Misp-project

Records141All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical31CVSS 9.0–10.0

CVSS high32CVSS 7.0–8.9

Exploited now

Misp-project records in CISA KEV

No Misp-project vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Misp 141 records HIGH

Records

141 records in Misp · all components

TI-2022-23942 CVE-2022-48328 · GHSA-2pq9-cj9c-6vgr

app/Controller/Component/IndexFilterComponent.php in MISP before 2.4.167 mishandles…

HIGH 82

app/Controller/Component/IndexFilterComponent.php in MISP before 2.4.167 mishandles ordered_url_params and additional_delimiters.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01298 Published 2023-02-20 No fix listed CWE-755

TI-2025-41517 CVE-2025-67906 · GHSA-x84j-v2j2-g9v8

In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path.

HIGH 72

In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path.

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.00329 Published 2025-12-15 Fixed in 2.5.28 CWE-79

TI-2023-18936 CVE-2023-37306 · GHSA-c2c7-4gw8-mr7w

MISP 2.4.172 mishandles different certificate file extensions in server sync.

HIGH 72

MISP 2.4.172 mishandles different certificate file extensions in server sync.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00531 Published 2023-06-30 No fix listed CWE-209

TI-2018-14106 CVE-2018-19908 · GHSA-2g5q-p9pf-crp5

An issue was discovered in MISP 2.4.9x before 2.4.99.

MEDIUM 55

An issue was discovered in MISP 2.4.9x before 2.4.99.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.17295 Published 2018-12-06 No fix listed CWE-78

TI-2023-26503 CVE-2023-48656 · GHSA-5w2x-5q25-hmvp

An issue was discovered in MISP before 2.4.176.

MEDIUM 51

An issue was discovered in MISP before 2.4.176.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00915 Published 2023-11-17 No fix listed

TI-2023-26502 CVE-2023-48655 · GHSA-gq45-c76q-q33j

An issue was discovered in MISP before 2.4.176.

MEDIUM 51

An issue was discovered in MISP before 2.4.176.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00915 Published 2023-11-17 No fix listed CWE-116

TI-2022-23943 CVE-2022-48329 · GHSA-65hj-59g8-fjjc

MISP before 2.4.166 unsafely allows users to use the order parameter, related to…

MEDIUM 51

MISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/Model/Workflow.php, and app/Plugin/Assets/models/behaviors/LogableBehavior.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00937 Published 2023-02-20 No fix listed CWE-755

TI-2024-19631 CVE-2024-29859 · GHSA-g52c-2cj5-jgxg

In MISP before 2.4.187, add_misp_export in app/Controller/EventsController.php does not…

MEDIUM 50

In MISP before 2.4.187, add_misp_export in app/Controller/EventsController.php does not properly check for a valid file upload.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00823 Published 2024-03-21 No fix listed CWE-434

TI-2024-16893 CVE-2024-25675 · GHSA-rprw-7v7r-h7jp

An issue was discovered in MISP before 2.4.184.

MEDIUM 50

An issue was discovered in MISP before 2.4.184.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00824 Published 2024-02-09 No fix listed CWE-749

TI-2024-16892 CVE-2024-25674 · GHSA-wj6j-6g37-7vch

An issue was discovered in MISP before 2.4.184.

MEDIUM 50

An issue was discovered in MISP before 2.4.184.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00775 Published 2024-02-09 No fix listed CWE-434

TI-2023-09812 CVE-2023-24028 · GHSA-2p25-c5jm-68vm

In MISP 2.4.167, app/Controller/Component/ACLComponent.php has incorrect access control…

MEDIUM 50

In MISP 2.4.167, app/Controller/Component/ACLComponent.php has incorrect access control for the decaying import function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00721 Published 2023-01-20 No fix listed CWE-284

TI-2024-31324 CVE-2024-46918 · GHSA-m62g-7v8j-3fwc

app/Controller/UserLoginProfilesController.php in MISP before 2.4.198 does not prevent an…

MEDIUM 49

app/Controller/UserLoginProfilesController.php in MISP before 2.4.198 does not prevent an org admin from viewing sensitive login fields of another org admin in the same org.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0044 Published 2024-09-15 No fix listed CWE-863

