10 matches found
CVE-2026-90893 MISP UserSettingsController CSRF Protection Bypass on setTheme, setHomePage, and eventIndexColumnToggle Endpoints
MISP contains a Cross-Site Request Forgery CSRF vulnerability in the UserSettingsController. The actions setTheme, setHomePage, and eventIndexColumnToggle were explicitly added to the Security component's unlockedActions list, which disabled all CSRF validation both token and field-hash checks fo...
CVE-2026-90893 MISP UserSettingsController CSRF Protection Bypass on setTheme, setHomePage, and eventIndexColumnToggle Endpoints
MISP contains a Cross-Site Request Forgery CSRF vulnerability in the UserSettingsController. The actions setTheme, setHomePage, and eventIndexColumnToggle were explicitly added to the Security component's unlockedActions list, which disabled all CSRF validation both token and field-hash checks fo...
EUVD-2026-77341
MISP contains a Cross-Site Request Forgery CSRF vulnerability in the UserSettingsController. The actions setTheme, setHomePage, and eventIndexColumnToggle were explicitly added to the Security component's unlockedActions list, which disabled all CSRF validation both token and field-hash checks fo...
CVE-2026-90893: Cross-Site Request Forgery (CSRF)
MISP contains a Cross-Site Request Forgery CSRF vulnerability in the UserSettingsController. The actions setTheme, setHomePage, and eventIndexColumnToggle were explicitly added to the Security component's unlockedActions list, which disabled all CSRF validation both token and field-hash checks fo...
CVE-2026-54393: Improper Neutralization of Input During Web Page Generation
A stored cross-site scripting vulnerability exists in MISP when the Overmind theme is used. The setHomePage endpoint previously saved the user-controlled path value through setSettingInternal, bypassing the normal setSetting validation logic, including validatehomepage, which requires homepage...
Cross site scripting
A cross-site scripting XSS vulnerability exists in MISP v2.4.128 in app/Controller/UserSettingsController.php at SetHomePage function. Due to a lack of controller validation in "path" parameter, an attacker can execute malicious JavaScript code...
CVE-2020-24085
A cross-site scripting XSS vulnerability exists in MISP v2.4.128 in app/Controller/UserSettingsController.php at SetHomePage function. Due to a lack of controller validation in "path" parameter, an attacker can execute malicious JavaScript code...
NtlmRelayToEWS - Ntlm Relay Attack To Exchange Web Services
ntlmRelayToEWS is a tool for performing ntlm relay attacks on Exchange Web Services EWS. It spawns an SMBListener on port 445 and an HTTPListener on port 80, waiting for incoming connection from the victim. Once the victim connects to one of the listeners, an NTLM negociation occurs and is relaye...
CVE-2009-3944
This CVE concerns the BlackBerry Browser on the BlackBerry 8800. It describes a remotely triggerable denial of service caused by a JavaScript loop that configures the home page via the setHomePage method and a DHTML behavior property. The statement implies the vulnerability arises from how the pa...
