CVE-2017-16946

The adminedit function in app/Controller/UsersController.php in MISP 2.4.82 mishandles the enablepassword field, which allows admins to discover a hashed password by reading the audit log...

CVE-2017-16946

The adminedit function in app/Controller/UsersController.php in MISP 2.4.82 mishandles the enablepassword field, which allows admins to discover a hashed password by reading the audit log...

CVE-2017-16946

CVE-2017-16946 affects MISP version 2.4.82 where the admin_edit function in app/Controller/UsersController.php mishandles the enable_password field, enabling admins to read the audit log and discover a hashed password. The vulnerability description is consistently reported across multiple feeds (...

CVE-2017-16994

creationtimestamp| type| source ---|---|--- 2017-11-24 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/43178 2025-02-06 03:13:43+00:00| seen| MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd 2025-02-23 04:09:55+00:00| seen| MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd...

CVE-2017-6168

creationtimestamp| type| source ---|---|--- 2017-11-19 13:57:33+00:00| seen| https://t.me/canyoupwnme/2682 2017-11-20 13:06:20+00:00| seen| https://t.me/HackerOne/1296 2018-05-29 15:50:33+00:00| seen|...

CVE-2017-11882

creationtimestamp| type| source ---|---|--- 2017-11-15 11:11:01+00:00| exploited| https://t.me/informationsecuritychannel/11068 2017-11-15 18:56:28+00:00| seen| https://t.me/cybershit/173 2017-11-15 21:50:34+00:00| exploited| https://t.me/informationsecuritychannel/11105 2017-11-21 07:39:51+00:00...

CVE-2017-16802

In the sharingGroupPopulateOrganisations function in app/webroot/js/misp.js in MISP 2.4.82, there is XSS via a crafted organisation name that is manually added...

Design/Logic Flaw

In the sharingGroupPopulateOrganisations function in app/webroot/js/misp.js in MISP 2.4.82, there is XSS via a crafted organisation name that is manually added...

CVE-2017-16802

In the sharingGroupPopulateOrganisations function in app/webroot/js/misp.js in MISP 2.4.82, there is XSS via a crafted organisation name that is manually added...

CVE-2017-16802

The CVE concerns MISP version 2.4.82 where the function shared ingGroupPopulateOrganisations in app/webroot/js/misp.js is vulnerable to cross-site scripting (XSS). A remote attacker can inject arbitrary script via a specially crafted organisation name added to the list, exposing users to client-s...

CVE-2014-8517

creationtimestamp| type| source ---|---|--- 2017-11-03 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/43112 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/http/tnftpsavefile.rb 2025-02-06 03:13:42+00:00| seen|...

CVE-2017-14143

creationtimestamp| type| source ---|---|--- 2017-10-23 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/43028 2018-01-24 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/43876 2018-05-29 15:50:33+00:00| seen|...

CVE-2017-15222

creationtimestamp| type| source ---|---|--- 2017-10-21 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/43025 2018-01-05 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/43448 2018-05-29 15:50:33+00:00| seen|...

CVE-2017-12629

creationtimestamp| type| source ---|---|--- 2017-10-17 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/43009 2018-03-09 07:40:58+00:00| seen| MISP/5aa23875-d0dc-49d6-82a6-d309950d210f 2025-08-01 21:00:04+00:00| published-proof-of-concept|...

CVE-2017-11292

creationtimestamp| type| source ---|---|--- 2017-10-16 15:03:08+00:00| seen| MISP/59e4c923-a6e0-4894-a6a8-994d950d210f 2017-10-16 17:56:56+00:00| exploited| https://t.me/informationsecuritychannel/10023 2017-10-16 19:53:28+00:00| seen| MISP/59e50d7c-e7cc-44f6-9f15-02afac12042b 2017-10-17...

CVE-2017-11826

creationtimestamp| type| source ---|---|--- 2017-10-11 16:30:10+00:00| exploited| https://t.me/informationsecuritychannel/9851 2017-10-12 11:04:08+00:00| exploited| https://t.me/informationsecuritychannel/9892 2017-11-09 20:56:42+00:00| published-proof-of-concept| https://t.me/canyoupwnme/2608...

Cross site scripting

MISP before 2.4.81 has a potential reflected XSS in a quickDelete action that is used to delete a sighting, related to app/View/Sightings/ajax/quickDeleteConfirmationForm.ctp and app/webroot/js/misp.js...

CVE-2017-15216

MISP before 2.4.81 has a potential reflected XSS in a quickDelete action that is used to delete a sighting, related to app/View/Sightings/ajax/quickDeleteConfirmationForm.ctp and app/webroot/js/misp.js...

CVE-2017-15216

MISP before 2.4.81 has a potential reflected XSS in a quickDelete action that is used to delete a sighting, related to app/View/Sightings/ajax/quickDeleteConfirmationForm.ctp and app/webroot/js/misp.js...

CVE-2017-15216

Summary: CVE-2017-15216 is a reflected XSS vulnerability in MISP prior to version 2.4.81. The issue arises in the quickDelete action used to delete a sighting, related to the files app/View/Sightings/ajax/quickDeleteConfirmationForm.ctp and app/webroot/js/misp.js. Affected software: MISP before 2...