Filtered by vendor Misp-project
Subscribe
Total
121 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2019-11814 | 1 Misp-project | 1 Misp | 2026-06-22 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in app/webroot/js/misp.js in MISP before 2.4.107. There is persistent XSS via image names in titles, as demonstrated by a screenshot. | |||||
| CVE-2024-25675 | 1 Misp-project | 1 Misp | 2026-06-22 | N/A | 9.8 CRITICAL |
| An issue was discovered in MISP before 2.4.184. A client does not need to use POST to start an export generation process. This is related to app/Controller/JobsController.php and app/View/Events/export.ctp. | |||||
| CVE-2026-10856 | 1 Misp-project | 1 Misp | 2026-06-22 | N/A | 6.1 MEDIUM |
| A URL validation flaw in the MISP dashboard button widget allowed a crafted relative-looking URL to be accepted as a local path while being interpreted by browsers as an external URL. The validation rejected URLs containing an explicit scheme, host, or user component, but did not reject paths beginning with a slash followed by a backslash, such as /\example.com. Some browsers normalize backslashes in URLs as forward slashes, which can turn this into a scheme-relative external navigation target. In addition, the generated href concatenated the reconstructed URL with the original URL, increasing the possibility of unsafe or malformed link generation. An attacker able to configure or influence a dashboard button URL could craft a button that appears to point inside the application but redirects users to an attacker-controlled site when clicked. This could be used for phishing, credential theft, or social engineering. The patch fixes the issue by rejecting empty paths and paths starting with /\, and by emitting only the reconstructed validated URL in the anchor href. | |||||
| CVE-2020-28043 | 1 Misp-project | 1 Misp | 2026-06-22 | 5.0 MEDIUM | 7.5 HIGH |
| MISP through 2.4.133 allows SSRF in the REST client via the use_full_path parameter with an arbitrary URL. | |||||
| CVE-2026-44380 | 1 Misp-project | 1 Misp | 2026-06-22 | N/A | 7.2 HIGH |
| MISP is an open source threat intelligence and sharing platform. Prior to 2.5.37, an improper access control vulnerability in the authentication key reset functionality allowed an authenticated organization administrator to reset authentication keys belonging to site administrator accounts within the same organization. Because non-site administrators were not explicitly prevented from accessing or resetting site administrator auth keys, an attacker with organization administrator privileges could potentially obtain a newly generated auth key for a higher-privileged account and use it to escalate privileges. This vulnerability is fixed in 2.5.37. | |||||
| CVE-2026-10863 | 1 Misp-project | 1 Misp | 2026-06-22 | N/A | 8.1 HIGH |
| A security issue was fixed in the correlations over-correlation endpoint where the order query parameter was accepted from user-controlled named request parameters. This allowed an authenticated user to override the server-defined ordering of over-correlating values. Depending on how the value was processed by the underlying data access layer, this could allow manipulation of database query ordering and potentially expose the application to unsafe query construction. The patch removes order from the set of request-controlled parameters and instead sets the ordering server-side to occurrence desc after processing allowed user parameters. Affected component: app/Controller/CorrelationsController.php, overCorrelations() Security impact: An authenticated attacker could influence the ordering clause used by the over-correlations query. The direct impact appears limited to query manipulation unless further evidence confirms SQL injection or unauthorized data exposure through the manipulated ordering expression. | |||||
| CVE-2018-11562 | 1 Misp-project | 1 Misp | 2026-06-22 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in MISP 2.4.91. A vulnerability in app/View/Elements/eventattribute.ctp allows reflected XSS if a user clicks on a malicious link for an event view and then clicks on the deleted attributes quick filter. | |||||
