MISP.

Stored Cross-Site Scripting via Unescaped Galaxy Cluster Tag Names in MISP Default Theme Galaxies Index

• MISP
• Cross-site scripting (XSS)

Stored Cross-Site Scripting in MISP Galaxy Matrix Statistics via Unescaped Galaxy Name

• MISP
• Cross-site scripting (XSS)

MISP Overmind: Stored Cross-Site Scripting via Unescaped Object Names in Statistics Legends

• misp
• Cross-site scripting (XSS)

MISP Background Job Argument Injection via Console Path Switches Enables Remote Code Execution

• misp
• Other injection
• CWE-20

MISP Unthrottled Authentication Failure Log Writes Enable Resource Exhaustion

• MISP
• Denial of service

MISP: Authentication failure logging suppressed during Redis unavailability

• MISP
• CWE-778

MISP Access Log Entry Overwritten by Error Controller's Second beforeFilter Pass

• MISP
• CWE-223
• CWE-778

MISP: State-changing actions accessible via GET request enabling CSRF

• MISP
• Cross-site request forgery (CSRF)

MISP Dashboard Template ACL Bypass Due to VARCHAR-to-Integer Type Coercion in Permission Flag Comparison

• MISP
• Broken access control
• CWE-697

MISP Collection Element Add Missing Authorization on Referenced Object UUID

• MISP
• Broken access control

MISP: Missing Authorization Check for Event Sharing Group When Distribution Field Is Omitted During Edit

• MISP
• Broken access control

MISP: HTTP Method Override Bypasses CSRF and Form Validation in BetterSecurityComponent

• MISP
• Cross-site request forgery (CSRF)
• CWE-20

MISP LdapAuth and LinOTPAuth Authentication Bypass via Empty or Non-String Credentials

• MISP
• Authentication bypass
• CWE-20

MISP: Stored XSS via Inline-Served SVG Organisation Logos and Report Pictures

• MISP
• Cross-site scripting (XSS)
• CWE-693

MISP CLI Shell Audit Logs Lose User Identity and CLI Marker After First Lazy Model Load

• MISP
• CWE-223
• CWE-778

MISP Interactive CLI Shell: Authorization Bypass, Credential Exposure, and Terminal Injection

• MISP
• Information disclosure
• Hard-coded credentials

MISP UserSettingsController CSRF Protection Bypass on setTheme, setHomePage, and eventIndexColumnToggle Endpoints

• MISP
• Cross-site request forgery (CSRF)

MISP: Unescaped HTML Injection in PDF Report Element Rendering

• MISP
• Cross-site scripting (XSS)
• CWE-116

MISP Event Template Instantiation Bypasses Sharing Group and Tagging Authorization

• MISP
• Broken access control

MISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request Flooding

• MISP
• Denial of service

MISP Event Graph Object Reference Lookup Exposes References from Unauthorized Objects

• MISP
• Broken access control

MISP Dashboard Organisation Widgets Bypass Organisation-Index Restrictions and Expose Hidden Organisation Data

• MISP
• Information disclosure
• Broken access control

MISP Dashboard Button Widget Allows Stored XSS via Unsafe javascript: and Backslash URLs

• MISP
• Cross-site scripting (XSS)
• CWE-20

MISP Insufficient Outbound URL Validation Allows SSRF and Credential Disclosure via Feed Redirects and TAXII Discovery

• MISP
• Information disclosure
• Server-side request forgery (SSRF)

MISP Dashboard Organisation Picker Exposes Hidden Organisation Metadata to Unauthorized Users

• MISP
• Information disclosure
• Broken access control

MISP Dashboard Template REST API Exposes Template Owner Email Addresses to Unauthorized Users

• MISP
• Information disclosure
• Broken access control

MISP Missing Authorization in Cryptographic Key View Exposes Signing Keys from Protected Events

• MISP
• Broken access control

MISP User Homepage Validation Allows Authenticated Open Redirect via Protocol-Relative URL

