Misp-Project
Page 2 of 2 — Misp-Project CVEs from a corpus of 141, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-28947 | Medium | 6.1 | 2020-11-19 | In MISP 2.4.134, XSS exists in the template element index view because the id parameter is mishandled. |
CVE-2020-28043 | High | 7.5 | 2020-11-02 | MISP through 2.4.133 allows SSRF in the REST client via the use_full_path parameter with an arbitrary URL. |
CVE-2020-25766 | High | 7.5 | 2020-09-18 | An issue was discovered in MISP before 2.4.132. It can perform an unwanted action because of a POST operation on a form that is not linked to the login page. |
CVE-2020-15711 | High | 8.8 | 2020-07-14 | In MISP before 2.4.129, setting a favourite homepage was not CSRF protected. |
CVE-2020-15412 | Medium | 4.3 | 2020-06-30 | An issue was discovered in MISP 2.4.128. app/Controller/EventsController.php lacks an event ACL check before proceeding to allow a user to send an event contac… |
CVE-2020-15411 | Critical | 9.8 | 2020-06-30 | An issue was discovered in MISP 2.4.128. app/Controller/AttributesController.php has insufficient ACL checks in the attachment downloader. |
CVE-2020-14969 | High | 7.5 | 2020-06-22 | app/Model/Attribute.php in MISP 2.4.127 lacks an ACL lookup on attribute correlations. This occurs when querying the attribute restsearch API, revealing metada… |
CVE-2020-13153 | Medium | 6.1 | 2020-05-18 | app/View/Events/resolved_attributes.ctp in MISP before 2.4.126 has XSS in the resolved attributes view. |
CVE-2020-11458 | Medium | 4.9 | 2020-04-02 | app/Model/feed.php in MISP before 2.4.124 allows administrators to choose arbitrary files that should be ingested by MISP. This does not cause a leak of the fu… |
CVE-2020-10247 | Medium | 6.1 | 2020-03-09 | MISP 2.4.122 has Persistent XSS in the sighting popover tool. This is related to app/View/Elements/Events/View/sighting_field.ctp. |
CVE-2020-10246 | Medium | 6.1 | 2020-03-09 | MISP 2.4.122 has reflected XSS via unsanitized URL parameters. This is related to app/View/Users/statistics_orgs.ctp. |
CVE-2020-8894 | Medium | 6.5 | 2020-02-12 | An issue was discovered in MISP before 2.4.121. ACLs for discussion threads were mishandled in app/Controller/ThreadsController.php and app/Model/Thread.php. |
CVE-2020-8893 | High | 7.5 | 2020-02-12 | An issue was discovered in MISP before 2.4.121. The Galaxy view contained an incorrectly sanitized search string in app/View/Galaxies/view.ctp. |
CVE-2020-8892 | High | 8.1 | 2020-02-12 | An issue was discovered in MISP before 2.4.121. It did not consider the HTTP PUT method when trying to block a brute-force series of invalid requests. |
CVE-2020-8891 | Medium | 5.9 | 2020-02-12 | An issue was discovered in MISP before 2.4.121. It did not canonicalize usernames when trying to block a brute-force series of invalid requests. |
CVE-2020-8890 | Medium | 5.9 | 2020-02-12 | An issue was discovered in MISP before 2.4.121. It mishandled time skew (between the machine hosting the web server and the machine hosting the database) when… |
CVE-2019-19379 | Medium | 5.3 | 2019-11-28 | In app/Controller/TagsController.php in MISP 2.4.118, users can bypass intended restrictions on tagging data. |
CVE-2019-16202 | Medium | 6.5 | 2019-09-10 | MISP before 2.4.115 allows privilege escalation in certain situations. After updating to 2.4.115, escalation attempts are blocked by the __checkLoggedActions f… |
CVE-2019-14286 | Medium | 6.1 | 2019-07-27 | In app/webroot/js/event-graph.js in MISP 2.4.111, a stored XSS vulnerability exists in the event-graph view when a user toggles the event graph view. A malicio… |
CVE-2019-12868 | High | 7.2 | 2019-06-18 | app/Model/Server.php in MISP 2.4.109 allows remote command execution by a super administrator because the PHP file_exists function is used with user-controlled… |
CVE-2019-12794 | Medium | 6.6 | 2019-06-11 | An issue was discovered in MISP 2.4.108. Organization admins could reset credentials for site admins (organization admins have the inherent ability to reset pa… |
