9 matches found
CVE-2024-57969
app/Model/Attribute.php in MISP before 2.4.198 ignores an ACL during a GUI attribute search...
Design/Logic Flaw
MISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/Model/Workflow.php, and app/Plugin/Assets/models/behaviors/LogableBehavior.php...
CVE-2022-48329
MISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/Model/Workflow.php, and app/Plugin/Assets/models/behaviors/LogableBehavior.php...
PT-2023-15707
Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.4.166 Description The issue allows users to unsafely use the order parameter, which is related to several PHP files, including app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/Model/Workflow.php, and...
CVE-2020-14969
app/Model/Attribute.php in MISP 2.4.127 lacks an ACL lookup on attribute correlations. This occurs when querying the attribute restsearch API, revealing metadata about a correlating but unreachable attribute...
CVE-2020-14969: Missing Authorization
app/Model/Attribute.php in MISP 2.4.127 lacks an ACL lookup on attribute correlations. This occurs when querying the attribute restsearch API, revealing metadata about a correlating but unreachable attribute...
PT-2020-14096
Name of the Vulnerable Software and Affected Versions MISP version 2.4.127 Description The issue arises from a lack of ACL lookup on attribute correlations in the app/Model/Attribute.php file. This occurs when querying the "attribute restsearch API", revealing metadata about a correlating but...
CVE-2018-8949
An issue was discovered in app/Model/Attribute.php in MISP before 2.4.89. There is a critical API integrity bug, potentially allowing users to delete attributes of other events. A crafted edit for an event without attribute UUIDs but attribute IDs set could overwrite an existing attribute...
CVE-2018-8949: Exposed Dangerous Method or Function
An issue was discovered in app/Model/Attribute.php in MISP before 2.4.89. There is a critical API integrity bug, potentially allowing users to delete attributes of other events. A crafted edit for an event without attribute UUIDs but attribute IDs set could overwrite an existing attribute...