| CVE-2026-10861 | 1 Misp-project | 1 Misp | 2026-06-22 | N/A | 6.1 MEDIUM |
| An open redirect vulnerability existed in MISP UsersController::routeafterlogin() because the value stored in the pre_login_requested_url session key was used as the post-login redirect destination without sufficiently enforcing that it was a local application path. An unauthenticated remote attacker could craft a link that causes a victim to visit a trusted MISP instance and, after successful authentication, be redirected to an attacker-controlled external URL. This could be abused to increase the credibility of phishing attacks, redirect users to counterfeit login pages, or deliver attacker-controlled content from an untrusted domain. CWE-601 describes this weakness as accepting user-controlled input that specifies an external link and using it in a redirect, with phishing as a common consequence. The patch mitigates the issue by decoding and parsing the URL, rejecting URLs with a scheme, host, user component, missing or non-local path, and protocol-relative forms such as //example.com and /\example.com. | |||||
| CVE-2020-28947 | 1 Misp-project | 1 Misp | 2026-06-22 | 4.3 MEDIUM | 6.1 MEDIUM |
| In MISP 2.4.134, XSS exists in the template element index view because the id parameter is mishandled. | |||||
| CVE-2022-29533 | 1 Misp-project | 1 Misp | 2026-06-22 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in MISP before 2.4.158. There is XSS in app/Controller/OrganisationsController.php in a situation with a "weird single checkbox page." | |||||
| CVE-2024-57969 | 1 Misp-project | 1 Misp | 2026-06-22 | N/A | 4.3 MEDIUM |
| app/Model/Attribute.php in MISP before 2.4.198 ignores an ACL during a GUI attribute search. | |||||
| CVE-2020-10247 | 1 Misp-project | 1 Misp | 2026-06-22 | 4.3 MEDIUM | 6.1 MEDIUM |
| MISP 2.4.122 has Persistent XSS in the sighting popover tool. This is related to app/View/Elements/Events/View/sighting_field.ctp. | |||||
| CVE-2024-46918 | 1 Misp-project | 1 Misp | 2026-06-22 | N/A | 4.9 MEDIUM |
| app/Controller/UserLoginProfilesController.php in MISP before 2.4.198 does not prevent an org admin from viewing sensitive login fields of another org admin in the same org. | |||||
| CVE-2023-24028 | 1 Misp-project | 1 Misp | 2026-06-17 | N/A | 9.8 CRITICAL |
| In MISP 2.4.167, app/Controller/Component/ACLComponent.php has incorrect access control for the decaying import function. | |||||
| CVE-2023-24026 | 1 Misp-project | 1 Misp | 2026-06-17 | N/A | 6.1 MEDIUM |
| In MISP 2.4.167, app/webroot/js/event-graph.js has an XSS vulnerability via an event-graph preview payload. | |||||
| CVE-2018-8949 | 1 Misp-project | 1 Misp | 2026-06-17 | 5.5 MEDIUM | 4.3 MEDIUM |
| An issue was discovered in app/Model/Attribute.php in MISP before 2.4.89. There is a critical API integrity bug, potentially allowing users to delete attributes of other events. A crafted edit for an event (without attribute UUIDs but attribute IDs set) could overwrite an existing attribute. | |||||
| CVE-2018-8948 | 1 Misp-project | 1 Misp | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| In MISP before 2.4.89, app/View/Events/resolved_attributes.ctp has multiple XSS issues via a malicious MISP module. | |||||
| CVE-2018-11245 | 1 Misp-project | 1 Misp | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| app/webroot/js/misp.js in MISP 2.4.91 has a DOM based XSS with cortex type attributes. | |||||
| CVE-2017-16802 | 1 Misp-project | 1 Misp | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| In the sharingGroupPopulateOrganisations function in app/webroot/js/misp.js in MISP 2.4.82, there is XSS via a crafted organisation name that is manually added. | |||||
| CVE-2017-15216 | 1 Misp-project | 1 Misp | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| MISP before 2.4.81 has a potential reflected XSS in a quickDelete action that is used to delete a sighting, related to app/View/Sightings/ajax/quickDeleteConfirmationForm.ctp and app/webroot/js/misp.js. | |||||