CVE-2025-5410 Mist Community Edition middleware.py session_start_response cross-site request forgery

A vulnerability was found in Mist Community Edition up to 4.7.1. It has been declared as problematic. This vulnerability affects the function sessionstartresponse of the file src/mist/api/auth/middleware.py. The manipulation leads to cross-site request forgery. The attack can be initiated remotel...

CVE-2025-5409

A vulnerability was found in Mist Community Edition up to 4.7.1. It has been classified as critical. This affects the function createtoken of the file src/mist/api/auth/views.py of the component API Token Handler. The manipulation leads to improper access controls. It is possible to initiate the...

CVE-2025-5409 Mist Community Edition API Token views.py create_token access control

A vulnerability was found in Mist Community Edition up to 4.7.1. It has been classified as critical. This affects the function createtoken of the file src/mist/api/auth/views.py of the component API Token Handler. The manipulation leads to improper access controls. It is possible to initiate the...

CVE-2025-5409 Mist Community Edition API Token views.py create_token access control

A vulnerability was found in Mist Community Edition up to 4.7.1. It has been classified as critical. This affects the function createtoken of the file src/mist/api/auth/views.py of the component API Token Handler. The manipulation leads to improper access controls. It is possible to initiate the...

CVE-2025-5409 Mist Community Edition API Token views.py create_token access control

A vulnerability was found in Mist Community Edition up to 4.7.1. It has been classified as critical. This affects the function createtoken of the file src/mist/api/auth/views.py of the component API Token Handler. The manipulation leads to improper access controls. It is possible to initiate the...

CVE-2025-5409

Mist Community Edition up to 4.7.1 contains a vulnerability in the API Token Handler’s create_token function (src/mist/api/auth/views.py) that enables improper access controls. The issue allows remote initiation of an attack and has publicly disclosed exploits. Upgrading to version 4.7.2 addresse...

Mist 安全漏洞

Mist is an open source multi-cloud management platform from Mist, Inc. in the United States. A security vulnerability exists in Mist 4.7.1 and earlier versions, which originates from a cross-site request forgery in the function sessionstartresponse in the file src/mist/api/auth/middleware.py...

PT-2025-23436 · Unknown · Mist Community Edition

Name of the Vulnerable Software and Affected Versions: Mist Community Edition versions up to 4.7.1 Description: A critical issue has been found, affecting the create token function of the API Token Handler component. This leads to improper access controls, allowing remote attacks. The issue has...

Mist 安全漏洞

Mist is an open source multi-cloud management platform from Mist, Inc. in the United States. Mist has a security vulnerability that originates from improper access control in the function createtoken in the file src/mist/api/auth/views.py...

PT-2025-23439 · Unknown · Mist Community Edition

Name of the Vulnerable Software and Affected Versions: Mist Community Edition versions up to 4.7.1 Description: A problematic issue has been found in the Authentication Endpoint component, specifically in the Login function of the file src/mist/api/views.py. The manipulation of the return to...

PT-2025-23438 · Mist · Mist Community Edition

Name of the Vulnerable Software and Affected Versions: Mist Community Edition versions up to 4.7.1 Description: A problem was found in the function tag resources of the file src/mist/api/tag/views.py. The manipulation of the argument tag leads to cross-site scripting. The attack may be initiated...

Mist 代码注入漏洞

Mist is an open source multi-cloud management platform from Mist, Inc. in the United States. A code injection vulnerability exists in Mist 4.7.1 and earlier versions, which originates from a cross-site scripting attack on the parameter tag in the file src/mist/api/tag/views.py...

PT-2025-23437 · Unknown · Mist Community Edition

Name of the Vulnerable Software and Affected Versions: Mist Community Edition versions up to 4.7.1 Description: A vulnerability was found in the function session start response of the file src/mist/api/auth/middleware.py. This issue leads to cross-site request forgery and can be initiated remotel...

CVE-2022-39245

Mist is the command-line interface for the makedeb Package Repository. Prior to version 0.9.5, a user-provided sudo binary via the PATH variable can allow a local user to run arbitrary commands on the user's system with root permissions. Versions 0.9.5 and later contain a patch. No known...

Juniper Networks Releases Critical Security Update for Routers

Juniper Networks has released out-of-band security updates to address a critical security flaw that could lead to an authentication bypass in some of its routers. The vulnerability, tracked as CVE-2024-2973, carries a CVSS score of 10.0, indicating maximum severity. "An Authentication Bypass Usin...

CVE-2022-39245

Mist is the command-line interface for the makedeb Package Repository. Prior to version 0.9.5, a user-provided sudo binary via the PATH variable can allow a local user to run arbitrary commands on the user's system with root permissions. Versions 0.9.5 and later contain a patch. No known...

Design/Logic Flaw

Mist is the command-line interface for the makedeb Package Repository. Prior to version 0.9.5, a user-provided sudo binary via the PATH variable can allow a local user to run arbitrary commands on the user's system with root permissions. Versions 0.9.5 and later contain a patch. No known...

CVE-2022-39245 Mist vulnerable to user providing a Sudo binary for authentication checks

Mist is the command-line interface for the makedeb Package Repository. Prior to version 0.9.5, a user-provided sudo binary via the PATH variable can allow a local user to run arbitrary commands on the user's system with root permissions. Versions 0.9.5 and later contain a patch. No known...

CVE-2022-39245

CVE-2022-39245 affects Mist, the CLI for the makedeb package repository. Before version 0.9.5, a local user could inject a user-provided sudo binary via PATH, causing arbitrary commands to run with root privileges. The issue is fixed in versions 0.9.5 and later (patch applied); no public workarou...

CVE-2022-39245 Mist vulnerable to user providing a Sudo binary for authentication checks

Mist is the command-line interface for the makedeb Package Repository. Prior to version 0.9.5, a user-provided sudo binary via the PATH variable can allow a local user to run arbitrary commands on the user's system with root permissions. Versions 0.9.5 and later contain a patch. No known...