CVE-2019-10254: Improper Neutralization of Input During Web Page Generation

In MISP before 2.4.105, the app/View/Layouts/default.ctp default layout template has a Reflected XSS vulnerability...

CVE-2018-11562

An issue was discovered in MISP 2.4.91. A vulnerability in app/View/Elements/eventattribute.ctp allows reflected XSS if a user clicks on a malicious link for an event view and then clicks on the deleted attributes quick filter...

CVE-2018-11562: Improper Neutralization of Input During Web Page Generation

An issue was discovered in MISP 2.4.91. A vulnerability in app/View/Elements/eventattribute.ctp allows reflected XSS if a user clicks on a malicious link for an event view and then clicks on the deleted attributes quick filter...

PT-2018-10670

Name of the Vulnerable Software and Affected Versions MISP version 2.4.91 Description A reflected XSS issue was discovered, allowing exploitation if a user clicks on a malicious link for an event view and then clicks on the deleted attributes quick filter. This occurs due to a vulnerability in th...

CVE-2018-8948

In MISP before 2.4.89, app/View/Events/resolvedattributes.ctp has multiple XSS issues via a malicious MISP module...

CVE-2018-8948: Improper Neutralization of Input During Web Page Generation

In MISP before 2.4.89, app/View/Events/resolvedattributes.ctp has multiple XSS issues via a malicious MISP module...

PT-2018-18734

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.4.89 Description The issue is related to multiple XSS problems in the app/View/Events/resolved attributes.ctp file of MISP, which can be triggered by a malicious MISP module. Recommendations For versions prior to 2.4.8...

CVE-2017-15216

MISP before 2.4.81 has a potential reflected XSS in a quickDelete action that is used to delete a sighting, related to app/View/Sightings/ajax/quickDeleteConfirmationForm.ctp and app/webroot/js/misp.js...

CVE-2017-15216: Improper Neutralization of Input During Web Page Generation

MISP before 2.4.81 has a potential reflected XSS in a quickDelete action that is used to delete a sighting, related to app/View/Sightings/ajax/quickDeleteConfirmationForm.ctp and app/webroot/js/misp.js...

CVE-2017-13671

app/View/Helper/CommandHelper.php in MISP before 2.4.79 has persistent XSS via comments. It only impacts the users of the same instance because the comment field is not part of the MISP synchronisation...

PT-2017-13003

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.4.79 Description The issue is related to persistent XSS via comments in the app/View/Helper/CommandHelper.php file. It affects users of the same instance, as the comment field is not part of the MISP synchronization...

PT-2012-3579

Name of the Vulnerable Software and Affected Versions All-in-One Event Calendar plugin versions 1.4 and 1.5 Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting XSS attacks. This can be achieved through various parameter...

CVE-2012-1835: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the All-in-One Event Calendar plugin 1.4 and 1.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 title parameter to app/view/agenda-widget-form.php; 2 args, 3 title, 4 beforetitle, or 5 aftertitle parameter...