CVE-2023-48659: Undefined Security Weakness

An issue was discovered in MISP before 2.4.176. app/Controller/AppController.php mishandles parameter parsing...

MISP Cross-Site Script Vulnerabilities

MISP is an open source software solution. The product is used to collect, store, distribute, and share cybersecurity metrics and has features such as threat cybersecurity event analysis and malware analysis. A security vulnerability exists in MISP version 2.4.174, which stems from the presence of...

CVE-2023-24028: Improper Access Control

In MISP 2.4.167, app/Controller/Component/ACLComponent.php has incorrect access control for the decaying import function...

CVE-2015-10006

A vulnerability, which was classified as problematic, has been found in admont28 Ingnovarq. Affected by this issue is some unknown functionality of the file app/controller/insertarSliderAjax.php. The manipulation of the argument imagetitle leads to cross site scripting. The attack may be launched...

CVE-2015-10006: Improper Neutralization of Input During Web Page Generation

A vulnerability, which was classified as problematic, has been found in admont28 Ingnovarq. Affected by this issue is some unknown functionality of the file app/controller/insertarSliderAjax.php. The manipulation of the argument imagetitle leads to cross site scripting. The attack may be launched...

CVE-2022-42724

app/Controller/UsersController.php in MISP before 2.4.164 allows attackers to discover role names this is information that only the site admin should have...

CVE-2022-29533: Improper Neutralization of Input During Web Page Generation

An issue was discovered in MISP before 2.4.158. There is XSS in app/Controller/OrganisationsController.php in a situation with a "weird single checkbox page."...

CVE-2022-29533

An issue was discovered in MISP before 2.4.158. There is XSS in app/Controller/OrganisationsController.php in a situation with a "weird single checkbox page."...

CVE-2022-26268

Xiaohuanxiong v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /app/controller/Books.php...

PT-2022-17754

Name of the Vulnerable Software and Affected Versions Xiaohuanxiong version 1.0 Description The issue is related to a SQL injection vulnerability. It can be exploited via the id parameter at the "/app/controller/Books.php" API endpoint. Recommendations For Xiaohuanxiong version 1.0, as a temporar...

CVE-2022-26268: Improper Neutralization of Special Elements used in an SQL Command

Xiaohuanxiong v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /app/controller/Books.php...

CVE-2020-24085

A cross-site scripting XSS vulnerability exists in MISP v2.4.128 in app/Controller/UserSettingsController.php at SetHomePage function. Due to a lack of controller validation in "path" parameter, an attacker can execute malicious JavaScript code...

CVE-2020-29006: Missing Authorization

MISP before 2.4.135 lacks an ACL check, related to app/Controller/GalaxyElementsController.php and app/Model/GalaxyElement.php...

CVE-2020-15412: Missing Authorization

An issue was discovered in MISP 2.4.128. app/Controller/EventsController.php lacks an event ACL check before proceeding to allow a user to send an event contact form...

Description of Update Rollup 2 for System Center 2012 Service Pack 1

Discusses the issues that are fixed in Update Rollup 2 for Microsoft System Center 2012 Service Pack 1.IntroductionThis article describes the issues that are fixed in Update Rollup 2 for Microsoft System Center 2012 Service Pack 1 SP1. Additionally, this article contains the installation...

Description of Update Rollup 2 for System Center 2012 Service Pack 1

Description of Update Rollup 2 for System Center 2012 Service Pack 1 Introduction This article describes the issues that are fixed in Update Rollup 2 for Microsoft System Center 2012 Service Pack 1 SP1. Additionally, this article contains the installation instructions for Update Rollup 2 for Syst...

CVE-2018-12649

An issue was discovered in app/Controller/UsersController.php in MISP 2.4.92. An adversary can bypass the brute-force protection by using a PUT HTTP method instead of a POST HTTP method in the login part, because this protection was only covering POST requests...

FAQ: XenMobile Server Support

This article contains answers to the frequently asked questions on XenMobile Server Support. General What is XenMobile Server Support? How do I get to the support page on App Controller server? In which version of App Controller Support feature is available? What are the browsers and platforms...

CVE-2017-16946

The adminedit function in app/Controller/UsersController.php in MISP 2.4.82 mishandles the enablepassword field, which allows admins to discover a hashed password by reading the audit log...

CVE-2015-5719: Undefined Security Weakness

app/Controller/TemplatesController.php in Malware Information Sharing Platform MISP before 2.3.92 does not properly restrict filenames under the tmp/files/ directory, which has unspecified impact and attack vectors...