Filtered by vendor Misp Subscriptions
Filtered by product Misp Subscriptions
Total 152 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-39962 2 Misp, Misp-project 2 Misp, Misp 2026-04-23 9.6 Critical
MISP is an open source threat intelligence and sharing platform. Prior to 2.5.36, improper neutralization of special elements in an LDAP query in ApacheAuthenticate.php allows LDAP injection via an unsanitized username value when ApacheAuthenticate.apacheEnv is configured to use a user-controlled server variable instead of REMOTE_USER (such as in certain proxy setups). An attacker able to control that value can manipulate the LDAP search filter and potentially bypass authentication constraints or cause unauthorized LDAP queries. This vulnerability is fixed in 2.5.36.
CVE-2024-54674 1 Misp 1 Misp 2026-04-15 6.1 Medium
app/View/GalaxyClusters/cluster_export_misp_galaxy.ctp in MISP through 2.5.2 has stored XSS when exporting custom clusters into the misp-galaxy format.
CVE-2025-66384 1 Misp 1 Misp 2026-04-15 8.2 High
app/Controller/EventsController.php in MISP before 2.5.24 has invalid logic in checking for uploaded file validity, related to tmp_name.
CVE-2024-54675 1 Misp 1 Misp 2026-04-15 6.1 Medium
app/webroot/js/workflows-editor/workflows-editor.js in MISP through 2.5.2 has stored XSS in the editor interface for an ad-hoc workflow.
CVE-2025-66386 1 Misp 1 Misp 2026-04-15 4.1 Medium
app/Model/EventReport.php in MISP before 2.5.27 allows path traversal in view picture for a site-admin.
CVE-2025-67906 2 Misp, Misp-project 2 Misp, Misp 2025-12-21 5.4 Medium
In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path.
CVE-2024-29858 2 Misp, Misp-project 2 Misp, Misp 2025-06-17 9.8 Critical
In MISP before 2.4.187, __uploadLogo in app/Controller/OrganisationsController.php does not properly check for a valid logo upload.
CVE-2024-46918 2 Misp, Misp-project 2 Misp, Misp 2025-03-13 9.8 Critical
app/Controller/UserLoginProfilesController.php in MISP before 2.4.198 does not prevent an org admin from viewing sensitive login fields of another org admin in the same org.
CVE-2022-48328 1 Misp 1 Misp 2024-11-27 9.8 Critical
app/Controller/Component/IndexFilterComponent.php in MISP before 2.4.167 mishandles ordered_url_params and additional_delimiters.
CVE-2024-29859 2 Misp, Misp-project 2 Misp, Misp 2024-11-21 9.8 Critical
In MISP before 2.4.187, add_misp_export in app/Controller/EventsController.php does not properly check for a valid file upload.
CVE-2022-27243 1 Misp 1 Misp 2024-11-21 7.8 High
An issue was discovered in MISP before 2.4.156. app/View/Users/terms.ctp allows Local File Inclusion via the custom terms file setting.
CVE-2024-45509 2 Misp, Misp-project 2 Misp, Misp 2024-09-04 9.8 Critical
In MISP through 2.4.196, app/Controller/BookmarksController.php does not properly restrict access to bookmarks data in the case where the user is not an org admin.