Misp
Products
8- 145 CVEs
- 17 CVEs
- 1 CVE
- 1 CVE
- 1 CVE
- 1 CVE
- 1 CVE
- 0 CVEs
Recent CVEs
165| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-29859 | Cri | 0.64 | 9.8 | 0.01 | Mar 21, 2024 | In MISP before 2.4.187, add_misp_export in app/Controller/EventsController.php does not properly check for a valid file upload. | ||
| CVE-2024-29858 | Cri | 0.64 | 9.8 | 0.00 | Mar 21, 2024 | In MISP before 2.4.187, __uploadLogo in app/Controller/OrganisationsController.php does not properly check for a valid logo upload. | ||
| CVE-2024-25675 | Cri | 0.64 | 9.8 | 0.01 | Feb 9, 2024 | An issue was discovered in MISP before 2.4.184. A client does not need to use POST to start an export generation process. This is related to app/Controller/JobsController.php and app/View/Events/export.ctp. | ||
| CVE-2024-25674 | Cri | 0.64 | 9.8 | 0.01 | Feb 9, 2024 | An issue was discovered in MISP before 2.4.184. Organisation logo upload is insecure because of a lack of checks for the file extension and MIME type. | ||
| CVE-2023-50918 | Cri | 0.64 | 9.8 | 0.01 | Dec 15, 2023 | app/Controller/AuditLogsController.php in MISP before 2.4.182 mishandles ACLs for audit logs. | ||
| CVE-2023-48659 | Cri | 0.64 | 9.8 | 0.01 | Nov 17, 2023 | An issue was discovered in MISP before 2.4.176. app/Controller/AppController.php mishandles parameter parsing. | ||
| CVE-2023-48658 | Cri | 0.64 | 9.8 | 0.01 | Nov 17, 2023 | An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php lacks a checkParam function for alphanumerics, underscore, dash, period, and space. | ||
| CVE-2023-48657 | Cri | 0.64 | 9.8 | 0.01 | Nov 17, 2023 | An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php mishandles filters. | ||
| CVE-2023-48656 | Cri | 0.64 | 9.8 | 0.01 | Nov 17, 2023 | An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php mishandles order clauses. | ||
| CVE-2023-48655 | Cri | 0.64 | 9.8 | 0.01 | Nov 17, 2023 | An issue was discovered in MISP before 2.4.176. app/Controller/Component/IndexFilterComponent.php does not properly filter out query parameters. | ||
| CVE-2022-48329 | Cri | 0.64 | 9.8 | 0.01 | Feb 20, 2023 | MISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/Model/Workflow.php, and app/Plugin/Assets/models/behaviors/LogableBehavior.php. | ||
| CVE-2022-48328 | Cri | 0.64 | 9.8 | 0.01 | Feb 20, 2023 | app/Controller/Component/IndexFilterComponent.php in MISP before 2.4.167 mishandles ordered_url_params and additional_delimiters. | ||
| CVE-2022-29528 | Cri | 0.64 | 9.8 | 0.02 | Apr 20, 2022 | An issue was discovered in MISP before 2.4.158. PHAR deserialization can occur. | ||
| CVE-2021-41326 | Cri | 0.64 | 9.8 | 0.02 | Sep 17, 2021 | In MISP before 2.4.148, app/Lib/Export/OpendataExport.php mishandles parameter data that is used in a shell_exec call. | ||
| CVE-2021-39302 | Cri | 0.64 | 9.8 | 0.01 | Aug 19, 2021 | MISP 2.4.148, in certain configurations, allows SQL injection via the app/Model/Log.php $conditions['org'] value. | ||
| CVE-2021-35502 | Cri | 0.64 | 9.8 | 0.01 | Jun 25, 2021 | app/View/Elements/genericElements/IndexTable/Fields/generic_field.ctp in MISP 2.4.144 does not sanitize certain data related to generic-template:index. | ||
| CVE-2020-29006 | Cri | 0.64 | 9.8 | 0.01 | Nov 24, 2020 | MISP before 2.4.135 lacks an ACL check, related to app/Controller/GalaxyElementsController.php and app/Model/GalaxyElement.php. | ||
| CVE-2020-15411 | Cri | 0.64 | 9.8 | 0.01 | Jun 30, 2020 | An issue was discovered in MISP 2.4.128. app/Controller/AttributesController.php has insufficient ACL checks in the attachment downloader. | ||
| CVE-2018-12649 | Cri | 0.64 | 9.8 | 0.01 | Jun 22, 2018 | An issue was discovered in app/Controller/UsersController.php in MISP 2.4.92. An adversary can bypass the brute-force protection by using a PUT HTTP method instead of a POST HTTP method in the login part, because this protection was only covering POST requests. | ||
| CVE-2018-19908 | Hig | 0.62 | 8.8 | 0.17 | Dec 6, 2018 | An issue was discovered in MISP 2.4.9x before 2.4.99. In app/Model/Event.php (the STIX 1 import code), an unescaped filename string is used to construct a shell command. This vulnerability can be abused by a malicious authenticated user to execute arbitrary commands by tweaking… |
- risk 0.64cvss 9.8epss 0.01
In MISP before 2.4.187, add_misp_export in app/Controller/EventsController.php does not properly check for a valid file upload.
