CVE-2018-8948

CVE-2018-8948 affects MISP prior to 2.4.89, with multiple XSS flaws in app/View/Events/resolved_attributes.ctp due to a malicious MISP module. Impact is cross-site scripting; the documents do not specify exploit details or a remediation patch/version.

CVE-2018-8949

An issue was discovered in app/Model/Attribute.php in MISP before 2.4.89. There is a critical API integrity bug, potentially allowing users to delete attributes of other events. A crafted edit for an event without attribute UUIDs but attribute IDs set could overwrite an existing attribute...

CVE-2018-8949

CVE-2018-8949 involves MISP before 2.4.89, where a flaw in app/Model/Attribute.php creates an API integrity risk that could let a user delete attributes of other events. A crafted event edit (no attribute UUIDs but with attribute IDs set) could overwrite an existing attribute, potentially impacti...

CVE-2018-8948

In MISP before 2.4.89, app/View/Events/resolvedattributes.ctp has multiple XSS issues via a malicious MISP module...

CVE-2017-9248

creationtimestamp| type| source ---|---|--- 2018-03-21 13:35:18+00:00| published-proof-of-concept| https://t.me/informationsecuritychannel/14891 2018-09-02 06:50:13+00:00| published-proof-of-concept| https://t.me/informationsecuritychannel/19908 2018-09-02 07:17:44+00:00|...

CVE-2018-7445

creationtimestamp| type| source ---|---|--- 2018-03-16 14:31:38+00:00| exploited| https://t.me/informationsecuritychannel/14481 2018-03-16 14:31:38+00:00| published-proof-of-concept| https://t.me/informationsecuritychannel/14482 2018-05-24 15:44:33+00:00| seen|...

CVE-2013-4979

creationtimestamp| type| source ---|---|--- 2018-03-14 21:04:26+00:00| seen| MISP/5aa98d8a-3cac-42f0-b224-45d09f590eb0...

CVE-2015-2387

creationtimestamp| type| source ---|---|--- 2018-03-14 21:04:26+00:00| seen| MISP/5aa98d8a-3cac-42f0-b224-45d09f590eb0 2020-10-09 14:48:27+00:00| seen| MISP/f299f6e0-f80f-4c16-9812-b49640ed46c1 2020-10-09 17:20:22+00:00| seen| MISP/86dc4eac-b270-4870-b4e6-d873d9381d9f 2023-06-14 21:10:03+00:00|...

CVE-2018-5999

creationtimestamp| type| source ---|---|--- 2018-02-26 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/44176 2018-03-01 08:53:42+00:00| published-proof-of-concept| https://t.me/antichat/1000 2018-05-29 15:50:33+00:00| seen|...

CVE-2018-6000

creationtimestamp| type| source ---|---|--- 2018-02-26 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/44176 2018-03-01 08:53:42+00:00| published-proof-of-concept| https://t.me/antichat/1000 2018-05-29 15:50:33+00:00| seen|...

CVE-2017-6516

creationtimestamp| type| source ---|---|--- 2018-02-20 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/44150 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/local/magnicompsysinfomcsiwrapperprivesc.rb 2025-02-06...

CVE-2018-6389

creationtimestamp| type| source ---|---|--- 2018-02-14 09:33:59+00:00| exploited| https://t.me/canyoupwnme/3262 2018-04-09 06:36:01+00:00| seen| https://t.me/codebysec/1344 2019-11-21 11:20:46+00:00| published-proof-of-concept| https://t.me/thebugbountyhunter/3397 2020-01-08 15:00:20+00:00|...

MISP app/Controller/ServersController.php file OS command injection vulnerability

MISP is a suite of open source software solutions for collecting, storing, distributing and sharing cybersecurity metrics and threats cybersecurity event analysis and malware analysis. A security vulnerability exists in the app/Controller/ServersController.php file in MISP version 2.4.87. An...

CVE-2018-6892

creationtimestamp| type| source ---|---|--- 2018-02-13 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/44027 2018-02-26 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/44175 2018-05-29 15:50:33+00:00| seen|...

CVE-2018-6926

In app/Controller/ServersController.php in MISP 2.4.87, a server setting permitted the override of a path variable on certain Red Hed Enterprise Linux and CentOS systems where rhshellfix was enabled, and consequently allowed site admins to inject arbitrary OS commands. The impact is limited by th...

CVE-2018-6926

In app/Controller/ServersController.php in MISP 2.4.87, a server setting permitted the override of a path variable on certain Red Hed Enterprise Linux and CentOS systems where rhshellfix was enabled, and consequently allowed site admins to inject arbitrary OS commands. The impact is limited by th...

CVE-2018-6926

In app/Controller/ServersController.php in MISP 2.4.87, a server setting permitted the override of a path variable on certain Red Hed Enterprise Linux and CentOS systems where rhshellfix was enabled, and consequently allowed site admins to inject arbitrary OS commands. The impact is limited by th...

CVE-2018-6926

CVE-2018-6926 affects MISP 2.4.87 in the file app/Controller/ServersController.php . A server setting allowed the override of a path variable on certain Red Hat Enterprise Linux and CentOS systems (where rh_shell_fix was enabled), enabling site admins to inject arbitrary operating system commands...

CVE-2017-9232

creationtimestamp| type| source ---|---|--- 2018-02-12 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/44023 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/jujurunagentprivesc.rb 2025-02-06 03:13:43+00:00|...

CVE-2017-18046

creationtimestamp| type| source ---|---|--- 2018-02-11 13:20:49+00:00| seen| MISP/5a8042be-fe8c-4071-a140-414502de0b81 2025-03-15 00:00:00+00:00| seen| The Shadowserver honeypot/common-vulnerabilities - 2025-03-15 2026-03-23 00:00:00+00:00| seen| The Shadowserver honeypot/common-vulnerabilities -...