Search
Search Results (71 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2020-15412 | 1 Misp | 1 Misp | 2024-11-21 | 4.3 Medium |
| An issue was discovered in MISP 2.4.128. app/Controller/EventsController.php lacks an event ACL check before proceeding to allow a user to send an event contact form. | ||||
| CVE-2020-15411 | 1 Misp | 1 Misp | 2024-11-21 | 9.8 Critical |
| An issue was discovered in MISP 2.4.128. app/Controller/AttributesController.php has insufficient ACL checks in the attachment downloader. | ||||
| CVE-2020-14969 | 1 Misp | 1 Misp | 2024-11-21 | 7.5 High |
| app/Model/Attribute.php in MISP 2.4.127 lacks an ACL lookup on attribute correlations. This occurs when querying the attribute restsearch API, revealing metadata about a correlating but unreachable attribute. | ||||
| CVE-2020-13153 | 1 Misp | 1 Misp | 2024-11-21 | 6.1 Medium |
| app/View/Events/resolved_attributes.ctp in MISP before 2.4.126 has XSS in the resolved attributes view. | ||||
| CVE-2020-12889 | 1 Misp | 1 Misp-maltego | 2024-11-21 | 9.8 Critical |
| MISP MISP-maltego 1.4.4 incorrectly shares a MISP connection across users in a remote-transform use case. | ||||
| CVE-2020-11458 | 1 Misp | 1 Misp | 2024-11-21 | 4.9 Medium |
| app/Model/feed.php in MISP before 2.4.124 allows administrators to choose arbitrary files that should be ingested by MISP. This does not cause a leak of the full contents of a file, but does cause a leaks of strings that match certain patterns. Among the data that can leak are passwords from database.php or GPG key passphrases from config.php. | ||||
| CVE-2020-10247 | 1 Misp | 1 Misp | 2024-11-21 | 6.1 Medium |
| MISP 2.4.122 has Persistent XSS in the sighting popover tool. This is related to app/View/Elements/Events/View/sighting_field.ctp. | ||||
| CVE-2020-10246 | 1 Misp | 1 Misp | 2024-11-21 | 6.1 Medium |
| MISP 2.4.122 has reflected XSS via unsanitized URL parameters. This is related to app/View/Users/statistics_orgs.ctp. | ||||
| CVE-2019-19379 | 1 Misp | 1 Misp | 2024-11-21 | 5.3 Medium |
| In app/Controller/TagsController.php in MISP 2.4.118, users can bypass intended restrictions on tagging data. | ||||
| CVE-2019-16202 | 1 Misp | 1 Misp | 2024-11-21 | 6.5 Medium |
| MISP before 2.4.115 allows privilege escalation in certain situations. After updating to 2.4.115, escalation attempts are blocked by the __checkLoggedActions function with a "This could be an indication of an attempted privilege escalation on older vulnerable versions of MISP (<2.4.115)" message. | ||||
| CVE-2024-45509 | 1 Misp | 1 Misp | 2024-09-04 | 9.8 Critical |
| In MISP through 2.4.196, app/Controller/BookmarksController.php does not properly restrict access to bookmarks data in the case where the user is not an org admin. | ||||