CVE-2019-11814 | Medium | 6.1 | 2019-05-08 | An issue was discovered in app/webroot/js/misp.js in MISP before 2.4.107. There is persistent XSS via image names in titles, as demonstrated by a screenshot. |
CVE-2019-11813 | Medium | 6.1 | 2019-05-08 | An issue was discovered in app/View/Elements/Events/View/value_field.ctp in MISP before 2.4.107. There is persistent XSS via link type attributes with javascri… |
CVE-2019-11812 | Medium | 6.1 | 2019-05-08 | A persistent XSS issue was discovered in app/View/Helper/CommandHelper.php in MISP before 2.4.107. JavaScript can be included in the discussion interface, and… |
CVE-2019-10254 | Medium | 6.1 | 2019-03-28 | In MISP before 2.4.105, the app/View/Layouts/default.ctp default layout template has a Reflected XSS vulnerability. |
CVE-2019-9482 | Medium | 5.3 | 2019-03-01 | In MISP 2.4.102, an authenticated user can view sightings that they should not be eligible for. Exploiting this requires access to the event that has received… |
CVE-2018-19908 | High | 8.8 | 2018-12-06 | An issue was discovered in MISP 2.4.9x before 2.4.99. In app/Model/Event.php (the STIX 1 import code), an unescaped filename string is used to construct a shel… |
CVE-2018-12649 | Critical | 9.8 | 2018-06-22 | An issue was discovered in app/Controller/UsersController.php in MISP 2.4.92. An adversary can bypass the brute-force protection by using a PUT HTTP method ins… |
CVE-2018-11562 | Medium | 6.1 | 2018-05-30 | An issue was discovered in MISP 2.4.91. A vulnerability in app/View/Elements/eventattribute.ctp allows reflected XSS if a user clicks on a malicious link for a… |
CVE-2018-11245 | Medium | 6.1 | 2018-05-18 | app/webroot/js/misp.js in MISP 2.4.91 has a DOM based XSS with cortex type attributes. |
CVE-2018-8949 | Medium | 4.3 | 2018-03-23 | An issue was discovered in app/Model/Attribute.php in MISP before 2.4.89. There is a critical API integrity bug, potentially allowing users to delete attribute… |
CVE-2018-8948 | Medium | 6.1 | 2018-03-23 | In MISP before 2.4.89, app/View/Events/resolved_attributes.ctp has multiple XSS issues via a malicious MISP module. |
CVE-2018-6926 | High | 7.2 | 2018-02-12 | In app/Controller/ServersController.php in MISP 2.4.87, a server setting permitted the override of a path variable on certain Red Hed Enterprise Linux and Cent… |
CVE-2017-16946 | Medium | 4.9 | 2017-11-25 | The admin_edit function in app/Controller/UsersController.php in MISP 2.4.82 mishandles the enable_password field, which allows admins to discover a hashed pas… |
CVE-2017-16802 | Medium | 5.4 | 2017-11-13 | In the sharingGroupPopulateOrganisations function in app/webroot/js/misp.js in MISP 2.4.82, there is XSS via a crafted organisation name that is manually added. |
CVE-2017-15216 | Medium | 6.1 | 2017-10-10 | MISP before 2.4.81 has a potential reflected XSS in a quickDelete action that is used to delete a sighting, related to app/View/Sightings/ajax/quickDeleteConfi… |
CVE-2017-14337 | High | 8.1 | 2017-09-12 | When MISP before 2.4.80 is configured with X.509 certificate authentication (CertAuth) in conjunction with a non-MISP external user management ReST API, if an… |
CVE-2017-13671 | Medium | 6.1 | 2017-08-24 | app/View/Helper/CommandHelper.php in MISP before 2.4.79 has persistent XSS via comments. It only impacts the users of the same instance because the comment fie… |
CVE-2015-5721 | Critical | 9.8 | 2016-09-03 | Malware Information Sharing Platform (MISP) before 2.3.90 allows remote attackers to conduct PHP object injection attacks via crafted serialized data, related… |
CVE-2015-5720 | Medium | 6.1 | 2016-09-03 | Multiple cross-site scripting (XSS) vulnerabilities in the template-creation feature in Malware Information Sharing Platform (MISP) before 2.3.90 allow remote… |
CVE-2015-5719 | Critical | 9.8 | 2016-09-03 | app/Controller/TemplatesController.php in Malware Information Sharing Platform (MISP) before 2.3.92 does not properly restrict filenames under the tmp/files/ d… |