35 matches found
CVE-2023-24028
In MISP 2.4.167, app/Controller/Component/ACLComponent.php has incorrect access control for the decaying import function...
Cross site scripting
An issue was discovered in MISP before 2.4.158. There is stored XSS in the galaxy clusters...
PT-2022-19682 · Misp · Misp
Name of the Vulnerable Software and Affected Versions: MISP versions prior to 2.4.158 Description: The issue is related to a Cross-Site Scripting XSS vulnerability in the cerebrate view. This occurs when one administrator enters a javascript: URL in the URL field, and another administrator clicks...
PT-2021-21856 · Misp · Misp
Name of the Vulnerable Software and Affected Versions: MISP version 2.4.147 Description: The issue allows Stored XSS when viewing galaxy cluster relationships. This occurs in the app/View/Elements/GalaxyClusters/view relation tree.ctp file. Recommendations: For MISP version 2.4.147, consider...
CVE-2021-31780
In app/Model/MispObject.php in MISP 2.4.141, an incorrect sharing group association could lead to information disclosure on an event edit. When an object has a sharing group associated with an event edit, the sharing group object is ignored and instead the passed local ID is reused...
CVE-2020-29006
MISP before 2.4.135 lacks an ACL check, related to app/Controller/GalaxyElementsController.php and app/Model/GalaxyElement.php...
Information disclosure
MISP before 2.4.135 lacks an ACL check, related to app/Controller/GalaxyElementsController.php and app/Model/GalaxyElement.php...
Design/Logic Flaw
In MISP 2.4.134, XSS exists in the template element index view because the id parameter is mishandled...
CVE-2020-13153
app/View/Events/resolvedattributes.ctp in MISP before 2.4.126 has XSS in the resolved attributes view...
Cross site scripting
MISP 2.4.122 has reflected XSS via unsanitized URL parameters. This is related to app/View/Users/statisticsorgs.ctp...
PT-2020-12003 · Misp · Misp
Name of the Vulnerable Software and Affected Versions: MISP version 2.4.122 Description: The issue is related to a Persistent XSS in the sighting popover tool, specifically in the app/View/Elements/Events/View/sighting field.ctp file. Recommendations: For MISP version 2.4.122, consider disabling...
PT-2019-12993 · Misp · Misp
Name of the Vulnerable Software and Affected Versions: MISP version 2.4.109 Description: The issue allows remote command execution by a super administrator due to the use of the PHP file exists function with user-controlled entries. Specifically, phar:// URLs can trigger deserialization, leading ...
CVE-2019-10254
In MISP before 2.4.105, the app/View/Layouts/default.ctp default layout template has a Reflected XSS vulnerability...
PT-2018-10423 · Misp · Misp
Name of the Vulnerable Software and Affected Versions: MISP version 2.4.91 Description: The issue is related to a DOM-based XSS in the app/webroot/js/misp.js file, specifically with cortex type attributes. Recommendations: For MISP version 2.4.91, update to a newer version that contains a fix for...
