Session Fixation in MISP CustomAuth Authentication Allows Session Hijacking

An issue was discovered in MISP 2.4.108

MISP Missing Authorization in Cryptographic Key View Exposes Signing Keys from Protected Events

MISP Missing Authorization on Template File Upload Allows Authenticated Disk Exhaustion

MISP Event Template Definition Validation Bypass Allows Persistent Denial of Service

MISP CRUDComponent delete validation bypass via operator precedence error

Unauthorized ShadowAttribute modification in MISP via client-supplied identifier

In MISP through 2.4.196, app/Controller/BookmarksController.php does not properly restrict access to bookmarks data in the case where the user is not an org admin

An issue was discovered in MISP before 2.4.121

MISP before 2.4.115 allows privilege escalation in certain situations

MISP User Homepage Validation Allows Authenticated Open Redirect via Protocol-Relative URL

Reflected Cross-Site Scripting in MISP Event Filtering via taggedAttributes and galaxyAttachedAttributes Parameters

MISP post-login open redirect via pre_login_requested_url

Open redirect in MISP dashboard button widget URL handling

In app/Controller/Component/RestResponseComponent.php in MISP before 2.4.193, REST endpoints have a lack of sanitization for non-JSON responses

app/Lib/Tools/EventTimelineTool.php in MISP before 2.4.179 allows XSS in the event timeline widget

An issue was discovered in MISP 2.4.174

MISP 2.4.174 allows XSS in app/View/Events/index.ctp

In MISP 2.4.169, app/Lib/Tools/CustomPaginationTool.php allows XSS in the community index

js/event-graph.js in MISP before 2.4.169 allows XSS via event-graph node tooltips

js/event-graph.js in MISP before 2.4.169 allows XSS via the event-graph relationship tooltip

app/View/AuthKeys/authkey_display.ctp in MISP through 2.4.167 has an XSS in authkey add via a Referer field

In MISP 2.4.167, app/webroot/js/event-graph.js has an XSS vulnerability via an event-graph preview payload

In MISP 2.4.167, app/webroot/js/action_table.js allows XSS via a network history name

In MISP before 2.4.167, there is XSS in the template file uploads in app/View/Templates/upload_file.ctp

An issue was discovered in MISP before 2.4.158

An issue was discovered in MISP before 2.4.156

app/View/SharingGroups/view.ctp in MISP before 2.4.146 allows stored XSS in the sharing groups view

A cross-site scripting (XSS) vulnerability exists in MISP v2.4.128 in app/Controller/UserSettingsController.php at SetHomePage() function

MISP 2.4.136 has XSS via a crafted URL to the app/View/Elements/global_menu.ctp user homepage favourite button

MISP 2.4.136 has XSS via galaxy cluster element values to app/View/GalaxyElements/ajax/index.ctp

MISP 2.4.136 has Stored XSS in the galaxy cluster view via a cluster name to app/View/GalaxyClusters/view.ctp

app/View/Elements/genericElements/SingleViews/Fields/genericField.ctp in MISP 2.4.135 has XSS via the authkey comment field

In MISP 2.4.134, XSS exists in the template element index view because the id parameter is mishandled

app/View/Events/resolved_attributes.ctp in MISP before 2.4.126 has XSS in the resolved attributes view

MISP 2.4.122 has Persistent XSS in the sighting popover tool

MISP 2.4.122 has reflected XSS via unsanitized URL parameters

In app/webroot/js/event-graph.js in MISP 2.4.111, a stored XSS vulnerability exists in the event-graph view when a user toggles the event graph view

An issue was discovered in app/webroot/js/misp.js in MISP before 2.4.107

An issue was discovered in app/View/Elements/Events/View/value_field.ctp in MISP before 2.4.107

A persistent XSS issue was discovered in app/View/Helper/CommandHelper.php in MISP before 2.4.107

In MISP before 2.4.105, the app/View/Layouts/default.ctp default layout template has a Reflected XSS vulnerability

An issue was discovered in MISP 2.4.91

app/webroot/js/misp.js in MISP 2.4.91 has a DOM based XSS with cortex type attributes

In MISP before 2.4.89, app/View/Events/resolved_attributes.ctp has multiple XSS issues via a malicious MISP module

MISP before 2.4.81 has a potential reflected XSS in a quickDelete action that is used to delete a sighting, related to app/View/Sightings/ajax/quickDeleteConfirmationForm.ctp and…

app/View/Helper/CommandHelper.php in MISP before 2.4.79 has persistent XSS via comments

Cross site scripting in some view elements in the index filter tool in app/webroot/js/misp2.4.68.js and the organisation landing page in…

Multiple cross-site scripting (XSS) vulnerabilities in the template-creation feature in Malware Information Sharing Platform (MISP) before 2.3.90 allow remote attackers to inject…

An issue was discovered in MISP before 2.4.121