Approved changes feed: RSS · Atom
cpe:2.3:a:dfir-iris:iris-web:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Dfir Iris (bee448b7-7989-5277-9b31-65d978267400) |
|---|---|
| Product | Iris Web (1f8894d4-53ce-598a-bf94-f03af500c5c6) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-42547 |
vulnerable | 2026-06-08 08:03:16.482952 |
IRIS Alerts Can be Falsely Attributed to Customers
MEDIUM (5.4)
IRIS is a web collaborative platform that helps incident responders share technical details during investigations. In versions prior to 2.4.28, users can create alerts for customers that are not assigned to them. This can be abused to falsely attribute fake alerts to customers. In combination with Cross-Site Scripting, this can also be used to exfiltrate alerts from other customers. Version 2.4.28 contains a patch.
Published: 2026-06-04T21:08:53.996Z
Updated: 2026-06-08T15:12:18.894Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-42543 |
vulnerable | 2026-06-08 08:03:16.480859 |
IRIS has a Cross-Site Request Forgery (CSRF) issue
MEDIUM (4.3)
IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 are vulnerable to a cross-site request forgery attack, because they use the HTTP method `GET` to change state on the server. Version 2.4.28 contains a patch.
Published: 2026-06-04T21:00:51.337Z
Updated: 2026-06-08T18:30:38.214Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-42540 |
vulnerable | 2026-06-08 08:03:16.478173 |
IRIS has a Mass Assignment issue
MEDIUM (4.3)
IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 allow a user to alter values in the database via manipulated API requests. Version 2.4.28 contains a patch.
Published: 2026-06-04T20:57:52.211Z
Updated: 2026-06-05T19:30:43.905Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-42539 |
vulnerable | 2026-06-08 08:03:16.477953 |
IRIS has an Excessive Data Exposure issue
MEDIUM (6.5)
IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 return sensitive data to the user which are not required for the client’s operation. Version 2.4.28 contains a patch.
Published: 2026-06-04T20:54:51.107Z
Updated: 2026-06-08T16:40:23.264Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-42538 |
vulnerable | 2026-06-08 08:03:16.477701 |
IRIS has an Insecure File Upload
MEDIUM (6.3)
IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 do not properly validate uploaded files. The application can therefore be misused to host phishing pages, amongst other things. This also creates another instance of a Cross-Site Scripting (XSS) vulnerability. Version 2.4.28 contains a patch.
Published: 2026-06-04T20:48:58.466Z
Updated: 2026-06-05T20:07:09.013Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-42329 |
vulnerable | 2026-06-08 08:03:16.170128 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-41522 |
vulnerable | 2026-06-08 08:03:15.538428 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-22783 |
vulnerable | 2026-06-08 07:51:13.900267 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-25640 |
vulnerable | 2026-06-08 06:31:23.637005 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-25624 |
vulnerable | 2026-06-08 06:31:23.603495 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-50712 |
vulnerable | 2026-06-08 06:16:16.324379 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-30615 |
vulnerable | 2026-06-08 06:04:39.959040 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.