OTP bypass via plugin-based LDAP authentication in MISP when LDAP mixed authentication is enabled

MISP LDAP and LinOTP Authentication Bypass via Empty or Invalid Credentials

In MISP before 2.4.187, __uploadLogo in app/Controller/OrganisationsController.php does not properly check for a valid logo upload

In MISP before 2.4.187, add_misp_export in app/Controller/EventsController.php does not properly check for a valid file upload

An issue was discovered in MISP before 2.4.184

LDAP injection in MISP ApacheAuthenticate when using a user-controlled Apache environment variable

MISP Core: Mass Assignment and Object Re-ownership via Unvalidated Request Fields

MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Period

MISP LdapAuth and LinOTPAuth Authentication Bypass via Empty or Non-String Credentials

MISP Insufficient Outbound URL Validation Allows SSRF and Credential Disclosure via Feed Redirects and TAXII Discovery

MISP CurlClient TLS Peer Verification Disabled by Default Enables Man-in-the-Middle Attacks

MISP user edit endpoint mass assignment vulnerability allows unauthorized user account modification

In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path