CVE-2021-3184

MISP 2.4.136 has XSS via a crafted URL to the app/View/Elements/globalmenu.ctp user homepage favourite button...

CVE-2021-25324

MISP 2.4.136 has Stored XSS in the galaxy cluster view via a cluster name to app/View/GalaxyClusters/view.ctp...

CVE-2021-25325

MISP 2.4.136 has XSS via galaxy cluster element values to app/View/GalaxyElements/ajax/index.ctp. Reference types could contain javascript: URLs...

PT-2021-7040

Name of the Vulnerable Software and Affected Versions MISP version 2.4.136 Description The issue is related to a lack of input data sanitization in the app/View/GalaxyElements/ajax/index.ctp component of the MISP platform, which can be exploited to perform cross-site scripting XSS attacks...

CVE-2021-3184: Improper Neutralization of Input During Web Page Generation

MISP 2.4.136 has XSS via a crafted URL to the app/View/Elements/globalmenu.ctp user homepage favourite button...

PT-2021-19542

Name of the Vulnerable Software and Affected Versions MISP version 2.4.136 Description The issue is related to a crafted URL that can cause XSS via the app/View/Elements/global menu.ctp user homepage favourite button. Recommendations For MISP version 2.4.136, consider disabling access to the...

PT-2021-16520

Name of the Vulnerable Software and Affected Versions: MISP version 2.4.136 Description: The issue is related to Stored XSS in the galaxy cluster view. This occurs via a cluster name to the app/View/GalaxyClusters/view.ctp file. Recommendations: For MISP version 2.4.136, consider restricting acce...

CVE-2021-25325: Improper Neutralization of Input During Web Page Generation

MISP 2.4.136 has XSS via galaxy cluster element values to app/View/GalaxyElements/ajax/index.ctp. Reference types could contain javascript: URLs...

CVE-2021-25324: Improper Neutralization of Input During Web Page Generation

MISP 2.4.136 has Stored XSS in the galaxy cluster view via a cluster name to app/View/GalaxyClusters/view.ctp...

CVE-2020-13153: Improper Neutralization of Input During Web Page Generation

app/View/Events/resolvedattributes.ctp in MISP before 2.4.126 has XSS in the resolved attributes view...

PT-2020-13358

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.4.126 Description The issue is related to a Cross-Site Scripting XSS flaw in the resolved attributes view. This occurs in the app/View/Events/resolved attributes.ctp file. Recommendations For versions prior to 2.4.126,...

CVE-2020-10246

MISP 2.4.122 has reflected XSS via unsanitized URL parameters. This is related to app/View/Users/statisticsorgs.ctp...

CVE-2020-10247

MISP 2.4.122 has Persistent XSS in the sighting popover tool. This is related to app/View/Elements/Events/View/sightingfield.ctp...

Design/Logic Flaw

MISP 2.4.122 has Persistent XSS in the sighting popover tool. This is related to app/View/Elements/Events/View/sightingfield.ctp...

CVE-2020-10246

MISP 2.4.122 has reflected XSS via unsanitized URL parameters. This is related to app/View/Users/statisticsorgs.ctp...

CVE-2020-10247: Improper Neutralization of Input During Web Page Generation

MISP 2.4.122 has Persistent XSS in the sighting popover tool. This is related to app/View/Elements/Events/View/sightingfield.ctp...

CVE-2020-10246: Improper Neutralization of Input During Web Page Generation

MISP 2.4.122 has reflected XSS via unsanitized URL parameters. This is related to app/View/Users/statisticsorgs.ctp...

CVE-2020-8893: Undefined Security Weakness

An issue was discovered in MISP before 2.4.121. The Galaxy view contained an incorrectly sanitized search string in app/View/Galaxies/view.ctp...

CVE-2020-8893

An issue was discovered in MISP before 2.4.121. The Galaxy view contained an incorrectly sanitized search string in app/View/Galaxies/view.ctp...

CVE-2020-8893

CVE-2020-8893 affects MISP prior to 2.4.121. The issue is in the Galaxy view (file: app/View/Galaxies/view.ctp) where a search string was not properly sanitized, enabling improper handling of input. Impact is described in the sources as a vulnerability in the Galaxy search functionality; explicit...