Misp-Project Misp vulnerabilities

CVE-2021-37534 [MEDIUM] CWE-79 CVE-2021-37534: app/View/GalaxyClusters/add.ctp in MISP 2.4.146 allows Stored XSS when forking a galaxy cluster. app/View/GalaxyClusters/add.ctp in MISP 2.4.146 allows Stored XSS when forking a galaxy cluster.

CVE-2017-16946 [MEDIUM] CWE-532 CVE-2017-16946: The admin_edit function in app/Controller/UsersController.php in MISP 2.4.82 mishandles the enable_p The admin_edit function in app/Controller/UsersController.php in MISP 2.4.82 mishandles the enable_password field, which allows admins to discover a hashed password by reading the audit log.

CVE-2026-10864 [MEDIUM] CWE-200 CVE-2026-10864: A vulnerability in the MISP dashboard widgets allowed an authenticated user to manipulate the fields A vulnerability in the MISP dashboard widgets allowed an authenticated user to manipulate the fields option and influence which fields were returned by the New Users and New Organisations widgets. In some cases, requesting a field set that became empty after validation or redaction could cause the underlying query to fall back to returning unintende

CVE-2017-13671 [MEDIUM] CWE-79 CVE-2017-13671: app/View/Helper/CommandHelper.php in MISP before 2.4.79 has persistent XSS via comments. It only imp app/View/Helper/CommandHelper.php in MISP before 2.4.79 has persistent XSS via comments. It only impacts the users of the same instance because the comment field is not part of the MISP synchronisation.

CVE-2020-28947 [MEDIUM] CWE-79 CVE-2020-28947: In MISP 2.4.134, XSS exists in the template element index view because the id parameter is mishandle In MISP 2.4.134, XSS exists in the template element index view because the id parameter is mishandled.

CVE-2022-29533 [MEDIUM] CWE-79 CVE-2022-29533: An issue was discovered in MISP before 2.4.158. There is XSS in app/Controller/OrganisationsControll An issue was discovered in MISP before 2.4.158. There is XSS in app/Controller/OrganisationsController.php in a situation with a "weird single checkbox page."

CVE-2020-29572 [MEDIUM] CWE-79 CVE-2020-29572: app/View/Elements/genericElements/SingleViews/Fields/genericField.ctp in MISP 2.4.135 has XSS via th app/View/Elements/genericElements/SingleViews/Fields/genericField.ctp in MISP 2.4.135 has XSS via the authkey comment field.

CVE-2022-27246 [MEDIUM] CWE-79 CVE-2022-27246: An issue was discovered in MISP before 2.4.156. An SVG org logo (which may contain JavaScript) is no An issue was discovered in MISP before 2.4.156. An SVG org logo (which may contain JavaScript) is not forbidden by default.

CVE-2022-47928 [MEDIUM] CWE-79 CVE-2022-47928: In MISP before 2.4.167, there is XSS in the template file uploads in app/View/Templates/upload_file. In MISP before 2.4.167, there is XSS in the template file uploads in app/View/Templates/upload_file.ctp.

CVE-2023-28884 [MEDIUM] CWE-79 CVE-2023-28884: In MISP 2.4.169, app/Lib/Tools/CustomPaginationTool.php allows XSS in the community index. In MISP 2.4.169, app/Lib/Tools/CustomPaginationTool.php allows XSS in the community index.

CVE-2023-24027 [MEDIUM] CWE-79 CVE-2023-24027: In MISP 2.4.167, app/webroot/js/action_table.js allows XSS via a network history name. In MISP 2.4.167, app/webroot/js/action_table.js allows XSS via a network history name.

CVE-2021-37743 [MEDIUM] CWE-79 CVE-2021-37743: app/View/GalaxyElements/ajax/index.ctp in MISP 2.4.147 allows Stored XSS when viewing galaxy cluster app/View/GalaxyElements/ajax/index.ctp in MISP 2.4.147 allows Stored XSS when viewing galaxy cluster elements in JSON format.

CVE-2024-46918 [MEDIUM] CWE-863 CVE-2024-46918: app/Controller/UserLoginProfilesController.php in MISP before 2.4.198 does not prevent an org admin app/Controller/UserLoginProfilesController.php in MISP before 2.4.198 does not prevent an org admin from viewing sensitive login fields of another org admin in the same org.

CVE-2026-10854 [MEDIUM] CWE-200 CVE-2026-10854: A visibility control issue in the event template creation workflow allowed non-site-admin users to a A visibility control issue in the event template creation workflow allowed non-site-admin users to access private galaxies belonging to other organisations. The event template builder loaded all enabled galaxies without applying organisation or distribution-based access restrictions, potentially exposing private galaxy metadata such as galaxy type a

CVE-2019-10254 [MEDIUM] CWE-79 CVE-2019-10254: In MISP before 2.4.105, the app/View/Layouts/default.ctp default layout template has a Reflected XSS In MISP before 2.4.105, the app/View/Layouts/default.ctp default layout template has a Reflected XSS vulnerability.

CVE-2020-13153 [MEDIUM] CWE-79 CVE-2020-13153: app/View/Events/resolved_attributes.ctp in MISP before 2.4.126 has XSS in the resolved attributes vi app/View/Events/resolved_attributes.ctp in MISP before 2.4.126 has XSS in the resolved attributes view.

CVE-2020-10247 [MEDIUM] CWE-79 CVE-2020-10247: MISP 2.4.122 has Persistent XSS in the sighting popover tool. This is related to app/View/Elements/E MISP 2.4.122 has Persistent XSS in the sighting popover tool. This is related to app/View/Elements/Events/View/sighting_field.ctp.

CVE-2019-11812 [MEDIUM] CWE-79 CVE-2019-11812: A persistent XSS issue was discovered in app/View/Helper/CommandHelper.php in MISP before 2.4.107. J A persistent XSS issue was discovered in app/View/Helper/CommandHelper.php in MISP before 2.4.107. JavaScript can be included in the discussion interface, and can be triggered by clicking on the link.

CVE-2019-11814 [MEDIUM] CWE-79 CVE-2019-11814: An issue was discovered in app/webroot/js/misp.js in MISP before 2.4.107. There is persistent XSS vi An issue was discovered in app/webroot/js/misp.js in MISP before 2.4.107. There is persistent XSS via image names in titles, as demonstrated by a screenshot.

CVE-2018-11562 [MEDIUM] CWE-79 CVE-2018-11562: An issue was discovered in MISP 2.4.91. A vulnerability in app/View/Elements/eventattribute.ctp allo An issue was discovered in MISP 2.4.91. A vulnerability in app/View/Elements/eventattribute.ctp allows reflected XSS if a user clicks on a malicious link for an event view and then clicks on the deleted attributes quick filter.