CVE-2024-33856

An issue was discovered in Logpoint before 7.4.0. An attacker can enumerate a valid list of usernames by observing the response time at the Forgot Password endpoint...

PT-2024-25513 · Logpoint · Logpoint

Name of the Vulnerable Software and Affected Versions: Logpoint versions prior to 7.4.0 Description: A path injection issue is present when adding a CSV enrichment source. The source name parameter can be modified to an absolute path, allowing the CSV file to be written to that path inside the /t...

PT-2024-25511 · Logpoint · Logpoint

Name of the Vulnerable Software and Affected Versions: Logpoint versions prior to 7.4.0 Description: An issue was discovered in Logpoint where an attacker can enumerate a valid list of usernames by observing the response time at the "Forgot Password" endpoint. Recommendations: For versions prior ...

Logpoint security vulnerabilities

Logpoint is a network security application from the Danish company Logpoint. A security vulnerability exists in Logpoint versions prior to 7.4.0, which stems from a lack of input validation of URLs in threat intelligence, and allows an attacker with low-level access to the system to trigger...

CVE-2024-33859

An issue was discovered in Logpoint before 7.4.0. HTML code sent through logs wasn't being escaped in the "Interesting Field" Web UI, leading to XSS...

Logpoint cross-site scripting vulnerabilities

Logpoint is a network security application from the Danish company Logpoint. A cross-site scripting vulnerability exists in Logpoint versions prior to 7.4.0, which stems from HTML code sent via logs that is not escaped in Interesting Field's Web UI, resulting in cross-site scripting...

CVE-2024-33856

An issue was discovered in Logpoint before 7.4.0. An attacker can enumerate a valid list of usernames by observing the response time at the Forgot Password endpoint...

PT-2024-25514 · Logpoint · Logpoint

Name of the Vulnerable Software and Affected Versions: Logpoint versions prior to 7.4.0 Description: An issue was discovered where HTML code sent through logs wasn't being escaped in the "Interesting Field" Web UI, leading to XSS. Recommendations: For versions prior to 7.4.0, update to version...

CVE-2024-33857

Logpoint versions prior to 7.4.0 are vulnerable to Server Side Request Forgery (SSRF) due to a lack of input validation on URLs within the threat intelligence feature. An attacker with low-level access to the system can exploit this flaw to trigger unauthorized server-side requests. To remediate ...

CVE-2024-33856: Observable Response Discrepancy

An issue was discovered in Logpoint before 7.4.0. An attacker can enumerate a valid list of usernames by observing the response time at the Forgot Password endpoint...

CVE-2024-33859: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Logpoint before 7.4.0. HTML code sent through logs wasn't being escaped in the "Interesting Field" Web UI, leading to XSS...

CVE-2024-33858: XML Injection (aka Blind XPath Injection)

An issue was discovered in Logpoint before 7.4.0. A path injection vulnerability is seen while adding a CSV enrichment source. The sourcename parameter could be changed to an absolute path; this will write the CSV file to that path inside the /tmp directory...

CVE-2024-33857: Server-Side Request Forgery (SSRF)

An issue was discovered in Logpoint before 7.4.0. Due to a lack of input validation on URLs in threat intelligence, an attacker with low-level access to the system can trigger Server Side Request Forgery...

CVE-2024-33860: External Control of File Name or Path

An issue was discovered in Logpoint before 7.4.0. It allows Local File Inclusion LFI when an arbitrary File Path is used within the File System Collector. The content of the file specified can be viewed in the incoming logs...

CVE-2024-33857

An issue was discovered in Logpoint before 7.4.0. Due to a lack of input validation on URLs in threat intelligence, an attacker with low-level access to the system can trigger Server Side Request Forgery...

PT-2024-25512 · Logpoint · Logpoint

Name of the Vulnerable Software and Affected Versions: Logpoint versions prior to 7.4.0 Description: An issue was discovered due to a lack of input validation on URLs in threat intelligence. This allows an attacker with low-level access to the system to trigger Server Side Request Forgery...

CVE-2024-33858

Logpoint versions prior to 7.4.0 are vulnerable to a path injection vulnerability when adding a CSV enrichment source. The root cause is that the source_name parameter can be manipulated to accept an absolute path, allowing an attacker to write the CSV file to a specific location within the /tmp ...

Logpoint security vulnerabilities

Logpoint is a network security application from the Danish company Logpoint. A security vulnerability exists in Logpoint versions prior to 7.4.0 that originates from a vulnerability that allows an attacker to enumerate a list of valid usernames by observing the response time of the Forgot Passwor...

CVE-2024-33859

The network security application Logpoint is affected by a Cross-Site Scripting (XSS) vulnerability in versions prior to 7.4.0 . The root cause is the failure to escape HTML code sent through logs within the "Interesting Field" Web UI. This could allow an attacker to execute malicious scripts in ...

CVE-2024-33858

An issue was discovered in Logpoint before 7.4.0. A path injection vulnerability is seen while adding a CSV enrichment source. The sourcename parameter could be changed to an absolute path; this will write the CSV file to that path inside the /tmp directory...