Misp-Project

MISP allowed an authenticated site administrator to set the Kafka_rdkafka_config setting to an arbitrary filesystem path

MISP allowed a site administrator to configure an arbitrary filesystem path for the NDJSON error log used by JsonLogTool

The Azure Active Directory (AAD) authentication implementation contained multiple weaknesses in its OAuth 2.0 authorizat

MISP core contained multiple broken access-control flaws where authorization checks were performed against the wrong ent

MISP Core contained broken access-control checks in the bulk deletion flows for Event Reports and Sharing Groups. The af

A vulnerability in the MISP dashboard widgets allowed an authenticated user to manipulate the fields option and influenc

A security issue was fixed in the correlations over-correlation endpoint where the order query parameter was accepted fr

A logic error in the MISP CRUD component delete handler allowed validation failures to be bypassed when requests used th

An open redirect vulnerability existed in MISP UsersController::routeafterlogin() because the value stored in the pre_lo

A URL validation flaw in the MISP dashboard button widget allowed a crafted relative-looking URL to be accepted as a loc

An authorization flaw existed in the MISP Event Template Importer overwrite workflow. When importing an event template i

A visibility control issue in the event template creation workflow allowed non-site-admin users to access private galaxi

An authentication bypass vulnerability exists in MISP when LDAP mixed authentication is enabled with OTP enforcement. In

The CSP report endpoint in MISP intended to limit logged CSP reports to 1 KB but incorrectly allowed reports up to 1 MB

A vulnerability was identified in the ShadowAttribute proposal creation workflow. The add action accepted user-controlle

MISP is an open source threat intelligence and sharing platform. Prior to 2.5.37, a SQL injection vulnerability existed

MISP is an open source threat intelligence and sharing platform. Prior to 2.5.37, an improper access control vulnerabili

MISP is an open source threat intelligence and sharing platform. Prior to 2.5.37, MISP Collections did not enforce RFC 4

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in misp allows

MISP is an open source threat intelligence and sharing platform. Prior to 2.5.36, improper neutralization of special ele