5397 matches found
CVE-2023-24070
app/View/AuthKeys/authkeydisplay.ctp in MISP through 2.4.167 has an XSS in authkey add via a Referer field...
Design/Logic Flaw
app/View/AuthKeys/authkeydisplay.ctp in MISP through 2.4.167 has an XSS in authkey add via a Referer field...
PT-2023-19388
Name of the Vulnerable Software and Affected Versions MISP versions 2.4.167 and earlier Description The issue is related to an XSS in authkey add via a Referer field in the app/View/AuthKeys/authkey display.ctp file. Recommendations For MISP versions 2.4.167 and earlier, as a temporary workaround...
CVE-2023-24070
Summary : CVE-2023-24070 concerns MISP
MISP 跨站脚本漏洞
MISP is an open source software solution. The product is used to collect, store, distribute, and share cybersecurity metrics and has features such as threat cybersecurity event analysis and malware analysis. A security vulnerability exists in MISP version 2.4.167 and prior versions. An attacker...
CVE-2023-24070
app/View/AuthKeys/authkeydisplay.ctp in MISP through 2.4.167 has an XSS in authkey add via a Referer field...
CVE-2023-24070
app/View/AuthKeys/authkeydisplay.ctp in MISP through 2.4.167 has an XSS in authkey add via a Referer field...
CVE-2023-24028
In MISP 2.4.167, app/Controller/Component/ACLComponent.php has incorrect access control for the decaying import function...
CVE-2023-24027
In MISP 2.4.167, app/webroot/js/actiontable.js allows XSS via a network history name...
CVE-2023-24026
In MISP 2.4.167, app/webroot/js/event-graph.js has an XSS vulnerability via an event-graph preview payload...
Design/Logic Flaw
In MISP 2.4.167, app/webroot/js/actiontable.js allows XSS via a network history name...
Design/Logic Flaw
In MISP 2.4.167, app/Controller/Component/ACLComponent.php has incorrect access control for the decaying import function...
Cross site scripting
In MISP 2.4.167, app/webroot/js/event-graph.js has an XSS vulnerability via an event-graph preview payload...
CVE-2023-24027
In MISP 2.4.167, app/webroot/js/actiontable.js allows XSS via a network history name...
CVE-2023-24028
In MISP 2.4.167, app/Controller/Component/ACLComponent.php has incorrect access control for the decaying import function...
CVE-2023-24026
In MISP 2.4.167, app/webroot/js/event-graph.js has an XSS vulnerability via an event-graph preview payload...
CVE-2023-24027
CVE-2023-24027 affects MISP 2.4.167 with an XSS issue in app/webroot/js/action_table.js triggered via a network history name. The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base score 6.1 (Medium). It requires user interaction and has network attack vector; impact concerns c...
CVE-2023-24026
CVE-2023-24026 affects MISP 2.4.167, specifically the file app/webroot/js/event-graph.js where an event-graph preview payload enables a Cross-Site Scripting (XSS) vulnerability. The root cause is an XSS in the event-graph preview flow, with the vulnerability described across multiple feeds (NVD, ...
CVE-2023-24028
CVE-2023-24028 affects MISP 2.4.167 where the decaying import function in app/Controller/Component/ACLComponent.php has incorrect access control. The CVSS 3.1 base score is 9.8 (CRITICAL) with network attack vector, no privileges, and no user interaction; impact to confidentiality, integrity, and...