CVE-2022-29533

An issue was discovered in MISP before 2.4.158. There is XSS in app/Controller/OrganisationsController.php in a situation with a "weird single checkbox page."...

CVE-2022-29528

An issue was discovered in MISP before 2.4.158. PHAR deserialization can occur...

CVE-2022-29531

An issue was discovered in MISP before 2.4.158. There is stored XSS in the event graph via a tag name...

CVE-2022-29528

An issue was discovered in MISP before 2.4.158. PHAR deserialization can occur...

CVE-2022-29532

An issue was discovered in MISP before 2.4.158. There is XSS in the cerebrate view if one administrator puts a javascript: URL in the URL field, and another administrator clicks on it...

CVE-2022-29534

An issue was discovered in MISP before 2.4.158. In UsersController.php, password confirmation can be bypassed via vectors involving an "Accept: application/json" header...

CVE-2022-29533

An issue was discovered in MISP before 2.4.158. There is XSS in app/Controller/OrganisationsController.php in a situation with a "weird single checkbox page."...

Deserialization of untrusted data

An issue was discovered in MISP before 2.4.158. PHAR deserialization can occur...

Cross site scripting

An issue was discovered in MISP before 2.4.158. There is stored XSS via the LinOTP login field...

Design/Logic Flaw

An issue was discovered in MISP before 2.4.158. There is XSS in app/Controller/OrganisationsController.php in a situation with a "weird single checkbox page."...

Cross site scripting

An issue was discovered in MISP before 2.4.158. There is stored XSS in the galaxy clusters...

Design/Logic Flaw

An issue was discovered in MISP before 2.4.158. In UsersController.php, password confirmation can be bypassed via vectors involving an "Accept: application/json" header...

Cross site scripting

An issue was discovered in MISP before 2.4.158. There is stored XSS in the event graph via a tag name...

Design/Logic Flaw

An issue was discovered in MISP before 2.4.158. There is XSS in the cerebrate view if one administrator puts a javascript: URL in the URL field, and another administrator clicks on it...

CVE-2022-29528

An issue was discovered in MISP before 2.4.158. PHAR deserialization can occur...

CVE-2022-29528

Occurrences across multiple sources confirm CVE-2022-29528: MISP before 2.4.158 is affected by PHAR deserialization. The root cause is PHAR deserialization in MISP; impact and exploit details are not explicitly described in the provided documents beyond the vulnerability description. Affected ver...

CVE-2022-29531

CVE-2022-29531 affects MISP before 2.4.158, with a stored XSS in the event graph via a tag name. Root cause: tag names lack data validation/filters, enabling injected JavaScript on the client side. Impact per sources: possible client-side script execution; affected versions are prior to 2.4.158. ...

CVE-2022-29534

An issue was discovered in MISP before 2.4.158. In UsersController.php, password confirmation can be bypassed via vectors involving an "Accept: application/json" header...

MISP 跨站脚本漏洞

MISP is an open source software solution. The product is used to collect, store, distribute, and share network security metrics, and has features such as threat network security event analysis and malware analysis. cross-site scripting vulnerabilities exist in versions of MISP prior to 2.4.158,...

PT-2022-19684 · Misp · Misp

Name of the Vulnerable Software and Affected Versions: MISP versions prior to 2.4.158 Description: An issue was discovered in the UsersController.php file, where password confirmation can be bypassed via vectors involving an "Accept: application/json" header. Recommendations: For versions prior t...