CVE-2021-25323

The CVE-2021-25323 issue concerns MISP version 2.4.136 where the default configuration did not require the current password (require_password_confirmation) when changing a password. Root cause: the default setting omits verification of the existing password during password changes. Impact: elevat...

CVE-2021-3184

MISP 2.4.136 is affected by a Cross-Site Scripting (XSS) vulnerability that arises from a crafted URL targeting the app/View/Elements/global_menu.ctp on the user homepage favourites button. The issue is documented across multiple sources and is confirmed by connected records describing a vulnerab...

CVE-2021-25324

CVE-2021-25324 affects MISP 2.4.136 with a Stored XSS flaw in the galaxy cluster view (app/View/GalaxyClusters/view.ctp). Root cause details are not fully disclosed in the provided documents, but the vulnerability is described by multiple sources as a cross-site scripting issue that could impact ...

CVE-2021-25325

CVE-2021-25325 affects MISP 2.4.136. It enables cross-site scripting via galaxy cluster element values sent to app/View/GalaxyElements/ajax/index.ctp, where reference types may include javascript: URLs. The issue arises from unsanitized input in galaxy elements, enabling an attacker to execute sc...