Advisories · Technology
misp.
Every CVE that names misp among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.3 Medium
MISP template builder exposes non-visible custom galaxies across organisations
- misp
- Broken access control
- CVSS 8.8 High
MISP mass assignment vulnerabilities allow unauthorized modification of ownership and delegation records
- misp
- Broken access control
- CVSS 8.4 High
MISP sharing group creation mass assignment allows unauthorized takeover of existing sharing groups
- misp
- Broken access control
- CVSS 7.1 High
MISP automation endpoints may be exposed to CSRF when Sec-Fetch-Site protection is disabled by default
- misp
- Cross-site request forgery (CSRF)
- CWE-1188
- CVSS 7.5 High
MISP organization administrators can target site administrator accounts for password reset
- misp
- Broken access control
- CVSS 5.1 Medium
MISP improper authorization allows organization administrators to modify site administrator user settings
- misp
- Broken access control
- CVSS 9.0 CriticalCritical · CVSS 9+
MISP user edit endpoint mass assignment vulnerability allows unauthorized user account modification
- misp
- Privilege escalation
- CVSS 5.3 Medium
MISP Dashboard widget field selection may expose restricted user and organisation data
- misp
- Information disclosure
- CVSS 6.4 Medium
MISP User-controlled order parameter in correlations over-correlation endpoint
- misp
- CWE-20
- CVSS 7.9 High
MISP CRUDComponent delete validation bypass via operator precedence error
- misp
- Broken access control
- CVSS 5.1 Medium
MISP post-login open redirect via pre_login_requested_url
- misp
- Open redirect
- CVSS 5.1 Medium
Open redirect in MISP dashboard button widget URL handling
- misp
- Open redirect
- CVSS 5.1 Medium
MISP Event template importer authorization bypass
- misp
- Broken access control
- CVSS 5.3 Medium
Unauthorized exposure of private galaxies in MISP event template creation
- misp
- Information disclosure
- CVSS 8.2 High
OTP bypass via plugin-based LDAP authentication in MISP when LDAP mixed authentication is enabled
- misp
- Authentication bypass
- CVSS 5.1 Medium
CSP Report Endpoint Log Flooding in MISP via Incorrect Size Limit
- misp
- Denial of service
- CVSS 8.3 High
Unauthorized ShadowAttribute modification in MISP via client-supplied identifier
- misp
- Broken access control
- CVSS 6.0 Medium
MISP OIDC authentication bypass via automatic email-based account linking under insecure IdP configurations
- misp
- Authentication bypass
- CVSS 5.3 Medium
MISP: Improper UUID validation in MISP Collections
- MISP
- CWE-20
- CVSS 8.6 High
MISP: Improper access control in auth key reset allows privilege escalation to site administrator
- MISP
- Broken access control
- CVSS 9.3 CriticalCritical · CVSS 9+
MISP: SQL injection via unvalidated ordering parameters in event and shadow attribute listings
- MISP
- SQL injection
- CVSS 6.8 Medium
MISP core - Stored XSS in MISP template (old engine) element attribute type
- misp
- Cross-site scripting (XSS)
- CVSS 8.8 High
LDAP injection in MISP ApacheAuthenticate when using a user-controlled Apache environment variable
- MISP
- Other injection
- CVSS 5.4 Medium
Cross-site scripting in MISP
- MISP
- Cross-site scripting (XSS)
- CVSS 4.1 Medium
Path traversal in MISP
- MISP
- Path traversal
- CVSS 8.2 High
MISP: app/Controller/EventsController.php in MISP before 2.5.24 has invalid logic in checking…
- MISP
- CWE-684
- CVSS 7.2 High
Cross-site scripting in MISP
- MISP
- Cross-site scripting (XSS)
- CVSS 5.5 Medium
Cross-site scripting in MISP
- MISP
- Cross-site scripting (XSS)
- CVSS 5.5 Medium
Cross-site scripting in MISP
- MISP
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
Incorrect authorization in MISP
- MISP
- Broken access control