CVE-2024-25674

An issue was discovered in MISP before 2.4.184. Organisation logo upload is insecure because of a lack of checks for the file extension and MIME type...

CVE-2024-25675

An issue was discovered in MISP before 2.4.184. A client does not need to use POST to start an export generation process. This is related to app/Controller/JobsController.php and app/View/Events/export.ctp...

Design/Logic Flaw

An issue was discovered in MISP before 2.4.184. Organisation logo upload is insecure because of a lack of checks for the file extension and MIME type...

Code injection

An issue was discovered in MISP before 2.4.184. A client does not need to use POST to start an export generation process. This is related to app/Controller/JobsController.php and app/View/Events/export.ctp...

CVE-2024-21762

creationtimestamp| type| source ---|---|--- 2024-02-09 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=1225 2024-02-09 06:40:49+00:00| exploited| https://t.me/thehackernews/4526 2024-02-09 06:59:47+00:00| exploited| https://t.me/KomunitiSiber/1466 2024-02-09 07:19:01+00:00...

CVE-2024-23113

creationtimestamp| type| source ---|---|--- 2024-02-09 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=1225 2024-02-09 08:40:20+00:00| seen| https://www.cert.at/de/warnungen/2024/2/kritische-sicherheitslucken-in-fortinet-fortios-updates-verfugbar 2024-02-09 10:14:28+00:00|...

MISP Security Vulnerabilities

MISP is an open source software solution. The product is used to collect, store, distribute, and share cybersecurity metrics and has features such as threat cybersecurity event analysis and malware analysis. A security vulnerability exists in MISP versions prior to 2.4.184, which stems from a...

PT-2024-21082 · Misp · Misp

Name of the Vulnerable Software and Affected Versions: MISP versions prior to 2.4.184 Description: An issue was discovered in the organisation logo upload feature due to a lack of checks for the file extension and MIME type, making it insecure. Recommendations: For versions prior to 2.4.184, upda...

CVE-2024-25674

An issue was discovered in MISP before 2.4.184. Organisation logo upload is insecure because of a lack of checks for the file extension and MIME type...

CVE-2024-25675

An issue was discovered in MISP before 2.4.184. A client does not need to use POST to start an export generation process. This is related to app/Controller/JobsController.php and app/View/Events/export.ctp...

CVE-2024-25674

An issue was discovered in MISP before 2.4.184. Organisation logo upload is insecure because of a lack of checks for the file extension and MIME type...

CVE-2024-25674

CVE-2024-25674 affects MISP before 2.4.184. The issue is insecure organisation logo upload due to missing checks for file extension and MIME type, enabling potential abuse. CVSSv3.1 base score 9.8 (CRITICAL) with attack vector NETWORK, no auth, high impact to confidentiality, integrity, and avail...

CVE-2024-25675

An issue was discovered in MISP before 2.4.184. A client does not need to use POST to start an export generation process. This is related to app/Controller/JobsController.php and app/View/Events/export.ctp...

CVE-2024-25675

CVE-2024-25675 affects MISP prior to 2.4.184. The issue allows a client to start an export generation process without using POST, related to files app/Controller/JobsController.php and app/View/Events/export.ctp. According to connected sources, this could enable unintended initiation of export ta...

PT-2024-21083 · Misp · Misp

Name of the Vulnerable Software and Affected Versions: MISP versions prior to 2.4.184 Description: An issue was discovered where a client does not need to use POST to start an export generation process. This is related to app/Controller/JobsController.php and app/View/Events/export.ctp...

CVE-2024-25675

An issue was discovered in MISP before 2.4.184. A client does not need to use POST to start an export generation process. This is related to app/Controller/JobsController.php and app/View/Events/export.ctp...

CVE-2024-25674

An issue was discovered in MISP before 2.4.184. Organisation logo upload is insecure because of a lack of checks for the file extension and MIME type...

MISP 2.4.171 - Stored XSS Vulnerability

Exploit Title: MISP 2.4.171 Stored XSS CVE-2023-37307 Authenticated Exploit Author: Mücahit Çeri Vendor Homepage: https://www.circl.lu/ Software Link: https://github.com/MISP/MISP Version: 2.4.171 Tested on: Ubuntu 20.04 CVE : CVE-2023-37307 Exploit: Logged in as low privileged account 1Click on...

MISP 2.4.171 Cross Site Scripting

Exploit Title: MISP 2.4.171 Stored XSS CVE-2023-37307 Authenticated Date: 8th October 2023 Exploit Author: Mücahit Çeri Vendor Homepage: https://www.circl.lu/ Software Link: https://github.com/MISP/MISP Version: 2.4.171 Tested on: Ubuntu 20.04 CVE : CVE-2023-37307 Exploit: Logged in as low...

MISP 2.4.171 - Stored XSS

Exploit Title: MISP 2.4.171 Stored XSS CVE-2023-37307 Authenticated Date: 8th October 2023 Exploit Author: Mücahit Çeri Vendor Homepage: https://www.circl.lu/ Software Link: https://github.com/MISP/MISP Version: 2.4.171 Tested on: Ubuntu 20.04 CVE : CVE-2023-37307 Exploit: Logged in as low...