Vulnerabilities

MISP contains an incomplete authorization check in the discussion posting functionality.

MISP contains a reflected cross-site scripting (XSS) vulnerability in the analyst data notes panel.

MISP contains a reflected cross-site scripting (XSS) vulnerability in the legacy taxonomy tag management confirmation forms (add tag and disable tag).

MISP contains an authorization bypass in the event flattening feature.

MISP contains a vulnerability in its two-factor authentication (TOTP) verification process that permits a valid one-time code to be accepted more than once within its time-based validity window.

MISP contains a vulnerability in its one-time password (OTP) authentication flow that allows replay of a consumed HOTP (paper) token and rewinding of the token counter.