Skip to contentMisp-project vulnerabilities
Newest
- misp-project mispIn MISP 2.4.134, XSS exists in the template element index view because the id parameter is...CVE-2020-289476.1 Medium
- misp-project mispMISP through 2.4.133 allows SSRF in the REST client via the use_full_path parameter with an...CVE-2020-280437.5 High
- misp-project mispAn issue was discovered in MISP before 2.4.132. It can perform an unwanted action because of a...CVE-2020-257667.5 High
- misp-project mispIn MISP before 2.4.129, setting a favourite homepage was not CSRF protected.CVE-2020-157118.8 High
- misp-project mispAn issue was discovered in MISP 2.4.128. app/Controller/EventsController.php lacks an event ACL...CVE-2020-154124.3 Medium
- misp-project mispAn issue was discovered in MISP 2.4.128. app/Controller/AttributesController.php has insufficient...CVE-2020-154119.8 Critical
- misp-project mispapp/Model/Attribute.php in MISP 2.4.127 lacks an ACL lookup on attribute correlations. This...CVE-2020-149697.5 High
- misp-project mispapp/View/Events/resolved_attributes.ctp in MISP before 2.4.126 has XSS in the resolved attributes...CVE-2020-131536.1 Medium
- misp-project mispapp/Model/feed.php in MISP before 2.4.124 allows administrators to choose arbitrary files that...CVE-2020-114584.9 Medium
- misp-project mispMISP 2.4.122 has reflected XSS via unsanitized URL parameters. This is related to app/View/Users...CVE-2020-102466.1 Medium
- misp-project mispMISP 2.4.122 has Persistent XSS in the sighting popover tool. This is related to app/View...CVE-2020-102476.1 Medium
- misp-project mispAn issue was discovered in MISP before 2.4.121. It mishandled time skew (between the machine...CVE-2020-88905.9 Medium
- misp-project mispAn issue was discovered in MISP before 2.4.121. It did not canonicalize usernames when trying to...CVE-2020-88915.9 Medium
- misp-project mispAn issue was discovered in MISP before 2.4.121. It did not consider the HTTP PUT method when...CVE-2020-88928.1 High
- misp-project mispAn issue was discovered in MISP before 2.4.121. ACLs for discussion threads were mishandled in...CVE-2020-88946.5 Medium
- misp-project mispAn issue was discovered in MISP before 2.4.121. The Galaxy view contained an incorrectly...CVE-2020-88937.5 High
- misp-project mispIn app/Controller/TagsController.php in MISP 2.4.118, users can bypass intended restrictions on...CVE-2019-193795.3 Medium
- misp-project mispMISP before 2.4.115 allows privilege escalation in certain situations. After updating to 2.4.115,...CVE-2019-162026.5 Medium
- misp-project mispIn app/webroot/js/event-graph.js in MISP 2.4.111, a stored XSS vulnerability exists in the event...CVE-2019-142866.1 Medium
- misp-project mispapp/Model/Server.php in MISP 2.4.109 allows remote command execution by a super administrator...CVE-2019-128687.2 High
- misp-project mispAn issue was discovered in MISP 2.4.108. Organization admins could reset credentials for site...CVE-2019-127946.6 Medium
- misp-project mispAn issue was discovered in app/webroot/js/misp.js in MISP before 2.4.107. There is persistent XSS...CVE-2019-118146.1 Medium
- misp-project mispAn issue was discovered in app/View/Elements/Events/View/value_field.ctp in MISP before 2.4.107....CVE-2019-118136.1 Medium
- misp-project mispA persistent XSS issue was discovered in app/View/Helper/CommandHelper.php in MISP before 2.4.107...CVE-2019-118126.1 Medium
- misp-project mispIn MISP before 2.4.105, the app/View/Layouts/default.ctp default layout template has a Reflected...CVE-2019-102546.1 Medium
- misp-project mispIn MISP 2.4.102, an authenticated user can view sightings that they should not be eligible for....CVE-2019-94825.3 Medium
- misp-project mispAn issue was discovered in MISP 2.4.9x before 2.4.99. In app/Model/Event.php (the STIX 1 import...CVE-2018-19908Public exploitEPSS 17.3%8.8 High
- misp-project mispAn issue was discovered in app/Controller/UsersController.php in MISP 2.4.92. An adversary can...CVE-2018-126499.8 Critical
- misp-project mispAn issue was discovered in MISP 2.4.91. A vulnerability in app/View/Elements/eventattribute.ctp...CVE-2018-115626.1 Medium
- misp-project mispapp/webroot/js/misp.js in MISP 2.4.91 has a DOM based XSS with cortex type attributes.CVE-2018-112456.1 Medium
- misp-project mispAn issue was discovered in app/Model/Attribute.php in MISP before 2.4.89. There is a critical API...CVE-2018-89494.3 Medium
- misp-project mispIn MISP before 2.4.89, app/View/Events/resolved_attributes.ctp has multiple XSS issues via a...CVE-2018-89486.1 Medium
- misp-project mispIn app/Controller/ServersController.php in MISP 2.4.87, a server setting permitted the override...CVE-2018-69267.2 High
- misp-project mispThe admin_edit function in app/Controller/UsersController.php in MISP 2.4.82 mishandles the...CVE-2017-169464.9 Medium
- misp-project mispIn the sharingGroupPopulateOrganisations function in app/webroot/js/misp.js in MISP 2.4.82, there...CVE-2017-168025.4 Medium
- misp-project mispMISP before 2.4.81 has a potential reflected XSS in a quickDelete action that is used to delete a...CVE-2017-152166.1 Medium
- misp-project mispWhen MISP before 2.4.80 is configured with X.509 certificate authentication (CertAuth) in...CVE-2017-143378.1 High
- misp-project mispapp/View/Helper/CommandHelper.php in MISP before 2.4.79 has persistent XSS via comments. It only...CVE-2017-136716.1 Medium
- misp-project mispMalware Information Sharing Platform (MISP) before 2.3.90 allows remote attackers to conduct PHP...CVE-2015-57219.8 Critical
- misp-project mispMultiple cross-site scripting (XSS) vulnerabilities in the template-creation feature in Malware...CVE-2015-57206.1 Medium
- misp-project mispapp/Controller/TemplatesController.php in Malware Information Sharing Platform (MISP) before 2.3...CVE-2015-57199.8 Critical