Priority MEDIUM 60
MITRE CALDERA 4.1.0 allows stored XSS via app.contact.gist (aka the gist contact configuration field), leading to execution of arbitrary commands on agents.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00689 · Published 2022-10-17 · No fix listed CWE-79
Priority LOW 28
MITRE CALDERA before 4.1.0 allows XSS in the Operations tab and/or Debrief plugin via a crafted operation name, a different vulnerability than CVE-2022-40605.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00524 · Published 2022-10-17 · No fix listed CWE-79
Priority LOW 28
MITRE CALDERA before 4.1.0 allows XSS in the Operations tab and/or Debrief plugin via a crafted operation name, a different vulnerability than CVE-2022-40606.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00524 · Published 2022-10-17 · No fix listed CWE-79
Priority MEDIUM 42
An issue was discovered in CALDERA 2.8.1.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.02021 · Published 2022-01-12 · No fix listed CWE-77
Priority LOW 29
An issue was discovered in CALDERA 2.8.1.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01087 · Published 2022-01-12 · No fix listed CWE-79
Priority MEDIUM 42
An issue was discovered in CALDERA 2.9.0.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.02182 · Published 2022-01-12 · No fix listed CWE-611
Priority MEDIUM 56
An issue was discovered in CALDERA 2.8.1.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.19572 · Published 2022-01-12 · No fix listed CWE-74
Priority LOW 38
An issue was discovered in CALDERA 2.8.1.
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.01229 · Published 2022-01-12 · No fix listed CWE-269
Priority MEDIUM 44
A command injection vulnerability in the sandcat plugin of Caldera 2.3.1 and earlier allows authenticated attackers to execute any command or service.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.03013 · Published 2021-07-12 · No fix listed CWE-78
Priority LOW 25
CALDERA 2.7.0 allows XSS via the Operation Name box.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00626 · Published 2020-06-19 · No fix listed CWE-79
Priority LOW 27
auth_svc in Caldera before 2.6.5 allows authentication bypass (for REST API requests) via a forged "localhost" string in the HTTP Host header.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.0144 · Published 2020-03-22 · No fix listed CWE-290
THREATIST.IORead the docs