MISP 跨站脚本漏洞

MISP is an open source software solution. The product is used to collect, store, distribute, and share network security metrics, and has features such as threat network security event analysis and malware analysis. cross-site scripting vulnerabilities exist in versions of MISP prior to 2.4.158,...

CVE-2022-29528

Occurrences across multiple sources confirm CVE-2022-29528: MISP before 2.4.158 is affected by PHAR deserialization. The root cause is PHAR deserialization in MISP; impact and exploit details are not explicitly described in the provided documents beyond the vulnerability description. Affected ver...

CVE-2022-29531

CVE-2022-29531 affects MISP before 2.4.158, with a stored XSS in the event graph via a tag name. Root cause: tag names lack data validation/filters, enabling injected JavaScript on the client side. Impact per sources: possible client-side script execution; affected versions are prior to 2.4.158. ...

CVE-2022-29530

CVE-2022-29530 – MISP stored XSS in galaxy clusters affects MISP versions prior to 2.4.158. The vulnerability arises from a lack of data validation/filtering of user-supplied data and its output in galaxy clusters, allowing an attacker to execute JavaScript in a victim’s browser (stored XSS). Pub...

CVE-2022-29532

An issue was discovered in MISP before 2.4.158. There is XSS in the cerebrate view if one administrator puts a javascript: URL in the URL field, and another administrator clicks on it...

CVE-2022-29528

An issue was discovered in MISP before 2.4.158. PHAR deserialization can occur...

CVE-2022-29529

An issue was discovered in MISP before 2.4.158. There is stored XSS via the LinOTP login field...

CVE-2022-29531

An issue was discovered in MISP before 2.4.158. There is stored XSS in the event graph via a tag name...

CVE-2022-29534

An issue was discovered in MISP before 2.4.158. In UsersController.php, password confirmation can be bypassed via vectors involving an "Accept: application/json" header...

CVE-2022-29529

CVE-2022-29529 affects the MISP project prior to 2.4.158, with a stored XSS in the LinOTP login field. Root cause: insufficient input validation and output of user-supplied data in that field. Impact: potential execution of JavaScript in affected users’ browsers. Remediation: upgrade to MISP 2.4....

PT-2022-19681 · Misp · Misp

Name of the Vulnerable Software and Affected Versions: MISP versions prior to 2.4.158 Description: An issue was discovered in the event graph via a tag name, allowing stored XSS. Recommendations: For versions prior to 2.4.158, update to version 2.4.158 or later to resolve the issue. As a temporar...

CVE-2022-29529

An issue was discovered in MISP before 2.4.158. There is stored XSS via the LinOTP login field...

PT-2022-19679 · Misp · Misp

Name of the Vulnerable Software and Affected Versions: MISP versions prior to 2.4.158 Description: An issue was discovered in MISP, where there is stored XSS via the LinOTP login field. Recommendations: For versions prior to 2.4.158, update to version 2.4.158 or later to resolve the issue. As a...

CVE-2022-29530

An issue was discovered in MISP before 2.4.158. There is stored XSS in the galaxy clusters...

CVE-2022-29533

An issue was discovered in MISP before 2.4.158. There is XSS in app/Controller/OrganisationsController.php in a situation with a "weird single checkbox page."...

CVE-2022-29533

An issue was discovered in MISP before 2.4.158. There is XSS in app/Controller/OrganisationsController.php in a situation with a "weird single checkbox page."...

PT-2022-19683 · Misp · Misp

Name of the Vulnerable Software and Affected Versions: MISP versions prior to 2.4.158 Description: The issue is related to a Cross-Site Scripting XSS vulnerability in the app/Controller/OrganisationsController.php file, specifically in situations involving a "weird single checkbox page."...

MISP 跨站脚本漏洞

MISP is an open source software solution. The product is used to collect, store, distribute, and share network security metrics and has features such as threat network security event analysis and malware analysis. cross-site scripting vulnerability exists in versions prior to MISP 2.4.158, which...

PT-2022-19678 · Misp · Misp

Name of the Vulnerable Software and Affected Versions: MISP versions prior to 2.4.158 Description: An issue was discovered in MISP where PHAR deserialization can occur. Recommendations: For versions prior to 2.4.158, update to version 2.4.158 or later to resolve the issue...

CVE-2022-29530

An issue was discovered in MISP before 2.4.158. There is stored XSS in the galaxy clusters...