53 matches found
PT-2026-96065
Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.47 Description The galaxy matrix statistics view app/View/Users/statistics galaxymatrix.ctp renders the galaxy name directly into HTML output using the sprintf function without proper HTML encoding. An authenticated...
CVE-2026-54393: Improper Neutralization of Input During Web Page Generation
A stored cross-site scripting vulnerability exists in MISP when the Overmind theme is used. The setHomePage endpoint previously saved the user-controlled path value through setSettingInternal, bypassing the normal setSetting validation logic, including validatehomepage, which requires homepage...
EUVD-2026-30758
Mattermost Desktop App versions =6.1 6.0.1 5.4.13.0 fail to prevent server-rendered content from closing an underlying application view in the Mattermost Desktop App which allows a malicious server or plugin to crash the desktop client via invoking window.close in the renderer context, leading to...
CVE-2020-10247
MISP 2.4.122 has Persistent XSS in the sighting popover tool. This is related to app/View/Elements/Events/View/sightingfield.ctp...
CVE-2025-67906: Improper Neutralization of Input During Web Page Generation
In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path...
PT-2024-36400
Name of the Vulnerable Software and Affected Versions MISP versions 2.5.2 and earlier Description The issue is related to stored Cross Site Scripting XSS in the MISP Galaxy Cluster Export Function. This occurs when exporting custom clusters into the misp-galaxy format. The file...
CVE-2023-40224: Improper Neutralization of Input During Web Page Generation
MISP 2.4.174 allows XSS in app/View/Events/index.ctp...
CVE-2023-40224
MISP 2.4.174 allows XSS in app/View/Events/index.ctp...
CVE-2022-47928
In MISP before 2.4.167, there is XSS in the template file uploads in app/View/Templates/uploadfile.ctp...
CVE-2022-47928: Improper Neutralization of Input During Web Page Generation
In MISP before 2.4.167, there is XSS in the template file uploads in app/View/Templates/uploadfile.ctp...
PT-2022-18323
Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.4.156 Description An issue was discovered that allows Local File Inclusion via the custom terms file setting in the app/View/Users/terms.ctp file. Recommendations For versions prior to 2.4.156, update to version 2.4.15...
CVE-2021-37743
app/View/GalaxyElements/ajax/index.ctp in MISP 2.4.147 allows Stored XSS when viewing galaxy cluster elements in JSON format...
PT-2021-21857
Name of the Vulnerable Software and Affected Versions: MISP version 2.4.147 Description: The issue allows Stored XSS when viewing galaxy cluster elements in JSON format. This occurs in the app/View/GalaxyElements/ajax/index.ctp file. Recommendations: For MISP version 2.4.147, update to a version...
CVE-2021-37534
app/View/GalaxyClusters/add.ctp in MISP 2.4.146 allows Stored XSS when forking a galaxy cluster...
PT-2021-21696
Name of the Vulnerable Software and Affected Versions MISP version 2.4.146 Description The issue allows Stored XSS when forking a galaxy cluster. This occurs in the app/View/GalaxyClusters/add.ctp file. Recommendations For MISP version 2.4.146, update to a version that fixes the Stored XSS issue ...
CVE-2021-37534: Improper Neutralization of Input During Web Page Generation
app/View/GalaxyClusters/add.ctp in MISP 2.4.146 allows Stored XSS when forking a galaxy cluster...
CVE-2021-36212
app/View/SharingGroups/view.ctp in MISP before 2.4.146 allows stored XSS in the sharing groups view...
PT-2021-21177
Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.4.146 Description The issue allows stored XSS in the sharing groups view. This occurs due to a problem in the app/View/SharingGroups/view.ctp file. Recommendations For versions prior to 2.4.146, update to version 2.4.1...
CVE-2021-36212: Improper Neutralization of Input During Web Page Generation
app/View/SharingGroups/view.ctp in MISP before 2.4.146 allows stored XSS in the sharing groups view...