pycti vulnerabilities (PyPI)
22 vulnerabilities.
-
pyctiPyPI OpenCTI: Elasticsearch Painless Script Injection via GraphQL `script` filter operator allows authenticated user to exfiltrate data and cause DoS 6.5 Medium -
pyctiPyPI OpenCTI: Authorization Bypass via `synchronized-upsert` HTTP Header Injection 7.1 High -
pyctiPyPI OpenCTI has XSS in the rendering of email-message observable body data 5.3 Medium -
pyctiPyPI OpenCTI: Privilege escalation via graphQL API abusable by organization admins, due to incorrect ACL on userEdit relationAdd 7.2 High -
pyctiPyPI OpenCTI privilege escalation and unauthenticated access via default admin account 9.8 Critical -
pyctiPyPI OpenCTI affected by RCE via notifier template 9.1 Critical -
pyctiPyPI OpenCTI's GraphQL Mutations Allow Deletion of Unrelated Entities 6.5 Medium -
pyctiPyPI OpenCTI has a Semi-Blind SSRF via Unvalidated External URL in Data Ingestion Feature 7.7 High -
pyctiPyPI OpenCTI 3.3.1 - Cross Site Scripting 5.1 Medium -
pyctiPyPI OpenCTI 3.3.1 - Directory Traversal 7.1 High -
pyctiPyPI Open Redirect in OpenCTI's SAML Authentication Flow 5.4 Medium -
pyctiPyPI GraphQL IDOR allows authenticated user to delete workspace content of other users 7.1 High -
pyctiPyPI OpenCTI's GraphQL IDOR enables authenticated users to modify or delete notifications of other users 5.4 Medium -
pyctiPyPI OpenCTI vulnerable to Denial of Service through web hook 7.6 High -
pyctiPyPI OpenCTI has remote code execution and sensitive secrets exposed through web hook 9.1 Critical -
pyctiPyPI OpenCTI bypass of protected attribute update 6.3 Medium -
pyctiPyPI OpenCTI leaks support information due to inadequate access control 4.3 Medium -
pyctiPyPI OpenCTI's lack of Rate Limit lead to OTP brute forcing 8.1 High -
pyctiPyPI OpenCTI May Bypass Introspection Restriction 6.5 Medium -
pyctiPyPI OpenCTI Authenticated Privilege Escalation 8.3 High -
pyctiPyPI In OpenCTI through 5.2.4, a broken access control vulnerability has been identified in the... 7.5 High -
pyctiPyPI A stored Cross-site Scripting (XSS) vulnerability was identified in the Data Import functionality... 5.4 Medium