OTP bypass via plugin-based LDAP authentication in MISP when LDAP mixed authentication is enabled

MISP LDAP and LinOTP Authentication Bypass via Empty or Invalid Credentials

In MISP before 2.4.187, __uploadLogo in app/Controller/OrganisationsController.php does not properly check for a valid logo upload

In MISP before 2.4.187, add_misp_export in app/Controller/EventsController.php does not properly check for a valid file upload

An issue was discovered in MISP before 2.4.184

An issue was discovered in MISP before 2.4.184

app/Controller/AuditLogsController.php in MISP before 2.4.182 mishandles ACLs for audit logs

An issue was discovered in MISP before 2.4.176

An issue was discovered in MISP before 2.4.176

An issue was discovered in MISP before 2.4.176

An issue was discovered in MISP before 2.4.176

An issue was discovered in MISP before 2.4.176

MISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/Model/Workflow.php, and…

app/Controller/Component/IndexFilterComponent.php in MISP before 2.4.167 mishandles ordered_url_params and additional_delimiters

In MISP 2.4.167, app/Controller/Component/ACLComponent.php has incorrect access control for the decaying import function

An issue was discovered in MISP before 2.4.158

In MISP before 2.4.148, app/Lib/Export/OpendataExport.php mishandles parameter data that is used in a shell_exec call

MISP 2.4.148, in certain configurations, allows SQL injection via the app/Model/Log.php $conditions['org'] value

app/View/Elements/genericElements/IndexTable/Fields/generic_field.ctp in MISP 2.4.144 does not sanitize certain data related to generic-template:index

MISP before 2.4.135 lacks an ACL check, related to app/Controller/GalaxyElementsController.php and app/Model/GalaxyElement.php

An issue was discovered in MISP 2.4.128

An issue was discovered in app/Controller/UsersController.php in MISP 2.4.92

Malware Information Sharing Platform (MISP) before 2.3.90 allows remote attackers to conduct PHP object injection attacks via crafted serialized data, related to…

app/Controller/TemplatesController.php in Malware Information Sharing Platform (MISP) before 2.3.92 does not properly restrict filenames under the tmp/files/ directory, which has…

LDAP injection in MISP ApacheAuthenticate when using a user-controlled Apache environment variable

MISP Insufficient Outbound URL Validation Allows SSRF and Credential Disclosure via Feed Redirects and TAXII Discovery

MISP CurlClient TLS Peer Verification Disabled by Default Enables Man-in-the-Middle Attacks

The default setting of MISP 2.4.136 did not enable the requirements (aka require_password_confirmation) to provide the previous password when changing a password

In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path

MISP cullEmptyEvents CSRF Allows Irreversible Deletion of Events via GET Request

MISP AAD authentication plugin - Improper OAuth State Handling, Missing Session Rotation, Insecure Redirect URI Validation, and Log Injection

Broken access control in MISP core allows cross-organization unauthorized modification or deletion of analyst data, event reports, collections, templates, and decaying models

MISP Core: Broken access control allows instance-wide unauthorized deletion of event reports and sharing groups via bulk deletion endpoints

An issue was discovered in MISP before 2.4.156

In MISP before 2.4.129, setting a favourite homepage was not CSRF protected

An issue was discovered in MISP 2.4.9x before 2.4.99

Missing Rate Limiting in Email OTP Verification Allows Brute-Force Authentication Bypass

MISP User-controlled order parameter in correlations over-correlation endpoint

An issue was discovered in MISP before 2.4.121

When MISP before 2.4.80 is configured with X.509 certificate authentication (CertAuth) in conjunction with a non-MISP external user management ReST API, if an external user…

An issue was discovered in MISP before 2.4.156

MISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request Flooding

CSP Report Endpoint Log Flooding in MISP via Incorrect Size Limit

MISP 2.4.172 mishandles different certificate file extensions in server sync

An issue was discovered in MISP before 2.4.158

In app/Model/MispObject.php in MISP 2.4.141, an incorrect sharing group association could lead to information disclosure on an event edit

MISP through 2.4.133 allows SSRF in the REST client via the use_full_path parameter with an arbitrary URL

An issue was discovered in MISP before 2.4.132

app/Model/Attribute.php in MISP 2.4.127 lacks an ACL lookup on attribute correlations

An issue was discovered in MISP before 2.4.121