Product:

Misp

(Misp\-Project)
Repositories https://github.com/MISP/MISP
#Vulnerabilities 8
Date Id Summary Products Score Patch Annotated
2023-01-20 CVE-2023-24026 In MISP 2.4.167, app/webroot/js/event-graph.js has an XSS vulnerability via an event-graph preview payload. Misp 6.1
2023-01-20 CVE-2023-24028 In MISP 2.4.167, app/Controller/Component/ACLComponent.php has incorrect access control for the decaying import function. Misp 9.8
2018-05-18 CVE-2018-11245 app/webroot/js/misp.js in MISP 2.4.91 has a DOM based XSS with cortex type attributes. Misp 6.1
2018-03-23 CVE-2018-8949 An issue was discovered in app/Model/Attribute.php in MISP before 2.4.89. There is a critical API integrity bug, potentially allowing users to delete attributes of other events. A crafted edit for an event (without attribute UUIDs but attribute IDs set) could overwrite an existing attribute. Misp 4.3
2018-03-23 CVE-2018-8948 In MISP before 2.4.89, app/View/Events/resolved_attributes.ctp has multiple XSS issues via a malicious MISP module. Misp 6.1
2017-11-13 CVE-2017-16802 In the sharingGroupPopulateOrganisations function in app/webroot/js/misp.js in MISP 2.4.82, there is XSS via a crafted organisation name that is manually added. Misp 5.4
2017-10-10 CVE-2017-15216 MISP before 2.4.81 has a potential reflected XSS in a quickDelete action that is used to delete a sighting, related to app/View/Sightings/ajax/quickDeleteConfirmationForm.ctp and app/webroot/js/misp.js. Misp 6.1
2017-09-12 CVE-2017-14337 When MISP before 2.4.80 is configured with X.509 certificate authentication (CertAuth) in conjunction with a non-MISP external user management ReST API, if an external user provides X.509 certificate authentication and this API returns an empty value, the unauthenticated user can be granted access as an arbitrary user. Misp 8.1