Mkoppmann

**Name of the Vulnerable Software and Affected Versions** Iris versions prior to 2.4.28 **Description** Iris is a web collaborative platform designed for incident responders to share technical details during investigations. The software contains an open redirect flaw that allows an attacker to redirect users to a malicious website under the attacker's control. **Recommendations** Update to version 2.4.28.

**Name of the Vulnerable Software and Affected Versions** IRIS versions prior to 2.4.28 **Description** IRIS is a web collaborative platform for incident responders to share technical details during investigations. The application fails to properly validate uploaded files, which allows the platform to be misused for hosting phishing pages. This flaw also enables Cross-Site Scripting (XSS), a technique where malicious scripts are injected into trusted websites. **Recommendations** Update to version 2.4.28.

**Name of the Vulnerable Software and Affected Versions** IRIS versions prior to 2.4.28 **Description** IRIS is a web collaborative platform designed for incident responders to share technical details during investigations. The platform returns sensitive data to the user that is not required for client operations. **Recommendations** Update to version 2.4.28.

**Name of the Vulnerable Software and Affected Versions** IRIS versions prior to 2.4.28 **Description** IRIS is a web collaborative platform designed for incident responders to share technical details during investigations. The platform allows users to alter database values through manipulated API requests. **Recommendations** Update to version 2.4.28.

**Name of the Vulnerable Software and Affected Versions** IRIS versions prior to 2.4.28 **Description** IRIS is a web collaborative platform designed for incident responders to share technical details during investigations. The software is susceptible to a cross-site request forgery attack, which occurs when an attacker tricks a user into performing actions they did not intend to do, because the application uses the `GET` HTTP method to change state on the server. **Recommendations** Update to version 2.4.28.

**Name of the Vulnerable Software and Affected Versions** IRIS versions prior to 2.4.28 **Description** Users can create alerts for customers not assigned to them, allowing for the false attribution of fake alerts. When combined with Cross-Site Scripting (XSS)—a technique where malicious scripts are injected into trusted websites—this flaw can be used to exfiltrate alerts belonging to other customers. **Recommendations** Update to version 2.4.28.