Alexandre Dulaunoy

**Name of the Vulnerable Software and Affected Versions** Vulnerability-Lookup (affected versions not specified) **Description** A server-side request forgery (SSRF) issue exists in the remote-instance synchronization functionality. The system validated remote instance addresses only for basic URL syntax before storage, while the synchronization worker later processed these addresses using `requests.get()` with automatic redirect handling and no network-boundary restrictions. An authenticated administrator with `admin:access` permission could configure a remote instance pointing to internal, loopback, link-local, or cloud metadata HTTP(S) services. Additionally, a publicly accessible URL could be used to redirect to an internal destination since redirects were followed without revalidation. This allows a privileged attacker to probe or interact with services accessible from the server's network context, such as private network services or cloud instance metadata endpoints. **Recommendations** Apply the available patch to implement a shared outbound URL policy that restricts remote instances to HTTP(S), rejects non-public IP addresses, resolves hostnames at request time, and validates each redirect destination. As a temporary mitigation, restrict the `admin:access` permission to trusted users only.

**Name of the Vulnerable Software and Affected Versions** Vulnerability-Lookup (affected versions not specified) **Description** A stored cross-site scripting (XSS) issue exists in the `render tag badges` Jinja filter used to display reference tags for vulnerability records. The application directly interpolates values from `containers.cna.references[].tags[]` into HTML badge elements and wraps the result in `markupsafe.Markup`, which bypasses Jinja's automatic HTML escaping. An authenticated user with `vulnerability:create` or `vulnerability:modify` permissions can submit crafted reference tags via the CNA API containing arbitrary HTML or JavaScript. This malicious content is stored and subsequently executed in the browser of any user visiting the public `/cve/<id>` or `/vuln/<id>` endpoints. This could allow an attacker to perform actions on behalf of the victim, access session information, or modify page content, potentially affecting unauthenticated users. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Vulnerability-Lookup (affected versions not specified) **Description** An authorization bypass exists due to inconsistent enforcement between the REST API and the Server-Sent Events (SSE) streaming interface. The Pub/Sub interface uses a `token required` decorator that authenticates requests by matching the `X-API-KEY` header against a user API key but fails to verify if the account is active or confirmed. Since API keys are issued during self-registration before confirmation is complete, unauthorized users can access the `/pubsub/subscribe/<topic>` endpoint. This allows access to stream events, such as unmoderated comments, that are otherwise restricted via the REST API. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Vulnerability-Lookup (affected versions not specified) **Description** An authentication weakness exists in the account activation and password-recovery mechanism. The system uses stateless signed tokens containing only the user's login. While the signature and age are validated, the application fails to track if a token has already been used. Consequently, a captured activation or recovery link remains valid for the duration of the `TOKEN VALIDITY PERIOD`, even after a password change. This allows an attacker with a valid token to replay it multiple times to reset the password and take control of the account. Furthermore, tokens are not bound to a specific purpose, enabling the same token to be used for both activation and recovery workflows. Exploitation requires obtaining a valid link but does not require the victim's current password or an active session. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** misp-modules (affected versions not specified) **Description** A Server-Side Request Forgery (SSRF) protection bypass exists in the `html to markdown` expansion module. The module fails to normalize IPv4-mapped IPv6 addresses before comparing them against blocked ranges for loopback, private, and link-local IP addresses. An authenticated attacker can provide an IPv4-mapped IPv6 address or a hostname that resolves to one to bypass these filters. This allows the server to connect to internal web services, administrative interfaces, or cloud instance metadata, with the retrieved content returned to the attacker as converted Markdown. **Recommendations** Upgrade to the patched release that normalizes IPv4-mapped IPv6 addresses to their underlying IPv4 representation and rejects URLs without a valid hostname.

**Name of the Vulnerable Software and Affected Versions** cve-search (affected versions not specified) **Description** An unauthenticated improper input validation issue exists in the 'POST /fetch cve data' endpoint. A remote attacker can manipulate request parameters that control the MongoDB collection, projected fields, and regular-expression filters to read arbitrary application MongoDB collections. This flaw can expose administrative usernames and password hashes from the `mgmt users` collection, which may lead to offline password cracking and the compromise of administrative accounts. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MISP BSimVis versions prior to 0.2.1 **Description** A stored cross-site scripting issue exists in the tag rendering code. Several client-side rendering paths interpolate tag names, collection names, entity identifiers, cluster names, and tag metadata directly into HTML, HTML attributes, inline JavaScript event handlers, and CSS style values without context-appropriate escaping. An attacker capable of creating or influencing stored tag or metadata values can inject a crafted payload. When a victim views affected BSimVis pages, the payload executes arbitrary JavaScript in their session, potentially allowing the attacker to perform actions as the victim, read available data, or alter application content. **Recommendations** Update to version 0.2.1 or later.

**Name of the Vulnerable Software and Affected Versions** FlowIntel versions prior to 3.3.1 **Description** An issue exists in the external reference URL probe functionality within `app/case/task.py`. An attacker can submit an external reference URL to force the application server to issue an HTTP HEAD request to a specified destination. Due to insufficient validation of the URL scheme and resolved destination address, this allows requests to loopback, link-local, private, reserved, or other restricted network resources. This may enable interaction with internal services or cloud metadata endpoints from the server's network context. This is a server-side request forgery (SSRF), which occurs when a server is tricked into making requests to an unintended location. **Recommendations** Update to a version later than 3.3.0.