CVE-2021-37743

app/View/GalaxyElements/ajax/index.ctp in MISP 2.4.147 allows Stored XSS when viewing galaxy cluster elements in JSON format...

Cross site scripting

app/View/GalaxyElements/ajax/index.ctp in MISP 2.4.147 allows Stored XSS when viewing galaxy cluster elements in JSON format...

CVE-2021-37743

app/View/GalaxyElements/ajax/index.ctp in MISP 2.4.147 allows Stored XSS when viewing galaxy cluster elements in JSON format...

PT-2021-21857

Name of the Vulnerable Software and Affected Versions: MISP version 2.4.147 Description: The issue allows Stored XSS when viewing galaxy cluster elements in JSON format. This occurs in the app/View/GalaxyElements/ajax/index.ctp file. Recommendations: For MISP version 2.4.147, update to a version...

CVE-2021-25325

MISP 2.4.136 has XSS via galaxy cluster element values to app/View/GalaxyElements/ajax/index.ctp. Reference types could contain javascript: URLs...

PT-2021-7040

Name of the Vulnerable Software and Affected Versions MISP version 2.4.136 Description The issue is related to a lack of input data sanitization in the app/View/GalaxyElements/ajax/index.ctp component of the MISP platform, which can be exploited to perform cross-site scripting XSS attacks...

CVE-2021-25325: Improper Neutralization of Input During Web Page Generation

MISP 2.4.136 has XSS via galaxy cluster element values to app/View/GalaxyElements/ajax/index.ctp. Reference types could contain javascript: URLs...