5455 matches found
CVE-2020-29006
MISP before 2.4.135 lacks an ACL check, related to app/Controller/GalaxyElementsController.php and app/Model/GalaxyElement.php...
CVE-2020-28947
In MISP 2.4.134, XSS exists in the template element index view because the id parameter is mishandled...
CVE-2020-15411
An issue was discovered in MISP 2.4.128. app/Controller/AttributesController.php has insufficient ACL checks in the attachment downloader...
CVE-2020-15412
An issue was discovered in MISP 2.4.128. app/Controller/EventsController.php lacks an event ACL check before proceeding to allow a user to send an event contact form...
CVE-2020-13153
app/View/Events/resolvedattributes.ctp in MISP before 2.4.126 has XSS in the resolved attributes view...
CVE-2019-14286
In app/webroot/js/event-graph.js in MISP 2.4.111, a stored XSS vulnerability exists in the event-graph view when a user toggles the event graph view. A malicious MISP event must be crafted in order to trigger the vulnerability...
CVE-2018-8948
In MISP before 2.4.89, app/View/Events/resolvedattributes.ctp has multiple XSS issues via a malicious MISP module...
CVE-2019-10254
In MISP before 2.4.105, the app/View/Layouts/default.ctp default layout template has a Reflected XSS vulnerability...
CVE-2019-16202
MISP before 2.4.115 allows privilege escalation in certain situations. After updating to 2.4.115, escalation attempts are blocked by the checkLoggedActions function with a "This could be an indication of an attempted privilege escalation on older vulnerable versions of MISP 2.4.115" message...
CVE-2019-19379
In app/Controller/TagsController.php in MISP 2.4.118, users can bypass intended restrictions on tagging data...
CVE-2018-8949
An issue was discovered in app/Model/Attribute.php in MISP before 2.4.89. There is a critical API integrity bug, potentially allowing users to delete attributes of other events. A crafted edit for an event without attribute UUIDs but attribute IDs set could overwrite an existing attribute...
CVE-2018-11562
An issue was discovered in MISP 2.4.91. A vulnerability in app/View/Elements/eventattribute.ctp allows reflected XSS if a user clicks on a malicious link for an event view and then clicks on the deleted attributes quick filter...
CVE-2025-3370
creationtimestamp| type| source ---|---|--- 2025-04-07 14:45:04+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/10708 2025-04-07 17:04:06+00:00| seen| https://t.me/cvedetector/22303 2025-08-09 17:25:38+00:00| seen| MISP/a1f4de80-fff0-4971-8020-da8f70ab57ea 2025-09-10...
CVE-2025-3369
creationtimestamp| type| source ---|---|--- 2025-04-07 13:45:20+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/10697 2025-04-07 17:04:07+00:00| seen| https://t.me/cvedetector/22304 2025-08-09 17:25:38+00:00| seen| MISP/a1f4de80-fff0-4971-8020-da8f70ab57ea 2025-09-10...
CVE-2025-30368
creationtimestamp| type| source ---|---|--- 2025-03-31 19:31:09+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/9746 2025-03-31 21:43:20+00:00| seen| https://t.me/cvedetector/21638 2025-08-10 18:27:44+00:00| seen| MISP/f2f93f16-9318-44b1-9be3-2d3346ca540c 2025-09-10...
CVE-2025-3026
creationtimestamp| type| source ---|---|--- 2025-03-31 11:31:45+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/9636 2025-03-31 15:00:50+00:00| seen| https://t.me/cvedetector/21583 2025-08-10 18:27:44+00:00| seen| MISP/f2f93f16-9318-44b1-9be3-2d3346ca540c 2025-09-10 07:47:57+00:00| seen|...
CVE-2024-58129
In MISP before 2.4.193, menucustomrightlinkhtml parameters can be set via the UI i.e., without using the CLI and thus attackers with admin privileges can conduct XSS attacks against every page...
CVE-2024-58128
In MISP before 2.4.193, menucustomrightlink parameters can be set via the UI i.e., without using the CLI and thus attackers with admin privileges can conduct XSS attacks via a global menu link...
