Mehmet D. Ince

An issue was discovered in Logpoint where authenticated users can inject payloads in Report Templates. These payloads are executed when the backup process is initiated, leading to Remote Code Execution.

The issue allows authenticated users to inject payloads while querying the Search Template Dashboard. These payloads are executed, leading to Server-Side Template Injection.

An issue was discovered in Logpoint UniversalNormalizer where authenticated users can inject payloads while creating Universal Normalizer, leading to Remote Code Execution.

A problem was discovered in Logpoint where authenticated users can inject payloads while creating the Search Template Dashboard. These payloads are executed, leading to Server-Side Template Injection.

An issue was discovered in Logpoint where unvalidated input during the EventHub Collector setup by an authenticated user leads to Remote Code execution. The issue is related to improper authentication in the EventHub Collector Setup.

An issue was discovered in Logpoint where endpoints for creating, editing, or deleting third-party authentication modules lacked proper authorization checks. This allowed unauthenticated users to register their own authentication plugins, resulting in unauthorized access.

An issue was discovered in Logpoint where an endpoint used by Distributed Logpoint Setup was exposed. This exposure allows unauthenticated attackers to bypass CSRF protections and authentication.

An issue in Logpoint allows Server-Side Request Forgery (SSRF) on SOAR, which can be used to leak Logpoint's API Token, leading to authentication bypass.

An issue was discovered in Logpoint where SOAR uses a static JWT secret key to generate tokens, allowing access to SOAR API endpoints without authentication. This enables attackers to create custom JWT secret keys for unauthorized access to these endpoints.

A heap-based buffer overflow issue exists when processing project files. Opening a specially crafted project file could allow an attacker to execute code under the privileges of the application.

Multiple buffer overflow vulnerabilities exist when the application processes project files. Opening a specially crafted project file could allow an attacker to exploit and execute code under the privileges of the application.