TI-2024-30544 CVE-2024-45509 · GHSA-9478-fw83-f763

In MISP through 2.4.196, app/Controller/BookmarksController.php does not properly…

MEDIUM 49

In MISP through 2.4.196, app/Controller/BookmarksController.php does not properly restrict access to bookmarks data in the case where the user is not an org admin.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00398 Published 2024-09-01 No fix listed CWE-284

TI-2024-19630 CVE-2024-29858 · GHSA-ppjv-38xc-pvpx

In MISP before 2.4.187, __uploadLogo in app/Controller/OrganisationsController.php does…

MEDIUM 49

In MISP before 2.4.187, __uploadLogo in app/Controller/OrganisationsController.php does not properly check for a valid logo upload.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00384 Published 2024-03-21 No fix listed CWE-616

TI-2015-04822 CVE-2015-5721 · GHSA-xf83-mpmg-c458

Malware Information Sharing Platform (MISP) before 2.3.90 allows remote attackers to…

MEDIUM 47

Malware Information Sharing Platform (MISP) before 2.3.90 allows remote attackers to conduct PHP object injection attacks via crafted serialized data, related to TemplatesController.php and populate_event_from_template_a…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02632 Published 2016-09-03 No fix listed CWE-94

TI-2022-11987 CVE-2022-29528 · GHSA-r8f5-5368-56m3

An issue was discovered in MISP before 2.4.158.

MEDIUM 46

An issue was discovered in MISP before 2.4.158.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0219 Published 2022-04-20 No fix listed CWE-502

TI-2021-18153 CVE-2021-41326 · GHSA-w27x-wj47-p6m7

In MISP before 2.4.148, app/Lib/Export/OpendataExport.php mishandles parameter data that is used in a shell_exec call.

MEDIUM 46

In MISP before 2.4.148, app/Lib/Export/OpendataExport.php mishandles parameter data that is used in a shell_exec call.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01795 Published 2021-09-17 No fix listed

TI-2015-04820 CVE-2015-5719 · GHSA-9vqr-hvpr-j7r6

app/Controller/TemplatesController.php in Malware Information Sharing Platform (MISP)…

MEDIUM 46

app/Controller/TemplatesController.php in Malware Information Sharing Platform (MISP) before 2.3.92 does not properly restrict filenames under the tmp/files/ directory, which has unspecified impact and attack vectors.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02287 Published 2016-09-03 No fix listed

TI-2020-17514 CVE-2020-29006 · GHSA-wmf5-gp42-gq5m

MISP before 2.4.135 lacks an ACL check, related to…

MEDIUM 45

MISP before 2.4.135 lacks an ACL check, related to app/Controller/GalaxyElementsController.php and app/Model/GalaxyElement.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01257 Published 2020-11-24 No fix listed CWE-862

TI-2020-12148 CVE-2020-15411 · GHSA-jjx3-pqc8-56r8

An issue was discovered in MISP 2.4.128.

MEDIUM 45

An issue was discovered in MISP 2.4.128.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01461 Published 2020-06-30 No fix listed

TI-2018-09079 CVE-2018-12649 · GHSA-c6gr-mfc7-q7h7

An issue was discovered in app/Controller/UsersController.php in MISP 2.4.92.

MEDIUM 45

An issue was discovered in app/Controller/UsersController.php in MISP 2.4.92.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01468 Published 2018-06-22 No fix listed CWE-307

TI-2026-59159 CVE-2026-86452 · GHSA-6crc-w8rh-cr5w

MISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request Flooding

MEDIUM 44

Affected versions of MISP permit unauthenticated or weakly constrained request paths to perform persistent work without adequate input bounds or rate limiting.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00542 Published 2026-09-07 No fix listed CWE-400

TI-2026-58541 CVE-2026-85216 · GHSA-5jpw-fjj6-5gr7

MISP LDAP and LinOTP Authentication Bypass via Empty or Invalid Credentials

MEDIUM 44

MISP contains an authentication bypass vulnerability in its LDAP and LinOTP authentication components due to insufficient validation of user-supplied credentials.