Misp Security Vulnerabilities

CVE-2022-48328

app/Controller/Component/IndexFilterComponent.php in MISP before 2.4.167 mishandles ordered_url_params and...

CVE-2024-25675

An issue was discovered in MISP before 2.4.184. A client does not need to use POST to start an export generation process. This is related to app/Controller/JobsController.php and...

CVE-2024-25674

An issue was discovered in MISP before 2.4.184. Organisation logo upload is insecure because of a lack of checks for the file extension and MIME...

CVE-2023-37307

In MISP before 2.4.172, title_for_layout is not properly sanitized in Correlations, CorrelationExclusions, and...

CVE-2022-29532

An issue was discovered in MISP before 2.4.158. There is XSS in the cerebrate view if one administrator puts a javascript: URL in the URL field, and another administrator clicks on...

CVE-2022-29534

An issue was discovered in MISP before 2.4.158. In UsersController.php, password confirmation can be bypassed via vectors involving an "Accept: application/json"...

CVE-2023-48658

An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php lacks a checkParam function for alphanumerics, underscore, dash, period, and...

CVE-2023-48657

An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php mishandles...

CVE-2023-48659

An issue was discovered in MISP before 2.4.176. app/Controller/AppController.php mishandles parameter...

CVE-2023-48655

An issue was discovered in MISP before 2.4.176. app/Controller/Component/IndexFilterComponent.php does not properly filter out query...

CVE-2023-48656

An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php mishandles order...

CVE-2022-47928

In MISP before 2.4.167, there is XSS in the template file uploads in...

CVE-2023-24070

app/View/AuthKeys/authkey_display.ctp in MISP through 2.4.167 has an XSS in authkey add via a Referer...

CVE-2023-28884

In MISP 2.4.169, app/Lib/Tools/CustomPaginationTool.php allows XSS in the community...

CVE-2022-29530

An issue was discovered in MISP before 2.4.158. There is stored XSS in the galaxy...

CVE-2022-29533

An issue was discovered in MISP before 2.4.158. There is XSS in app/Controller/OrganisationsController.php in a situation with a "weird single checkbox...

CVE-2022-29531

An issue was discovered in MISP before 2.4.158. There is stored XSS in the event graph via a tag...

CVE-2022-29528

An issue was discovered in MISP before 2.4.158. PHAR deserialization can...

CVE-2023-50918

app/Controller/AuditLogsController.php in MISP before 2.4.182 mishandles ACLs for audit...

CVE-2023-49926

app/Lib/Tools/EventTimelineTool.php in MISP before 2.4.179 allows XSS in the event timeline...

CVE-2023-40224

MISP 2.4.174 allows XSS in...

CVE-2022-29529

An issue was discovered in MISP before 2.4.158. There is stored XSS via the LinOTP login...

CVE-2019-12868

app/Model/Server.php in MISP 2.4.109 allows remote command execution by a super administrator because the PHP file_exists function is used with user-controlled entries, and phar:// URLs trigger...

CVE-2021-37742

app/View/Elements/GalaxyClusters/view_relation_tree.ctp in MISP 2.4.147 allows Stored XSS when viewing galaxy cluster...

CVE-2020-8894

An issue was discovered in MISP before 2.4.121. ACLs for discussion threads were mishandled in app/Controller/ThreadsController.php and...

CVE-2021-41326

In MISP before 2.4.148, app/Lib/Export/OpendataExport.php mishandles parameter data that is used in a shell_exec...

CVE-2020-8893

An issue was discovered in MISP before 2.4.121. The Galaxy view contained an incorrectly sanitized search string in...

CVE-2018-11245

app/webroot/js/misp.js in MISP 2.4.91 has a DOM based XSS with cortex type...

CVE-2023-41098

An issue was discovered in MISP 2.4.174. In app/Controller/DashboardsController.php, a reflected XSS issue exists via the id parameter upon a dashboard...

CVE-2022-42724

app/Controller/UsersController.php in MISP before 2.4.164 allows attackers to discover role names (this is information that only the site admin should...

CVE-2023-37306

MISP 2.4.172 mishandles different certificate file extensions in server sync. An attacker can obtain sensitive information because of the nature of the error...

CVE-2023-28606

js/event-graph.js in MISP before 2.4.169 allows XSS via event-graph node...

CVE-2023-28607

js/event-graph.js in MISP before 2.4.169 allows XSS via the event-graph relationship...

CVE-2020-10246

MISP 2.4.122 has reflected XSS via unsanitized URL parameters. This is related to...

CVE-2020-10247

MISP 2.4.122 has Persistent XSS in the sighting popover tool. This is related to...

CVE-2022-48329

MISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/Model/Workflow.php, and...

CVE-2023-24027

In MISP 2.4.167, app/webroot/js/action_table.js allows XSS via a network history...

CVE-2023-24028

In MISP 2.4.167, app/Controller/Component/ACLComponent.php has incorrect access control for the decaying import...

CVE-2023-24026

In MISP 2.4.167, app/webroot/js/event-graph.js has an XSS vulnerability via an event-graph preview...

CVE-2018-8949

An issue was discovered in app/Model/Attribute.php in MISP before 2.4.89. There is a critical API integrity bug, potentially allowing users to delete attributes of other events. A crafted edit for an event (without attribute UUIDs but attribute IDs set) could overwrite an existing...

CVE-2018-8948

In MISP before 2.4.89, app/View/Events/resolved_attributes.ctp has multiple XSS issues via a malicious MISP...

CVE-2018-11562

An issue was discovered in MISP 2.4.91. A vulnerability in app/View/Elements/eventattribute.ctp allows reflected XSS if a user clicks on a malicious link for an event view and then clicks on the deleted attributes quick...

CVE-2018-6926

In app/Controller/ServersController.php in MISP 2.4.87, a server setting permitted the override of a path variable on certain Red Hed Enterprise Linux and CentOS systems (where rh_shell_fix was enabled), and consequently allowed site admins to inject arbitrary OS commands. The impact is limited by....

CVE-2022-27244

An issue was discovered in MISP before 2.4.156. A malicious site administrator could store an XSS payload in the custom auth name. This would be executed each time the administrator modifies a...

CVE-2022-27243

An issue was discovered in MISP before 2.4.156. app/View/Users/terms.ctp allows Local File Inclusion via the custom terms file...

CVE-2022-27245

An issue was discovered in MISP before 2.4.156. app/Model/Server.php does not restrict generateServerSettings to the CLI. This could lead to...

CVE-2022-27246

An issue was discovered in MISP before 2.4.156. An SVG org logo (which may contain JavaScript) is not forbidden by...

CVE-2021-39302

MISP 2.4.148, in certain configurations, allows SQL injection via the app/Model/Log.php $conditions['org']...

CVE-2021-37743

app/View/GalaxyElements/ajax/index.ctp in MISP 2.4.147 allows Stored XSS when viewing galaxy cluster elements in JSON...

CVE-2021-37534

app/View/GalaxyClusters/add.ctp in MISP 2.4.146 allows Stored XSS when forking a galaxy...