Design/Logic Flaw

An issue was discovered in MISP 2.4.128. app/Controller/EventsController.php lacks an event ACL check before proceeding to allow a user to send an event contact form...

Design/Logic Flaw

An issue was discovered in MISP 2.4.128. app/Controller/AttributesController.php has insufficient ACL checks in the attachment downloader...

CVE-2020-15412

An issue was discovered in MISP 2.4.128. app/Controller/EventsController.php lacks an event ACL check before proceeding to allow a user to send an event contact form...

CVE-2020-15412

The CVE-2020-15412 issue affects MISP 2.4.128 where app/Controller/EventsController.php lacks an event ACL check before allowing a user to submit an event contact form. This is reported across multiple sources (NVD entry and RH/CVE detail) and framed as an ACL authorization flaw in the event subm...

CVE-2020-15411

CVE-2020-15411 affects MISP 2.4.128; the vulnerability stems from insufficient ACL checks in the file app/Controller/AttributesController.php within the Attachment Downloader. The NVD entry shows a CVSSv3.1 base score of 9.8 (CRITICAL) with network attack, no privileges required, no user interact...

CVE-2020-15411

An issue was discovered in MISP 2.4.128. app/Controller/AttributesController.php has insufficient ACL checks in the attachment downloader...

CVE-2020-2021

creationtimestamp| type| source ---|---|--- 2020-06-29 18:16:29+00:00| seen| https://t.me/avdno/790 2020-06-29 21:35:28+00:00| seen| https://t.me/cKure/1047 2020-06-30 06:03:40+00:00| exploited| https://t.me/cKure/1050 2020-06-30 11:25:12+00:00| seen| https://t.me/truesecator/712 2020-06-30...

CVE-2019-12169

creationtimestamp| type| source ---|---|--- 2020-06-29 17:08:43+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/atutoruploadtraversal.rb 2025-02-06 03:13:43+00:00| seen| MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd 2025-02-23 04:10:11+00:00| seen|...

CVE-2020-12004

creationtimestamp| type| source ---|---|--- 2020-06-25 16:25:27+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/scada/inductiveignitionrce.rb 2024-10-31 02:05:38+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/1355 2025-02-0...

CVE-2020-10644

creationtimestamp| type| source ---|---|--- 2020-06-25 16:25:27+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/scada/inductiveignitionrce.rb 2024-10-31 02:05:38+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/1355 2025-02-0...

CVE-2020-14969

app/Model/Attribute.php in MISP 2.4.127 lacks an ACL lookup on attribute correlations. This occurs when querying the attribute restsearch API, revealing metadata about a correlating but unreachable attribute...

CVE-2020-14969

app/Model/Attribute.php in MISP 2.4.127 lacks an ACL lookup on attribute correlations. This occurs when querying the attribute restsearch API, revealing metadata about a correlating but unreachable attribute...

Code injection

app/Model/Attribute.php in MISP 2.4.127 lacks an ACL lookup on attribute correlations. This occurs when querying the attribute restsearch API, revealing metadata about a correlating but unreachable attribute...

CVE-2020-14969

app/Model/Attribute.php in MISP 2.4.127 lacks an ACL lookup on attribute correlations. This occurs when querying the attribute restsearch API, revealing metadata about a correlating but unreachable attribute...

CVE-2020-14969

In MISP 2.4.127, the file app/Model/Attribute.php lacks an ACL lookup on attribute correlations when using the attribute restsearch API, exposing metadata about a correlating but unreachable attribute. This is a validation/authorization oversight that can reveal sensitive linkage information thro...

CVE-2020-8605

creationtimestamp| type| source ---|---|--- 2020-06-22 11:03:34+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/trendmicrowebsecurityexec.rb 2024-10-29 19:01:25+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/1313...

CVE-2020-8606

creationtimestamp| type| source ---|---|--- 2020-06-22 11:03:34+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/trendmicrowebsecurityexec.rb 2024-10-29 19:01:25+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/1313...

CVE-2020-8604

creationtimestamp| type| source ---|---|--- 2020-06-22 11:03:34+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/trendmicrowebsecurityexec.rb 2024-10-29 19:01:25+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/1313...

CVE-2020-13160

creationtimestamp| type| source ---|---|--- 2020-06-20 09:26:15+00:00| seen| https://t.me/R0Crew/1664 2020-07-01 20:12:12+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/misc/cve202013160anydesk.rb 2021-03-03 00:00:00+00:00| exploited|...

CVE-2020-7356

creationtimestamp| type| source ---|---|--- 2020-06-18 15:43:56+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/cayinxpostsqlrce.rb 2025-02-06 03:13:44+00:00| seen| MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd 2025-02-23 04:10:30+00:00| seen|...