Filtered by vendor Misp
Subscribe
Total
69 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2019-14286 | 1 Misp | 1 Misp | 2019-07-31 | 4.3 MEDIUM | 6.1 MEDIUM |
| In app/webroot/js/event-graph.js in MISP 2.4.111, a stored XSS vulnerability exists in the event-graph view when a user toggles the event graph view. A malicious MISP event must be crafted in order to trigger the vulnerability. | |||||
| CVE-2019-11814 | 1 Misp | 1 Misp | 2019-05-08 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in app/webroot/js/misp.js in MISP before 2.4.107. There is persistent XSS via image names in titles, as demonstrated by a screenshot. | |||||
| CVE-2019-11813 | 1 Misp | 1 Misp | 2019-05-08 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in app/View/Elements/Events/View/value_field.ctp in MISP before 2.4.107. There is persistent XSS via link type attributes with javascript:// links. | |||||
| CVE-2019-11812 | 1 Misp | 1 Misp | 2019-05-08 | 4.3 MEDIUM | 6.1 MEDIUM |
| A persistent XSS issue was discovered in app/View/Helper/CommandHelper.php in MISP before 2.4.107. JavaScript can be included in the discussion interface, and can be triggered by clicking on the link. | |||||
| CVE-2019-10254 | 1 Misp | 1 Misp | 2019-03-28 | 4.3 MEDIUM | 6.1 MEDIUM |
| In MISP before 2.4.105, the app/View/Layouts/default.ctp default layout template has a Reflected XSS vulnerability. | |||||
| CVE-2018-11562 | 1 Misp | 1 Misp | 2018-06-29 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in MISP 2.4.91. A vulnerability in app/View/Elements/eventattribute.ctp allows reflected XSS if a user clicks on a malicious link for an event view and then clicks on the deleted attributes quick filter. | |||||
| CVE-2018-6926 | 1 Misp | 1 Misp | 2018-03-16 | 9.0 HIGH | 7.2 HIGH |
| In app/Controller/ServersController.php in MISP 2.4.87, a server setting permitted the override of a path variable on certain Red Hed Enterprise Linux and CentOS systems (where rh_shell_fix was enabled), and consequently allowed site admins to inject arbitrary OS commands. The impact is limited by the setting being only accessible to the site administrator. | |||||
| CVE-2017-16946 | 1 Misp | 1 Misp | 2017-12-07 | 4.0 MEDIUM | 4.9 MEDIUM |
| The admin_edit function in app/Controller/UsersController.php in MISP 2.4.82 mishandles the enable_password field, which allows admins to discover a hashed password by reading the audit log. | |||||
| CVE-2017-13671 | 1 Misp | 1 Misp | 2017-09-05 | 4.3 MEDIUM | 6.1 MEDIUM |
| app/View/Helper/CommandHelper.php in MISP before 2.4.79 has persistent XSS via comments. It only impacts the users of the same instance because the comment field is not part of the MISP synchronisation. | |||||