Total 121 security vulnerabilities recorded for misp-project software and firmware.
app/Model/Attribute.php in MISP before 2.4.198 ignores an ACL during a GUI attribute search....
app/Controller/UserLoginProfilesController.php in MISP before 2.4.198 does not prevent an org admin from viewing sensitive login fields of another org...
In MISP through 2.4.196, app/Controller/BookmarksController.php does not properly restrict access to bookmarks data in the case where the user is not ...
In MISP before 2.4.187, add_misp_export in app/Controller/EventsController.php does not properly check for a valid file upload....
In MISP before 2.4.187, __uploadLogo in app/Controller/OrganisationsController.php does not properly check for a valid logo upload....
An issue was discovered in MISP before 2.4.184. A client does not need to use POST to start an export generation process. This is related to app/Contr...
An issue was discovered in MISP before 2.4.184. Organisation logo upload is insecure because of a lack of checks for the file extension and MIME type....
app/Controller/AuditLogsController.php in MISP before 2.4.182 mishandles ACLs for audit logs....
app/Lib/Tools/EventTimelineTool.php in MISP before 2.4.179 allows XSS in the event timeline widget....
An issue was discovered in MISP before 2.4.176. app/Controller/AppController.php mishandles parameter parsing....
An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php lacks a checkParam function for alphanumerics, underscore, dash, period, and sp...
An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php mishandles filters....
An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php mishandles order clauses....
An issue was discovered in MISP before 2.4.176. app/Controller/Component/IndexFilterComponent.php does not properly filter out query parameters....
An issue was discovered in MISP 2.4.174. In app/Controller/DashboardsController.php, a reflected XSS issue exists via the id parameter upon a dashboar...
In MISP before 2.4.172, title_for_layout is not properly sanitized in Correlations, CorrelationExclusions, and Layouts....
MISP 2.4.172 mishandles different certificate file extensions in server sync. An attacker can obtain sensitive information because of the nature of th...
In MISP 2.4.169, app/Lib/Tools/CustomPaginationTool.php allows XSS in the community index....
js/event-graph.js in MISP before 2.4.169 allows XSS via the event-graph relationship tooltip....
js/event-graph.js in MISP before 2.4.169 allows XSS via event-graph node tooltips....
MISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/Model/Workf...
app/Controller/Component/IndexFilterComponent.php in MISP before 2.4.167 mishandles ordered_url_params and additional_delimiters....
app/View/AuthKeys/authkey_display.ctp in MISP through 2.4.167 has an XSS in authkey add via a Referer field....