- risk 0.64cvss 9.8epss 0.00
In MISP before 2.4.187, __uploadLogo in app/Controller/OrganisationsController.php does not properly check for a valid logo upload.
- risk 0.64cvss 9.8epss 0.01
An issue was discovered in MISP before 2.4.184. A client does not need to use POST to start an export generation process. This is related to app/Controller/JobsController.php and app/View/Events/export.ctp.
- risk 0.64cvss 9.8epss 0.01
An issue was discovered in MISP before 2.4.184. Organisation logo upload is insecure because of a lack of checks for the file extension and MIME type.
- risk 0.64cvss 9.8epss 0.01
app/Controller/AuditLogsController.php in MISP before 2.4.182 mishandles ACLs for audit logs.
- risk 0.64cvss 9.8epss 0.01
An issue was discovered in MISP before 2.4.176. app/Controller/AppController.php mishandles parameter parsing.
- risk 0.64cvss 9.8epss 0.01
An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php lacks a checkParam function for alphanumerics, underscore, dash, period, and space.
- risk 0.64cvss 9.8epss 0.01
An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php mishandles filters.
- risk 0.64cvss 9.8epss 0.01
An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php mishandles order clauses.
- risk 0.64cvss 9.8epss 0.01
An issue was discovered in MISP before 2.4.176. app/Controller/Component/IndexFilterComponent.php does not properly filter out query parameters.
- risk 0.64cvss 9.8epss 0.01
MISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/Model/Workflow.php, and app/Plugin/Assets/models/behaviors/LogableBehavior.php.
- risk 0.64cvss 9.8epss 0.01
app/Controller/Component/IndexFilterComponent.php in MISP before 2.4.167 mishandles ordered_url_params and additional_delimiters.
- risk 0.64cvss 9.8epss 0.02
An issue was discovered in MISP before 2.4.158. PHAR deserialization can occur.
- risk 0.64cvss 9.8epss 0.02
In MISP before 2.4.148, app/Lib/Export/OpendataExport.php mishandles parameter data that is used in a shell_exec call.
- risk 0.64cvss 9.8epss 0.01
MISP 2.4.148, in certain configurations, allows SQL injection via the app/Model/Log.php $conditions['org'] value.
- risk 0.64cvss 9.8epss 0.01
app/View/Elements/genericElements/IndexTable/Fields/generic_field.ctp in MISP 2.4.144 does not sanitize certain data related to generic-template:index.
- risk 0.64cvss 9.8epss 0.01
MISP before 2.4.135 lacks an ACL check, related to app/Controller/GalaxyElementsController.php and app/Model/GalaxyElement.php.
- risk 0.64cvss 9.8epss 0.01
An issue was discovered in MISP 2.4.128. app/Controller/AttributesController.php has insufficient ACL checks in the attachment downloader.
- risk 0.64cvss 9.8epss 0.01
An issue was discovered in app/Controller/UsersController.php in MISP 2.4.92. An adversary can bypass the brute-force protection by using a PUT HTTP method instead of a POST HTTP method in the login part, because this protection was only covering POST requests.
- risk 0.62cvss 8.8epss 0.17
An issue was discovered in MISP 2.4.9x before 2.4.99. In app/Model/Event.php (the STIX 1 import code), an unescaped filename string is used to construct a shell command. This vulnerability can be abused by a malicious authenticated user to execute arbitrary commands by tweaking…