Misp
Page 3 of 3 — Misp CVEs from a corpus of 218, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-8891 | Medium | 5.9 | 2020-02-12 | An issue was discovered in MISP before 2.4.121. It did not canonicalize usernames when trying to block a brute-force series of invalid requests. |
CVE-2020-8890 | Medium | 5.9 | 2020-02-12 | An issue was discovered in MISP before 2.4.121. It mishandled time skew (between the machine hosting the web server and the machine hosting the database) when… |
CVE-2019-19379 | Medium | 5.3 | 2019-11-28 | In app/Controller/TagsController.php in MISP 2.4.118, users can bypass intended restrictions on tagging data. |
CVE-2019-16202 | Medium | 6.5 | 2019-09-10 | MISP before 2.4.115 allows privilege escalation in certain situations. After updating to 2.4.115, escalation attempts are blocked by the __checkLoggedActions f… |
CVE-2019-14286 | Medium | 6.1 | 2019-07-27 | In app/webroot/js/event-graph.js in MISP 2.4.111, a stored XSS vulnerability exists in the event-graph view when a user toggles the event graph view. A malicio… |
CVE-2019-12868 | High | 7.2 | 2019-06-18 | app/Model/Server.php in MISP 2.4.109 allows remote command execution by a super administrator because the PHP file_exists function is used with user-controlled… |
CVE-2019-12794 | Medium | 6.6 | 2019-06-11 | An issue was discovered in MISP 2.4.108. Organization admins could reset credentials for site admins (organization admins have the inherent ability to reset pa… |
CVE-2019-11814 | Medium | 6.1 | 2019-05-08 | An issue was discovered in app/webroot/js/misp.js in MISP before 2.4.107. There is persistent XSS via image names in titles, as demonstrated by a screenshot. |
CVE-2019-11813 | Medium | 6.1 | 2019-05-08 | An issue was discovered in app/View/Elements/Events/View/value_field.ctp in MISP before 2.4.107. There is persistent XSS via link type attributes with javascri… |
CVE-2019-11812 | Medium | 6.1 | 2019-05-08 | A persistent XSS issue was discovered in app/View/Helper/CommandHelper.php in MISP before 2.4.107. JavaScript can be included in the discussion interface, and… |
CVE-2019-10254 | Medium | 6.1 | 2019-03-28 | In MISP before 2.4.105, the app/View/Layouts/default.ctp default layout template has a Reflected XSS vulnerability. |
CVE-2019-9482 | Medium | 5.3 | 2019-03-01 | In MISP 2.4.102, an authenticated user can view sightings that they should not be eligible for. Exploiting this requires access to the event that has received… |
CVE-2018-19908 | High | 8.8 | 2018-12-06 | An issue was discovered in MISP 2.4.9x before 2.4.99. In app/Model/Event.php (the STIX 1 import code), an unescaped filename string is used to construct a shel… |
CVE-2018-12649 | Critical | 9.8 | 2018-06-22 | An issue was discovered in app/Controller/UsersController.php in MISP 2.4.92. An adversary can bypass the brute-force protection by using a PUT HTTP method ins… |
CVE-2018-11562 | Medium | 6.1 | 2018-05-30 | An issue was discovered in MISP 2.4.91. A vulnerability in app/View/Elements/eventattribute.ctp allows reflected XSS if a user clicks on a malicious link for a… |
CVE-2018-6926 | High | 7.2 | 2018-02-12 | In app/Controller/ServersController.php in MISP 2.4.87, a server setting permitted the override of a path variable on certain Red Hed Enterprise Linux and Cent… |
CVE-2017-16946 | Medium | 4.9 | 2017-11-25 | The admin_edit function in app/Controller/UsersController.php in MISP 2.4.82 mishandles the enable_password field, which allows admins to discover a hashed pas… |
CVE-2017-13671 | Medium | 6.1 | 2017-08-24 | app/View/Helper/CommandHelper.php in MISP before 2.4.79 has persistent XSS via comments. It only impacts the users of the same instance because the comment fie… |