CVE-2025-22621 Privilege escalation for users who hold the “splunk_app_soar“ role in the Splunk App for SOAR

In versions 1.0.67 and lower of the Splunk App for SOAR, the Splunk documentation for that app recommended adding the adminallobjects capability to the splunkappsoar role. This addition could lead to improper access control for a low-privileged user that does not hold the "admin" Splunk roles...

CVE-2025-22621

CVE-2025-22621 affects Splunk App for SOAR, versions 1.0.67 and lower. The root cause is a documentation-guided addition of the admin_all_objects capability to the splunk_app_soar role, potentially granting high-privilege access to a low-privileged user and compromising access control. The CVE is...

PT-2025-4607 · Splunk · Splunk App For Soar

Name of the Vulnerable Software and Affected Versions: Splunk App for SOAR versions 1.0.67 and lower Description: The issue is related to improper access control. In the affected versions of the Splunk App for SOAR, the documentation recommended adding the admin all objects capability to the splu...

IBM Security SOAR Authorization Issues Vulnerability

IBM Security SOAR is a product from International Business Machines IBM, formerly known as Resilient. designed to help your security team confidently respond to cyber threats, automate through intelligence, and collaborate through consistency. IBM Security SOAR has an authorization issue...

CVE-2024-45670

IBM Security SOAR 51.0.1.0 and earlier contains a mechanism for users to recover or change their passwords without knowing the original password, but the user account must be compromised prior to the weak recovery mechanism...

CVE-2024-45670 IBM Security SOAR weak password recovery mechanism

IBM Security SOAR 51.0.1.0 and earlier contains a mechanism for users to recover or change their passwords without knowing the original password, but the user account must be compromised prior to the weak recovery mechanism...

CVE-2024-45670 IBM Security SOAR weak password recovery mechanism

IBM Security SOAR 51.0.1.0 and earlier contains a mechanism for users to recover or change their passwords without knowing the original password, but the user account must be compromised prior to the weak recovery mechanism...

CVE-2024-45670

CVE-2024-45670 affects IBM Security SOAR 51.0.1.0 and earlier. A password-recovery mechanism allows resetting/changing passwords without knowing the original, but requires the attacker’s prior compromise of the user account. The vulnerability could enable unauthorized access by exploiting this we...

PT-2024-31722 · Ibm · Ibm Security Soar

Name of the Vulnerable Software and Affected Versions: IBM Security SOAR versions 51.0.1.0 and earlier Description: The issue concerns a weak password recovery mechanism that allows users to recover or change their passwords without knowing the original password. However, the user account must be...

CVE-2024-48951

An issue was discovered in Logpoint before 7.5.0. Server-Side Request Forgery SSRF on SOAR can be used to leak Logpoint's API Token leading to authentication bypass...

CVE-2024-48952

An issue was discovered in Logpoint before 7.5.0. SOAR uses a static JWT secret key to generate tokens that allow access to SOAR API endpoints without authentication. This static key vulnerability enables attackers to create custom JWT secret keys for unauthorized access to these endpoints...

CVE-2024-48952

An issue was discovered in Logpoint before 7.5.0. SOAR uses a static JWT secret key to generate tokens that allow access to SOAR API endpoints without authentication. This static key vulnerability enables attackers to create custom JWT secret keys for unauthorized access to these endpoints...

PT-2024-33293 · Logpoint · Logpoint

Name of the Vulnerable Software and Affected Versions: Logpoint versions prior to 7.5.0 Description: An issue in Logpoint allows Server-Side Request Forgery SSRF on SOAR, which can be used to leak Logpoint's API Token, leading to authentication bypass. Recommendations: For versions prior to 7.5.0...

Logpoint 安全漏洞

Logpoint is a network security application from the Danish company Logpoint. A security vulnerability exists in Logpoint versions prior to 7.5.0, which stems from a server-side request forgery SSRF on SOAR that can be used to disclose Logpoint's API tokens, leading to authentication bypass...

CVE-2024-48952

An issue was discovered in Logpoint before 7.5.0. SOAR uses a static JWT secret key to generate tokens that allow access to SOAR API endpoints without authentication. This static key vulnerability enables attackers to create custom JWT secret keys for unauthorized access to these endpoints...

CVE-2024-48951

CVE-2024-48951 concerns Logpoint prior to 7.5.0, where a Server-Side Request Forgery (SSRF) on the SOAR component can be abused to disclose the system’s API token, resulting in authentication bypass. Affected product: Logpoint SOAR within the Logpoint platform (versions

CVE-2024-48952

CVE-2024-48952 affects Logpoint prior to 7.5.0. The issue arises from SOAR using a static JWT secret key to generate tokens, which can allow attackers to access SOAR API endpoints without authentication. This enables creation of custom JWT secret keys for unauthorized access. The Red Hat and PT S...

Security Bulletin: IBM SOAR QRadar Plugin App is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM SOAR QRadar Plugin App has addressed the applicable CVEs with an update. Vulnerability Details CVEID:CVE-2024-6345 DESCRIPTION: pypa/setuptools could allow a...

Security Bulletin: IBM Security SOAR is using components with multiple known vulnerabilities

Summary IBM Security SOAR uses an older version of Java that may be identified and exploited. An update has been released which addresses these issues. It is recommended that customers upgrade to Version 51.0.3.1 or later of IBM Security SOAR. AppHost users should upgrade to version 1.15.3.1 or...

Security Bulletin: IBM Security SOAR password recovery is vulnerable (CVE-2024-45670)

Summary The password reset function in IBM Security QRadar SOAR had vulnerabilities that could allow hackers to exploit and take over user privileges. An update has been released which addresses these issues. It is recommended upgrading to Version 51.0.2.0 or later of IBM Security SOAR...