CVE-2018-8948

In MISP before 2.4.89, app/View/Events/resolvedattributes.ctp has multiple XSS issues via a malicious MISP module...

Cross site scripting

In MISP before 2.4.89, app/View/Events/resolvedattributes.ctp has multiple XSS issues via a malicious MISP module...

CVE-2018-8948

In MISP before 2.4.89, app/View/Events/resolvedattributes.ctp has multiple XSS issues via a malicious MISP module...

CVE-2018-8949

An issue was discovered in app/Model/Attribute.php in MISP before 2.4.89. There is a critical API integrity bug, potentially allowing users to delete attributes of other events. A crafted edit for an event without attribute UUIDs but attribute IDs set could overwrite an existing attribute...

CVE-2018-8949

CVE-2018-8949 involves MISP before 2.4.89, where a flaw in app/Model/Attribute.php creates an API integrity risk that could let a user delete attributes of other events. A crafted event edit (no attribute UUIDs but with attribute IDs set) could overwrite an existing attribute, potentially impacti...

CVE-2018-8948

CVE-2018-8948 affects MISP prior to 2.4.89, with multiple XSS flaws in app/View/Events/resolved_attributes.ctp due to a malicious MISP module. Impact is cross-site scripting; the documents do not specify exploit details or a remediation patch/version.

CVE-2018-8948

In MISP before 2.4.89, app/View/Events/resolvedattributes.ctp has multiple XSS issues via a malicious MISP module...

CVE-2017-9248

creationtimestamp| type| source ---|---|--- 2018-03-21 13:35:18+00:00| published-proof-of-concept| https://t.me/informationsecuritychannel/14891 2018-09-02 06:50:13+00:00| published-proof-of-concept| https://t.me/informationsecuritychannel/19908 2018-09-02 07:17:44+00:00|...

CVE-2018-7445

creationtimestamp| type| source ---|---|--- 2018-03-16 14:31:38+00:00| exploited| https://t.me/informationsecuritychannel/14481 2018-03-16 14:31:38+00:00| published-proof-of-concept| https://t.me/informationsecuritychannel/14482 2018-05-24 15:44:33+00:00| seen|...

CVE-2015-2387

creationtimestamp| type| source ---|---|--- 2018-03-14 21:04:26+00:00| seen| MISP/5aa98d8a-3cac-42f0-b224-45d09f590eb0 2020-10-09 14:48:27+00:00| seen| MISP/f299f6e0-f80f-4c16-9812-b49640ed46c1 2020-10-09 17:20:22+00:00| seen| MISP/86dc4eac-b270-4870-b4e6-d873d9381d9f 2023-06-14 21:10:03+00:00|...

CVE-2013-4979

creationtimestamp| type| source ---|---|--- 2018-03-14 21:04:26+00:00| seen| MISP/5aa98d8a-3cac-42f0-b224-45d09f590eb0...

CVE-2018-5999

creationtimestamp| type| source ---|---|--- 2018-02-26 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/44176 2018-03-01 08:53:42+00:00| published-proof-of-concept| https://t.me/antichat/1000 2018-05-29 15:50:33+00:00| seen|...

CVE-2018-6000

creationtimestamp| type| source ---|---|--- 2018-02-26 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/44176 2018-03-01 08:53:42+00:00| published-proof-of-concept| https://t.me/antichat/1000 2018-05-29 15:50:33+00:00| seen|...

CVE-2017-6516

creationtimestamp| type| source ---|---|--- 2018-02-20 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/44150 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/local/magnicompsysinfomcsiwrapperprivesc.rb 2025-02-06...

CVE-2018-6389

creationtimestamp| type| source ---|---|--- 2018-02-14 09:33:59+00:00| exploited| https://t.me/canyoupwnme/3262 2018-04-09 06:36:01+00:00| seen| https://t.me/codebysec/1344 2019-11-21 11:20:46+00:00| published-proof-of-concept| https://t.me/thebugbountyhunter/3397 2020-01-08 15:00:20+00:00|...

CVE-2018-6892

creationtimestamp| type| source ---|---|--- 2018-02-13 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/44027 2018-02-26 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/44175 2018-05-29 15:50:33+00:00| seen|...

MISP app/Controller/ServersController.php file OS command injection vulnerability

MISP is a suite of open source software solutions for collecting, storing, distributing and sharing cybersecurity metrics and threats cybersecurity event analysis and malware analysis. A security vulnerability exists in the app/Controller/ServersController.php file in MISP version 2.4.87. An...

CVE-2018-6926

In app/Controller/ServersController.php in MISP 2.4.87, a server setting permitted the override of a path variable on certain Red Hed Enterprise Linux and CentOS systems where rhshellfix was enabled, and consequently allowed site admins to inject arbitrary OS commands. The impact is limited by th...

CVE-2018-6926

In app/Controller/ServersController.php in MISP 2.4.87, a server setting permitted the override of a path variable on certain Red Hed Enterprise Linux and CentOS systems where rhshellfix was enabled, and consequently allowed site admins to inject arbitrary OS commands. The impact is limited by th...

CVE-2018-6926

CVE-2018-6926 affects MISP 2.4.87 in the file app/Controller/ServersController.php . A server setting allowed the override of a path variable on certain Red Hat Enterprise Linux and CentOS systems (where rh_shell_fix was enabled), enabling site admins to inject arbitrary operating system commands...