulnerability Affecting Millions of IoT Devices

Today, Mandiant disclosed a critical risk vulnerability in coordination with the Cybersecurity and Infrastructure Security Agency “CISA” that affects millions of IoT devices that use the ThroughTek “Kalay” network. This vulnerability, discovered by researchers on Mandiant’s Red Team in late 2020,...

ThroughTek Kalay P2P SDK

1. EXECUTIVE SUMMARY CVSS v3 9.6 ATTENTION: Exploitable remotely/low attack complexity Vendor: ThroughTek Equipment: Kalay P2P SDK Vulnerability: Improper Access Control 2. RISK EVALUATION Successful exploitation of this vulnerability could permit remote code execution and unauthorized access to...

PT-2021-19981

Name of the Vulnerable Software and Affected Versions ThroughTek P2P products versions prior to 3.1.5 ThroughTek P2P products with nossl tag ThroughTek P2P products with device firmware not using AuthKey for IOTC connection ThroughTek P2P products with firmware using AVAPI module without enabling...

ThroughTek P2P SDK

1. EXECUTIVE SUMMARY CVSS v3 9.1 ATTENTION: Exploitable remotely/low attack complexity Vendor: ThroughTek Equipment: P2P SDK Vulnerability: Cleartext Transmission of Sensitive Information 2. RISK EVALUATION ThroughTek supplies multiple original equipment manufacturers of IP cameras with P2P...

Information Disclosure

ansible is vulnerable to information disclosure. The nolog feature is not enabled by default and confidential information such as the authkey and privkey are logged to the console...

MISP cross-site scripting vulnerability (CNVD-2021-08162)

MISP is an open source software solution for collecting, storing, distributing and sharing cybersecurity metrics and threats related to cybersecurity event analysis and malware analysis. A cross-site scripting vulnerability exists in...

CVE-2020-29572

app/View/Elements/genericElements/SingleViews/Fields/genericField.ctp in MISP 2.4.135 has XSS via the authkey comment field...

CVE-2020-29572

app/View/Elements/genericElements/SingleViews/Fields/genericField.ctp in MISP 2.4.135 has XSS via the authkey comment field...

Design/Logic Flaw

app/View/Elements/genericElements/SingleViews/Fields/genericField.ctp in MISP 2.4.135 has XSS via the authkey comment field...

CVE-2020-29572: Improper Neutralization of Input During Web Page Generation

app/View/Elements/genericElements/SingleViews/Fields/genericField.ctp in MISP 2.4.135 has XSS via the authkey comment field...

CVE-2020-29572

app/View/Elements/genericElements/SingleViews/Fields/genericField.ctp in MISP 2.4.135 has XSS via the authkey comment field...

CVE-2020-29572

CVE-2020-29572 affects MISP 2.4.135, with a cross-site scripting vulnerability in the file app/View/Elements/genericElements/SingleViews/Fields/genericField.ctp via the authkey comment field. The root cause is unsanitized input leading to XSS in the template rendering, enabling arbitrary script e...

MISP Cross-Site Script Vulnerabilities

MISP is an open source software solution for collecting, storing, distributing and sharing cybersecurity metrics and threats related to cybersecurity event analysis and malware analysis. A cross-site scripting vulnerability exists in...

PT-2020-17195

Name of the Vulnerable Software and Affected Versions MISP version 2.4.135 Description The issue is related to a XSS vulnerability via the authkey comment field in the genericField.ctp file. This allows for potential exploitation. Recommendations For MISP version 2.4.135, update to a version that...

PT-2019-12877

Name of the Vulnerable Software and Affected Versions Espressif ESP8266 NONOS SDK versions 2.2.0 through 3.1.0 Description The issue is related to the client 802.11 mac implementation, which does not correctly validate the RSN AuthKey suite list count in certain frames. This allows attackers with...