Misp-project vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2024-25675 An issue was discovered in MISP before 2.4.184.Critical 9.8 · Feb 9, 2024
• CVE-2023-50918 app/Controller/AuditLogsController.php in MISP before 2.4.182 mishandles ACLs for audit logs.Critical 9.8 · Dec 15, 2023
• CVE-2023-48659 An issue was discovered in MISP before 2.4.176.Critical 9.8 · Nov 17, 2023
• CVE-2023-48658 An issue was discovered in MISP before 2.4.176.Critical 9.8 · Nov 17, 2023
• CVE-2023-48657 An issue was discovered in MISP before 2.4.176.Critical 9.8 · Nov 17, 2023
• CVE-2023-48656 An issue was discovered in MISP before 2.4.176.Critical 9.8 · Nov 17, 2023
• CVE-2023-48655 An issue was discovered in MISP before 2.4.176.Critical 9.8 · Nov 17, 2023
• CVE-2023-37306 MISP 2.4.172 mishandles different certificate file extensions in server sync.High 7.5 · Jun 30, 2023
• CVE-2022-48329 MISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/Model/Workflow.php, aCritical 9.8 · Feb 19, 2023
• CVE-2022-48328 app/Controller/Component/IndexFilterComponent.php in MISP before 2.4.167 mishandles ordered_url_params and additional_delimiters.Critical 9.8 · Feb 19, 2023
• CVE-2023-24028 In MISP 2.4.167, app/Controller/Component/ACLComponent.php has incorrect access control for the decaying import function.Critical 9.8 · Jan 20, 2023
• CVE-2022-29534 An issue was discovered in MISP before 2.4.158.High 7.5 · Apr 20, 2022
• CVE-2022-29528 An issue was discovered in MISP before 2.4.158.Critical 9.8 · Apr 20, 2022
• CVE-2022-27245 An issue was discovered in MISP before 2.4.156.High 8.8 · Mar 18, 2022
• CVE-2022-27243 An issue was discovered in MISP before 2.4.156.High 7.8 · Mar 18, 2022
• CVE-2021-41326 In MISP before 2.4.148, app/Lib/Export/OpendataExport.php mishandles parameter data that is used in a shell_exec call.Critical 9.8 · Sep 17, 2021
• CVE-2021-39302 MISP 2.4.148, in certain configurations, allows SQL injection via the app/Model/Log.php $conditions['org'] value.Critical 9.8 · Aug 19, 2021
• CVE-2021-35502 app/View/Elements/genericElements/IndexTable/Fields/generic_field.ctp in MISP 2.4.144 does not sanitize certain data related to generic-template:index.Critical 9.8 · Jun 25, 2021
• CVE-2021-31780 In app/Model/MispObject.php in MISP 2.4.141, an incorrect sharing group association could lead to information disclosure on an event edit.High 7.5 · Apr 23, 2021
• CVE-2021-25323 The default setting of MISP 2.4.136 did not enable the requirements (aka require_password_confirmation) to provide the previous password when changing a passworCritical 9.1 · Jan 19, 2021
• CVE-2020-29006 MISP before 2.4.135 lacks an ACL check, related to app/Controller/GalaxyElementsController.php and app/Model/GalaxyElement.php.Critical 9.8 · Nov 24, 2020
• CVE-2020-28043 MISP through 2.4.133 allows SSRF in the REST client via the use_full_path parameter with an arbitrary URL.High 7.5 · Nov 2, 2020
• CVE-2020-25766 An issue was discovered in MISP before 2.4.132.High 7.5 · Sep 18, 2020
• CVE-2020-15711 In MISP before 2.4.129, setting a favourite homepage was not CSRF protected.High 8.8 · Jul 14, 2020
• CVE-2020-15411 An issue was discovered in MISP 2.4.128.Critical 9.8 · Jun 30, 2020