Jeroen Pinoy

Stored Cross-Site Scripting in URL Observables via Lookyloo Submission Handler in Pandora

Stored Cross-Site Scripting via MIME-Type Confusion in PDF Downloads of Pandora

Path Traversal in TAR Archive Extraction Allows Arbitrary File Write in Pandora

Unbounded DAA Decompression in Pandora Allows Denial of Service via Decompression Bomb

cti-transmute Conversion Table Allows XSS via Unescaped Cell Content During Search Highlighting

cti-transmute CSRF Allows Unauthorized Follow and Notification State Changes

cti-transmute Evaluation Report Exports Expose Private Comments and Author Information

cti-transmute Missing Authorization Allows Reactions to Private Comments

cti-transmute Sunburst and Treemap Tooltips Allow Cross-Site Scripting via Crafted Conversion Data

cti-transmute Remote MISP Event Browser Allows Cross-Site Scripting via Malicious Event Metadata