• MISP
• Open redirect
• CWE-20

MISP Missing Authorization on Template File Upload Allows Authenticated Disk Exhaustion

• MISP
• Denial of service
• Broken access control

MISP Freetext Feed Preview Improper Authorization Exposes Restricted Event and Feed Information

• MISP
• Broken access control

MISP UiBeta Collection View Bypasses Event ACL, Exposing Unauthorized Event Data

• MISP
• Broken access control

Cross-Site Request Forgery via Attacker-Controlled REST Detection in MISP

• misp
• Cross-site request forgery (CSRF)

MISP Sharing Group Quick-Edit Actions Allow CSRF via State-Changing GET Requests

• misp
• Cross-site request forgery (CSRF)

MISP Attribute Deletion Authorization Bypass Allows Users Without Modify Permissions to Delete Attributes

• misp
• Broken access control

MISP Sharing Group Authorization Bypass via Omitted Distribution Parameter

• misp
• Broken access control

MISP Event Template Definition Validation Bypass Allows Persistent Denial of Service

• misp
• CWE-20

Session Fixation in MISP CustomAuth Authentication Allows Session Hijacking

• misp
• Authentication bypass

Missing Rate Limiting in Email OTP Verification Allows Brute-Force Authentication Bypass

• misp
• Authentication bypass

MISP cullEmptyEvents CSRF Allows Irreversible Deletion of Events via GET Request

• misp
• Cross-site request forgery (CSRF)

MISP Dashboard Button Widget Allows Persistent JavaScript URL Injection

• misp
• Cross-site scripting (XSS)
• CWE-20

Reflected Cross-Site Scripting in MISP Event Filtering via taggedAttributes and galaxyAttachedAttributes Parameters

• misp
• Cross-site scripting (XSS)

MISP OnDemand Correlation Engine Missing Access Control Allows Disclosure of Restricted Correlations

• misp
• Broken access control

MISP CurlClient TLS Peer Verification Disabled by Default Enables Man-in-the-Middle Attacks

• misp
• Weak cryptography or TLS

MISP LDAP and LinOTP Authentication Bypass via Empty or Invalid Credentials

• misp
• Hard-coded credentials

Open Redirect in MISP Installer-Generated Apache Configuration

• misp
• Open redirect

MISP: Improper sharing group authorization check when adding attributes

• misp
• Broken access control

importModule function in MISP ignores per-organisation import module restrictions

• misp
• Broken access control

MISP importModule missing authorization allows read-only users to modify events via misp_standard imports

• misp
• Broken access control

MISP remote code execution via arbitrary rdkafka configuration path

• misp
• CWE-829

Authenticated Remote Code Execution via Arbitrary NDJSON Error Log Path in MISP

• misp
• Code injection

MISP AAD authentication plugin - Improper OAuth State Handling, Missing Session Rotation, Insecure Redirect URI Validation, and Log Injection

• misp
• Authentication bypass

Broken access control in MISP core allows cross-organization unauthorized modification or deletion of analyst data, event reports, collections, templates, and decaying models

• misp
• Broken access control

MISP Core: Broken access control allows instance-wide unauthorized deletion of event reports and sharing groups via bulk deletion endpoints

• misp
• Broken access control

MISP Core: Mass Assignment and Object Re-ownership via Unvalidated Request Fields

• misp
• Broken access control

MISP object edit authorization bypass allows unauthorized sharing group assignment

• misp
• Broken access control

MISP event editing allows unauthorized assignment to undisclosed sharing groups

• misp
• Broken access control

MISP AuthKey edit endpoint allows authenticated user email enumeration

• misp
• Information disclosure

MISP UiBeta event index reflected XSS in advanced filter popup

• misp
• Cross-site scripting (XSS)

MISP organisation logo path traversal allows retrieval of arbitrary PNG/SVG files

• misp
• Path traversal

MISP Overmind theme stored XSS via unvalidated homepage setting

• misp
• Cross-site scripting (XSS)