CVE-2024-33859: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Logpoint before 7.4.0. HTML code sent through logs wasn't being escaped in the "Interesting Field" Web UI, leading to XSS...

PT-2024-25514 · Logpoint · Logpoint

Name of the Vulnerable Software and Affected Versions: Logpoint versions prior to 7.4.0 Description: An issue was discovered where HTML code sent through logs wasn't being escaped in the "Interesting Field" Web UI, leading to XSS. Recommendations: For versions prior to 7.4.0, update to version...

CVE-2024-33858

An issue was discovered in Logpoint before 7.4.0. A path injection vulnerability is seen while adding a CSV enrichment source. The sourcename parameter could be changed to an absolute path; this will write the CSV file to that path inside the /tmp directory...

Logpoint 安全漏洞

Logpoint is a network security application from the Danish company Logpoint. A security vulnerability exists in Logpoint versions prior to 7.4.0, which stems from a lack of input validation of URLs in threat intelligence, and allows an attacker with low-level access to the system to trigger...

PT-2024-25511 · Logpoint · Logpoint

Name of the Vulnerable Software and Affected Versions: Logpoint versions prior to 7.4.0 Description: An issue was discovered in Logpoint where an attacker can enumerate a valid list of usernames by observing the response time at the "Forgot Password" endpoint. Recommendations: For versions prior ...

CVE-2024-33859

The network security application Logpoint is affected by a Cross-Site Scripting (XSS) vulnerability in versions prior to 7.4.0 . The root cause is the failure to escape HTML code sent through logs within the "Interesting Field" Web UI. This could allow an attacker to execute malicious scripts in ...

PT-2024-25512 · Logpoint · Logpoint

Name of the Vulnerable Software and Affected Versions: Logpoint versions prior to 7.4.0 Description: An issue was discovered due to a lack of input validation on URLs in threat intelligence. This allows an attacker with low-level access to the system to trigger Server Side Request Forgery...

PT-2024-25515 · Logpoint · Logpoint

Name of the Vulnerable Software and Affected Versions: Logpoint versions prior to 7.4.0 Description: An issue was discovered that allows Local File Inclusion LFI when an arbitrary File Path is used within the File System Collector. The content of the file specified can be viewed in the incoming...

CVE-2024-33860

An issue was discovered in Logpoint before 7.4.0. It allows Local File Inclusion LFI when an arbitrary File Path is used within the File System Collector. The content of the file specified can be viewed in the incoming logs...

CVE-2024-33859

An issue was discovered in Logpoint before 7.4.0. HTML code sent through logs wasn't being escaped in the "Interesting Field" Web UI, leading to XSS...

PT-2024-25513 · Logpoint · Logpoint

Name of the Vulnerable Software and Affected Versions: Logpoint versions prior to 7.4.0 Description: A path injection issue is present when adding a CSV enrichment source. The source name parameter can be modified to an absolute path, allowing the CSV file to be written to that path inside the /t...

Logpoint 安全漏洞

Logpoint is a network security application from the Danish company Logpoint. A security vulnerability exists in Logpoint versions prior to 7.4.0, which stems from the fact that the sourcename parameter can be changed to an absolute path, which will write a CSV file to the tmp directory...

CVE-2024-33858: XML Injection (aka Blind XPath Injection)

An issue was discovered in Logpoint before 7.4.0. A path injection vulnerability is seen while adding a CSV enrichment source. The sourcename parameter could be changed to an absolute path; this will write the CSV file to that path inside the /tmp directory...

CVE-2024-33857

Logpoint versions prior to 7.4.0 are vulnerable to Server Side Request Forgery (SSRF) due to a lack of input validation on URLs within the threat intelligence feature. An attacker with low-level access to the system can exploit this flaw to trigger unauthorized server-side requests. To remediate ...

Logpoint 跨站脚本漏洞

Logpoint is a network security application from the Danish company Logpoint. A cross-site scripting vulnerability exists in Logpoint versions prior to 7.4.0, which stems from HTML code sent via logs that is not escaped in Interesting Field's Web UI, resulting in cross-site scripting...

CVE-2024-33856

An issue was discovered in Logpoint before 7.4.0. An attacker can enumerate a valid list of usernames by observing the response time at the Forgot Password endpoint...

CVE-2024-33860: External Control of File Name or Path

An issue was discovered in Logpoint before 7.4.0. It allows Local File Inclusion LFI when an arbitrary File Path is used within the File System Collector. The content of the file specified can be viewed in the incoming logs...

CVE-2024-33857: Server-Side Request Forgery (SSRF)

An issue was discovered in Logpoint before 7.4.0. Due to a lack of input validation on URLs in threat intelligence, an attacker with low-level access to the system can trigger Server Side Request Forgery...

CVE-2024-33858

Logpoint versions prior to 7.4.0 are vulnerable to a path injection vulnerability when adding a CSV enrichment source. The root cause is that the source_name parameter can be manipulated to accept an absolute path, allowing an attacker to write the CSV file to a specific location within the /tmp ...

CVE-2024-33856

An issue was discovered in Logpoint versions prior to 7.4.0 that allows an attacker to enumerate a valid list of usernames. This vulnerability originates from an Observable Response Discrepancy (CWE-204) at the Forgot Password endpoint, where an attacker can identify valid users by observing vari...