Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

4 records

Vendor: AlgoSec Component: Fireflow Clear all filters
TI-2023-25102 CVE-2023-46596 · GHSA-qxwj-fm5r-rhx8

Improper input validation in FireFlow’s VisualFlow workflow editor

Priority LOW 27

Improper input validation in Algosec FireFlow VisualFlow workflow editor via Name, Description and Configuration File field in version A32.20, A32.50, A32.60 permits an attacker to initiate an XSS attack by injecting mal…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00282 Published 2024-02-15 No fix listed CWE-79
TI-2023-25101 CVE-2023-46595 · GHSA-9jpv-w64v-mgr2

Cross-site scripting in Algosec FireFlow

Priority LOW 26

Net-NTLM leak via HTML injection in FireFlow VisualFlow workflow editor allows an attacker to obtain victim’s domain credentials and Net-NTLM hash which can lead to relay domain attacks.

CVSS 3.1MEDIUM 5.9 Adjacent network High privileges User interaction EPSS 0.00348 Published 2023-11-02 No fix listed CWE-79
TI-2022-17024 CVE-2022-36783 · GHSA-jpmh-qrhq-g32f

Cross-site scripting in AlgoSec FireFlow A32.0

Priority LOW 29

AlgoSec – FireFlow Reflected Cross-Site-Scripting (RXSS) A malicious user injects JavaScript code into a parameter called IntersectudRule on the search/result.html page.

CVSS 3.1MEDIUM 6.5 Adjacent network Low privileges No interaction EPSS 0.00434 Published 2022-10-25 No fix listed CWE-79