312 matches found
CVE-2024-58128
In MISP before 2.4.193, menucustomrightlink parameters can be set via the UI i.e., without using the CLI and thus attackers with admin privileges can conduct XSS attacks via a global menu link...
CVE-2024-58129
In MISP before 2.4.193, menucustomrightlinkhtml parameters can be set via the UI i.e., without using the CLI and thus attackers with admin privileges can conduct XSS attacks against every page...
CVE-2024-58129
CVE-2024-58129 affects MISP prior to version 2.4.193. The issue allows attackers with admin privileges to set menu_custom_right_link_html through the UI (not the CLI), enabling cross-site scripting on every page. The risk description in the connected documents confirms XSS across pages due to thi...
CVE-2024-58128
CVE-2024-58128 (MISP) affects MISP prior to 2.4.193. The issue allows attackers with admin privileges to perform cross-site scripting (XSS) through the menu_custom_right_link parameter set via the UI (no CLI). The root cause is an insufficiency in input validation/handling of that parameter, enab...
CVE-2024-58130
In app/Controller/Component/RestResponseComponent.php in MISP before 2.4.193, REST endpoints have a lack of sanitization for non-JSON responses...
CVE-2024-58130
In app/Controller/Component/RestResponseComponent.php in MISP before 2.4.193, REST endpoints have a lack of sanitization for non-JSON responses...
CVE-2024-58128
In MISP before 2.4.193, menucustomrightlink parameters can be set via the UI i.e., without using the CLI and thus attackers with admin privileges can conduct XSS attacks via a global menu link...
CVE-2024-58129
In MISP before 2.4.193, menucustomrightlinkhtml parameters can be set via the UI i.e., without using the CLI and thus attackers with admin privileges can conduct XSS attacks against every page...
CVE-2024-58130
The CVE-2024-58130 affects MISP prior to 2.4.193 in RestResponseComponent.php where non-JSON REST responses are not sanitized. This could allow processing of non-JSON outputs through REST endpoints. Remediation: upgrade to MISP 2.4.193 (or later).
CVE-2024-57969
app/Model/Attribute.php in MISP before 2.4.198 ignores an ACL during a GUI attribute search...
CVE-2024-57969
CVE-2024-57969 affects MISP prior to 2.4.198. The root cause is that app/Model/Attribute.php ignores an ACL during a GUI attribute search, which can bypass access controls when listing attributes. Impact details in the sources indicate low confidentiality impact and no data integrity/availability...
CVE-2024-57969
app/Model/Attribute.php in MISP before 2.4.198 ignores an ACL during a GUI attribute search...
CVE-2024-54674
app/View/GalaxyClusters/clusterexportmispgalaxy.ctp in MISP through 2.5.2 has stored XSS when exporting custom clusters into the misp-galaxy format...
CVE-2021-21106
creationtimestamp| type| source ---|---|--- 2024-11-14 06:10:09+00:00| seen| MISP/04f708e2-47b6-4fd4-997c-c34be6ce1aa6...
CVE-2021-30637
creationtimestamp| type| source ---|---|--- 2024-11-14 06:08:54+00:00| seen| MISP/453892aa-3b77-4a2b-b7b4-5f905765d7a8...
CVE-2020-22839
creationtimestamp| type| source ---|---|--- 2024-11-14 06:08:10+00:00| seen| MISP/d554d4aa-1d22-4bb0-9413-fc4924f27d90...
CVE-2020-22840
creationtimestamp| type| source ---|---|--- 2024-11-14 06:08:09+00:00| seen| MISP/8ab39244-bb6c-4d97-b634-dea84993158e...
CVE-2017-15673
creationtimestamp| type| source ---|---|--- 2024-11-14 06:07:45+00:00| seen| MISP/50b22881-7091-4229-8dbf-185fb193b649...