Total
121 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2019-16202 | 1 Misp-project | 1 Misp | 2026-06-22 | 4.0 MEDIUM | 6.5 MEDIUM |
| MISP before 2.4.115 allows privilege escalation in certain situations. After updating to 2.4.115, escalation attempts are blocked by the __checkLoggedActions function with a "This could be an indication of an attempted privilege escalation on older vulnerable versions of MISP (<2.4.115)" message. | |||||
| CVE-2021-39302 | 1 Misp-project | 1 Misp | 2026-06-22 | 6.8 MEDIUM | 9.8 CRITICAL |
| MISP 2.4.148, in certain configurations, allows SQL injection via the app/Model/Log.php $conditions['org'] value. | |||||
| CVE-2020-8894 | 1 Misp-project | 1 Misp | 2026-06-22 | 6.4 MEDIUM | 6.5 MEDIUM |
| An issue was discovered in MISP before 2.4.121. ACLs for discussion threads were mishandled in app/Controller/ThreadsController.php and app/Model/Thread.php. | |||||
| CVE-2019-11814 | 1 Misp-project | 1 Misp | 2026-06-22 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in app/webroot/js/misp.js in MISP before 2.4.107. There is persistent XSS via image names in titles, as demonstrated by a screenshot. | |||||
| CVE-2024-25675 | 1 Misp-project | 1 Misp | 2026-06-22 | N/A | 9.8 CRITICAL |
| An issue was discovered in MISP before 2.4.184. A client does not need to use POST to start an export generation process. This is related to app/Controller/JobsController.php and app/View/Events/export.ctp. | |||||
| CVE-2020-28043 | 1 Misp-project | 1 Misp | 2026-06-22 | 5.0 MEDIUM | 7.5 HIGH |
| MISP through 2.4.133 allows SSRF in the REST client via the use_full_path parameter with an arbitrary URL. | |||||
| CVE-2026-44380 | 1 Misp-project | 1 Misp | 2026-06-22 | N/A | 7.2 HIGH |
| MISP is an open source threat intelligence and sharing platform. Prior to 2.5.37, an improper access control vulnerability in the authentication key reset functionality allowed an authenticated organization administrator to reset authentication keys belonging to site administrator accounts within the same organization. Because non-site administrators were not explicitly prevented from accessing or resetting site administrator auth keys, an attacker with organization administrator privileges could potentially obtain a newly generated auth key for a higher-privileged account and use it to escalate privileges. This vulnerability is fixed in 2.5.37. | |||||
| CVE-2018-11562 | 1 Misp-project | 1 Misp | 2026-06-22 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in MISP 2.4.91. A vulnerability in app/View/Elements/eventattribute.ctp allows reflected XSS if a user clicks on a malicious link for an event view and then clicks on the deleted attributes quick filter. | |||||
| CVE-2020-28947 | 1 Misp-project | 1 Misp | 2026-06-22 | 4.3 MEDIUM | 6.1 MEDIUM |
| In MISP 2.4.134, XSS exists in the template element index view because the id parameter is mishandled. | |||||
| CVE-2022-29533 | 1 Misp-project | 1 Misp | 2026-06-22 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in MISP before 2.4.158. There is XSS in app/Controller/OrganisationsController.php in a situation with a "weird single checkbox page." | |||||
| CVE-2024-57969 | 1 Misp-project | 1 Misp | 2026-06-22 | N/A | 4.3 MEDIUM |
| app/Model/Attribute.php in MISP before 2.4.198 ignores an ACL during a GUI attribute search. | |||||
| CVE-2020-10247 | 1 Misp-project | 1 Misp | 2026-06-22 | 4.3 MEDIUM | 6.1 MEDIUM |
| MISP 2.4.122 has Persistent XSS in the sighting popover tool. This is related to app/View/Elements/Events/View/sighting_field.ctp. | |||||
| CVE-2024-46918 | 1 Misp-project | 1 Misp | 2026-06-22 | N/A | 4.9 MEDIUM |
| app/Controller/UserLoginProfilesController.php in MISP before 2.4.198 does not prevent an org admin from viewing sensitive login fields of another org admin in the same org. | |||||
| CVE-2023-24028 | 1 Misp-project | 1 Misp | 2026-06-17 | N/A | 9.8 CRITICAL |
| In MISP 2.4.167, app/Controller/Component/ACLComponent.php has incorrect access control for the decaying import function. | |||||
| CVE-2023-24026 | 1 Misp-project | 1 Misp | 2026-06-17 | N/A | 6.1 MEDIUM |
| In MISP 2.4.167, app/webroot/js/event-graph.js has an XSS vulnerability via an event-graph preview payload. | |||||
| CVE-2018-8949 | 1 Misp-project | 1 Misp | 2026-06-17 | 5.5 MEDIUM | 4.3 MEDIUM |
| An issue was discovered in app/Model/Attribute.php in MISP before 2.4.89. There is a critical API integrity bug, potentially allowing users to delete attributes of other events. A crafted edit for an event (without attribute UUIDs but attribute IDs set) could overwrite an existing attribute. | |||||
| CVE-2018-8948 | 1 Misp-project | 1 Misp | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| In MISP before 2.4.89, app/View/Events/resolved_attributes.ctp has multiple XSS issues via a malicious MISP module. | |||||
| CVE-2018-11245 | 1 Misp-project | 1 Misp | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| app/webroot/js/misp.js in MISP 2.4.91 has a DOM based XSS with cortex type attributes. | |||||
| CVE-2017-16802 | 1 Misp-project | 1 Misp | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| In the sharingGroupPopulateOrganisations function in app/webroot/js/misp.js in MISP 2.4.82, there is XSS via a crafted organisation name that is manually added. | |||||
| CVE-2017-15216 | 1 Misp-project | 1 Misp | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| MISP before 2.4.81 has a potential reflected XSS in a quickDelete action that is used to delete a sighting, related to app/View/Sightings/ajax/quickDeleteConfirmationForm.ctp and app/webroot/js/misp.js. | |||||