Alexandre Dulaunoy

MISP: Site-Admin Can Repoint Redis Workers to Attacker-Controlled Server via UI/API Configuration Change

MISP sachertortephp - CakeResponse::download() HTTP Response Splitting via Unsanitized Filename Enables Stored XSS

Vulnerability-Lookup - Race Condition in Account Recovery Token Consumption Allows Password Takeover

Stored Server-Side Request Forgery in Remote-Instance Synchronization Allows Access to Internal Services in vulnerability-lookup

Reusable Account Activation and Recovery Tokens Allow Repeated Account Takeover in vulnerability-lookup

Authorization Bypass in SSE Pub/Sub Allows Unconfirmed Accounts to Access Stream Events in vulnerability-lookup

Stored Cross-Site Scripting (XSS) via Unescaped CNA Reference Tags in vulnerability-lookup

Server-Side Request Forgery protection bypass in misp-modules html_to_markdown via IPv4-mapped IPv6 addresses

Unauthenticated arbitrary MongoDB collection read in cve-search

FlowIntel external reference URL probe allows server-side request forgery