Code injection

An issue was discovered in MISP before 2.4.121. The Galaxy view contained an incorrectly sanitized search string in app/View/Galaxies/view.ctp...

CVE-2020-8890

An issue was discovered in MISP before 2.4.121. It mishandled time skew between the machine hosting the web server and the machine hosting the database when trying to block a brute-force series of invalid requests...

CVE-2020-8890

CVE-2020-8890 affects MISP before 2.4.121. The root cause is mishandling of time skew between the web server and database when attempting to block a brute-force sequence of invalid requests. This misalignment can undermine the intended rate-limiting or blocking logic. The connected records consis...

CVE-2020-8891

An issue was discovered in MISP before 2.4.121. It did not canonicalize usernames when trying to block a brute-force series of invalid requests...

CVE-2020-8891

The CVE-2020-8891 entry concerns MISP prior to 2.4.121 where brute-force blocking failed to canonicalize usernames. This is a software-level input normalization flaw in the authentication/brute-force protection path that could enable bypass of rate-limiting or account blocking under certain inval...

CVE-2020-8892

An issue was discovered in MISP before 2.4.121. It did not consider the HTTP PUT method when trying to block a brute-force series of invalid requests...

CVE-2020-8892

CVE-2020-8892 affects MISP prior to 2.4.121. The root cause is that the HTTP PUT method was not considered when blocking a brute-force series of invalid requests. CVSS scores indicate a high impact (3.1: 8.1) with network attack vector; substantial confidentiality, integrity, and availability imp...

Unspecified vulnerability in MISP (CNVD-2020-16092)

MISP is an open source software solution. The product is used to collect, store, distribute and share cybersecurity metrics and has features such as threat cybersecurity event analysis and malware analysis. A security vulnerability exists in MISP versions prior to 2.4.121, which stems from the...

PT-2020-20355 · Misp · Misp

Name of the Vulnerable Software and Affected Versions: MISP versions prior to 2.4.121 Description: An issue was discovered where ACLs for discussion threads were mishandled in the ThreadsController.php and Thread.php files. Recommendations: For versions prior to 2.4.121, update to version 2.4.121...

CVE-2020-8893

An issue was discovered in MISP before 2.4.121. The Galaxy view contained an incorrectly sanitized search string in app/View/Galaxies/view.ctp...

CVE-2020-8894

An issue was discovered in MISP before 2.4.121. ACLs for discussion threads were mishandled in app/Controller/ThreadsController.php and app/Model/Thread.php...

PT-2020-20354 · Misp · Misp

Name of the Vulnerable Software and Affected Versions: MISP versions prior to 2.4.121 Description: An issue was discovered in the Galaxy view, where an incorrectly sanitized search string was found in app/View/Galaxies/view.ctp. Recommendations: For versions prior to 2.4.121, update to version...

CVE-2020-8894

CVE-2020-8894 concerns MISP before 2.4.121, where ACLs for discussion threads were mishandled in the code paths of ThreadsController.php and Thread.php. The vulnerability arises from improper access control logic, enabling potential permission misconfigurations or exposure of thread discussions d...

CVE-2020-8893

CVE-2020-8893 affects MISP prior to 2.4.121. The issue is in the Galaxy view (file: app/View/Galaxies/view.ctp) where a search string was not properly sanitized, enabling improper handling of input. Impact is described in the sources as a vulnerability in the Galaxy search functionality; explicit...

CVE-2020-3837

creationtimestamp| type| source ---|---|--- 2020-02-10 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/48035 2022-06-24 19:34:31+00:00| seen| https://t.me/truesecator/3099 2023-06-14 21:10:04+00:00| seen| MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123 2023-12-04 15:09:00+00:00| seen|...

CVE-2019-18988

creationtimestamp| type| source ---|---|--- 2020-02-07 15:33:38+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/post/windows/gather/credentials/teamviewerpasswords.rb 2020-02-21 03:55:25+00:00| exploited| https://t.me/informationsecuritychannel/35219 2021-11-08...

CVE-2018-19320

creationtimestamp| type| source ---|---|--- 2020-02-07 13:20:11+00:00| seen| MISP/5e3d62c3-cc10-494e-b305-4c270a3b4631 2023-06-14 21:10:03+00:00| seen| MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123 2023-12-03 21:29:24+00:00| seen| https://t.me/arpsyndicate/1033 2024-12-24 20:33:18+00:00| seen|...

CVE-2020-3118

creationtimestamp| type| source ---|---|--- 2020-02-07 11:05:23+00:00| seen| https://t.me/icscert/234 2020-02-07 11:05:26+00:00| seen| https://t.me/icscert/232 2020-02-07 15:05:07+00:00| seen|...

CVE-2017-8750

creationtimestamp| type| source ---|---|--- 2020-02-07 07:05:41+00:00| seen| https://t.me/isn3ws/34 2020-10-09 16:01:51+00:00| seen| MISP/0264baf8-cabb-4965-b54d-a793c07d93f8...

CVE-2019-15975

creationtimestamp| type| source ---|---|--- 2020-02-06 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/48018 2021-06-24 16:07:15+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/networking/ciscodcnmauthbypass.rb 2024-03-19...