CVE-2025-66361 | Medium | 6.5 | 2025-11-28 | An issue was discovered in Logpoint before 7.7.0. Sensitive information is exposed in System Processes for an extended period during high CPU load. |
CVE-2025-66360 | High | 8.8 | 2025-11-28 | An issue was discovered in Logpoint before 7.7.0. An improperly configured access control policy exposes sensitive Logpoint internal service (Redis) informatio… |
CVE-2025-66359 | High | 8.5 | 2025-11-28 | An issue was discovered in Logpoint before 7.7.0. Insufficient input validation and a lack of output escaping in multiple components leads to a cross-site scri… |
CVE-2025-54317 | High | 8.4 | 2025-07-20 | An issue was discovered in Logpoint before 7.6.0. An attacker with operator privileges can exploit a path traversal vulnerability when creating a Layout Templa… |
CVE-2025-54316 | Medium | 4.9 | 2025-07-20 | An issue was discovered in Logpoint before 7.6.0. When creating reports, attackers can create custom Jinja templates that chained built-in filter functions to… |
CVE-2025-26789 | | | 2025-02-14 | An issue was discovered in Logpoint AgentX before 1.5.0. A vulnerability caused by limited access controls allowed li-admin users to access sensitive informati… |
CVE-2024-56087 | Medium | 5.9 | 2024-12-16 | An issue was discovered in Logpoint before 7.5.0. Authenticated users can inject payloads while querying Search Template Dashboard. These are executed, leading… |
CVE-2024-56086 | High | 7.1 | 2024-12-16 | An issue was discovered in Logpoint before 7.5.0. Authenticated users can inject payloads in Report Templates. These are executed when the backup process is in… |
CVE-2024-56085 | Medium | 5.9 | 2024-12-16 | An issue was discovered in Logpoint before 7.5.0. Authenticated users can inject payloads while creating Search Template Dashboard. These are executed, leading… |
CVE-2024-56084 | High | 7.1 | 2024-12-16 | An issue was discovered in Logpoint UniversalNormalizer before 5.7.0. Authenticated users can inject payloads while creating Universal Normalizer. These are ex… |
CVE-2024-48954 | Medium | 6.4 | 2024-11-07 | An issue was discovered in Logpoint before 7.5.0. Unvalidated input during the EventHub Collector setup by an authenticated user leads to Remote Code execution. |
CVE-2024-48953 | High | 7.5 | 2024-11-07 | An issue was discovered in Logpoint before 7.5.0. Endpoints for creating, editing, or deleting third-party authentication modules lacked proper authorization c… |
CVE-2024-48952 | Medium | 6.4 | 2024-11-07 | An issue was discovered in Logpoint before 7.5.0. SOAR uses a static JWT secret key to generate tokens that allow access to SOAR API endpoints without authenti… |
CVE-2024-48951 | High | 7.5 | 2024-11-07 | An issue was discovered in Logpoint before 7.5.0. Server-Side Request Forgery (SSRF) on SOAR can be used to leak Logpoint's API Token leading to authentication… |
CVE-2024-48950 | High | 7.5 | 2024-11-07 | An issue was discovered in Logpoint before 7.5.0. An endpoint used by Distributed Logpoint Setup was exposed, allowing unauthenticated attackers to bypass CSRF… |
CVE-2024-36383 | Medium | 5.3 | 2024-05-27 | An issue was discovered in Logpoint SAML Authentication before 6.0.3. An attacker can place a crafted filename in the state field of a SAML SSO-URL response, a… |
CVE-2024-33860 | Medium | 6.5 | 2024-05-07 | An issue was discovered in Logpoint before 7.4.0. It allows Local File Inclusion (LFI) when an arbitrary File Path is used within the File System Collector. Th… |
CVE-2024-33859 | Medium | 6.1 | 2024-05-07 | An issue was discovered in Logpoint before 7.4.0. HTML code sent through logs wasn't being escaped in the "Interesting Field" Web UI, leading to XSS. |
CVE-2024-33858 | Medium | 5.3 | 2024-05-07 | An issue was discovered in Logpoint before 7.4.0. A path injection vulnerability is seen while adding a CSV enrichment source. The source_name parameter could… |
CVE-2024-33857 | Critical | 9.6 | 2024-05-07 | An issue was discovered in Logpoint before 7.4.0. Due to a lack of input validation on URLs in threat intelligence, an attacker with low-level access to the sy… |
CVE-2024-33856 | Medium | 5.3 | 2024-05-07 | An issue was discovered in Logpoint before 7.4.0. An attacker can enumerate a valid list of usernames by observing the response time at the Forgot Password end… |
CVE-2024-30176 | Medium | 5.3 | 2024-05-01 | In Logpoint before 7.4.0, an attacker can enumerate a valid list of usernames by using publicly exposed URLs of shared widgets. |
CVE-2022-48685 | High | 7.7 | 2024-04-27 | An issue was discovered in Logpoint 7.1 before 7.1.2. The daily executed cron file clean_secbi_old_logs is writable by all users and is executed as root, leadi… |
CVE-2022-48684 | High | 8.4 | 2024-04-27 | An issue was discovered in Logpoint before 7.1.1. Template injection was seen in the search template. The search template uses jinja templating for generating… |
CVE-2024-29865 | Medium | 5.4 | 2024-03-22 | Logpoint before 7.1.0 allows Self-XSS on the LDAP authentication page via the username to the LDAP login form. |
CVE-2023-49950 | Medium | 5.4 | 2024-02-03 | The Jinja templating in Logpoint SIEM 6.10.0 through 7.x before 7.3.0 does not correctly sanitize log data being displayed when using a custom Jinja template i… |