Design/Logic Flaw

An issue was discovered in MISP 2.4.108. Organization admins could reset credentials for site admins organization admins have the inherent ability to reset passwords for all of their organization's users. This, however, could be abused in a situation where the host organization of an instance...

CVE-2019-12794

An issue was discovered in MISP 2.4.108. Organization admins could reset credentials for site admins organization admins have the inherent ability to reset passwords for all of their organization's users. This, however, could be abused in a situation where the host organization of an instance...

CVE-2019-12794

An issue was discovered in MISP 2.4.108. Organization admins could reset credentials for site admins organization admins have the inherent ability to reset passwords for all of their organization's users. This, however, could be abused in a situation where the host organization of an instance...

CVE-2019-12794

The CVE concerns MISP 2.4.108 where organization admins can reset credentials for site admins, enabling credential abuse when host organizations create lower-privilege admins. An org admin could manually set a site admin password or use the site admin’s API key to impersonate them, with abuse res...

CVE-2019-12794

An issue was discovered in MISP 2.4.108. Organization admins could reset credentials for site admins organization admins have the inherent ability to reset passwords for all of their organization's users. This, however, could be abused in a situation where the host organization of an instance...

CVE-2019-12840

creationtimestamp| type| source ---|---|--- 2019-06-11 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/46984 2019-06-19 13:57:30+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/webminpackageuprce.rb 2020-12-21 22:52:17+00:00| seen...

CVE-2018-13382

creationtimestamp| type| source ---|---|--- 2019-06-05 00:26:12+00:00| seen| https://t.me/cibsecurity/4683 2019-08-14 01:53:52+00:00| exploited| https://t.me/Pen7esting/339 2022-06-08 19:35:04+00:00| published-proof-of-concept| https://t.me/truesecator/3042 2022-06-13 12:18:44+00:00| seen|...

CVE-2019-4279

creationtimestamp| type| source ---|---|--- 2019-06-04 17:26:24+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/ibm/ibmwasdmgrjavadeserializationrce.rb 2019-06-05 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/46969 2024-01-06...

CVE-2019-2557

creationtimestamp| type| source ---|---|--- 2019-05-24 12:00:04+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/oatsdownloadservlettraversal.rb 2025-02-06 03:13:44+00:00| seen| MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd 2025-02-23 04:10:15+00:00|...

CVE-2019-1069

creationtimestamp| type| source ---|---|--- 2019-05-23 08:09:25+00:00| seen| https://www.kyberturvallisuuskeskus.fi/fi/nollapaivahaavoittuvuuksia-windows-10-kayttojarjestelmassa 2020-10-09 13:20:00+00:00| seen| MISP/fbff27c0-f30f-445c-92af-76781df1856d 2020-10-26 14:14:23+00:00| seen|...

CVE-2019-6814

creationtimestamp| type| source ---|---|--- 2019-05-22 20:48:28+00:00| seen| https://t.me/cvemitreorg/167 2019-07-22 19:56:03+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/http/schneiderelectricnet55xxencoder.rb 2019-07-29 00:00:00+00:00| exploited|...

CVE-2019-11634

creationtimestamp| type| source ---|---|--- 2019-05-22 17:48:31+00:00| seen| https://t.me/cvemitreorg/132 2021-02-01 14:56:35+00:00| seen| MISP/40f8e511-0605-4f1c-8112-5fe43ed25af0 2021-10-25 22:30:42+00:00| seen| MISP/63ddead6-4b82-414c-ad8e-c516b950b446 2021-11-08 08:58:17+00:00| seen|...

CVE-2019-8605

creationtimestamp| type| source ---|---|--- 2019-05-21 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/46892 2019-08-20 17:05:55+00:00| exploited| https://t.me/thehackernews/429 2020-10-09 14:05:40+00:00| seen| MISP/6d574aa3-3f1c-4275-acc4-bf5bc91f11b6 2021-03-20 18:08:16+00:00|...

CVE-2019-12799

creationtimestamp| type| source ---|---|--- 2019-05-17 23:32:16+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/shopwarecreateinstancefromnamedargumentsrce.rb 2025-02-06 03:13:44+00:00| seen| MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd 2025-02-23...

CVE-2019-11231

creationtimestamp| type| source ---|---|--- 2019-05-16 16:47:53+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/getsimplecmsunauthcodeexec.rb 2019-05-20 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/46880 2019-05-22...

CVE-2018-7841

creationtimestamp| type| source ---|---|--- 2019-05-15 09:07:02+00:00| published-proof-of-concept| https://t.me/antichat/4930 2019-12-17 14:15:18+00:00| seen| MISP/5df8e293-8fe4-4dc0-a0c4-4c3502de0b81 2020-10-09 14:49:39+00:00| seen| MISP/08d290fb-f97b-4471-b4fb-65cd5672f476 2020-10-15...

CVE-2019-0863

creationtimestamp| type| source ---|---|--- 2019-05-15 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=391 2019-05-15 15:45:13+00:00| exploited| https://t.me/CyberGovIL/451 2019-05-23 15:16:05+00:00| seen| https://t.me/ctinow/11701 2019-07-04 06:07:15+00:00|...

CVE-2019-0708

creationtimestamp| type| source ---|---|--- 2019-05-14 05:00:00+00:00| seen| https://msrc.microsoft.com/blog/2019/05/prevent-a-worm-by-updating-remote-desktop-services-cve-2019-0708/ 2019-05-14 20:27:23+00:00| seen| https://t.me/thehackernews/305 2019-05-14 21:31:48+00:00| seen|...

CVE-2019-3568

creationtimestamp| type| source ---|---|--- 2019-05-14 03:05:59+00:00| exploited| https://t.me/alexmakus/2832 2019-05-14 04:54:25+00:00| exploited| https://t.me/antichat/4889 2019-05-14 06:21:19+00:00| exploited| https://t.me/MajorHacker/62 2019-05-14 07:28:07+00:00| exploited|...

Cross site scripting

An issue was discovered in app/webroot/js/misp.js in MISP before 2.4.107. There is persistent XSS via image names in titles, as demonstrated by a screenshot...