Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (197 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2020-8890 1 Misp 1 Misp 2024-11-21 5.9 Medium
An issue was discovered in MISP before 2.4.121. It mishandled time skew (between the machine hosting the web server and the machine hosting the database) when trying to block a brute-force series of invalid requests.
CVE-2020-29006 1 Misp 1 Misp 2024-11-21 9.8 Critical
MISP before 2.4.135 lacks an ACL check, related to app/Controller/GalaxyElementsController.php and app/Model/GalaxyElement.php.
CVE-2020-28947 1 Misp 1 Misp 2024-11-21 6.1 Medium
In MISP 2.4.134, XSS exists in the template element index view because the id parameter is mishandled.
CVE-2020-28043 1 Misp 1 Misp 2024-11-21 7.5 High
MISP through 2.4.133 allows SSRF in the REST client via the use_full_path parameter with an arbitrary URL.
CVE-2020-25766 1 Misp 1 Misp 2024-11-21 7.5 High
An issue was discovered in MISP before 2.4.132. It can perform an unwanted action because of a POST operation on a form that is not linked to the login page.
CVE-2020-24085 1 Misp 1 Misp 2024-11-21 6.1 Medium
A cross-site scripting (XSS) vulnerability exists in MISP v2.4.128 in app/Controller/UserSettingsController.php at SetHomePage() function. Due to a lack of controller validation in "path" parameter, an attacker can execute malicious JavaScript code.
CVE-2020-15711 1 Misp 1 Misp 2024-11-21 8.8 High
In MISP before 2.4.129, setting a favourite homepage was not CSRF protected.
CVE-2020-15412 1 Misp 1 Misp 2024-11-21 4.3 Medium
An issue was discovered in MISP 2.4.128. app/Controller/EventsController.php lacks an event ACL check before proceeding to allow a user to send an event contact form.
CVE-2020-15411 1 Misp 1 Misp 2024-11-21 9.8 Critical
An issue was discovered in MISP 2.4.128. app/Controller/AttributesController.php has insufficient ACL checks in the attachment downloader.
CVE-2020-14969 1 Misp 1 Misp 2024-11-21 7.5 High
app/Model/Attribute.php in MISP 2.4.127 lacks an ACL lookup on attribute correlations. This occurs when querying the attribute restsearch API, revealing metadata about a correlating but unreachable attribute.
CVE-2020-12889 1 Misp 1 Misp-maltego 2024-11-21 9.8 Critical
MISP MISP-maltego 1.4.4 incorrectly shares a MISP connection across users in a remote-transform use case.
CVE-2020-11458 1 Misp 1 Misp 2024-11-21 4.9 Medium
app/Model/feed.php in MISP before 2.4.124 allows administrators to choose arbitrary files that should be ingested by MISP. This does not cause a leak of the full contents of a file, but does cause a leaks of strings that match certain patterns. Among the data that can leak are passwords from database.php or GPG key passphrases from config.php.
CVE-2020-10247 1 Misp 1 Misp 2024-11-21 6.1 Medium
MISP 2.4.122 has Persistent XSS in the sighting popover tool. This is related to app/View/Elements/Events/View/sighting_field.ctp.
CVE-2020-10246 1 Misp 1 Misp 2024-11-21 6.1 Medium
MISP 2.4.122 has reflected XSS via unsanitized URL parameters. This is related to app/View/Users/statistics_orgs.ctp.
CVE-2019-19379 1 Misp 1 Misp 2024-11-21 5.3 Medium
In app/Controller/TagsController.php in MISP 2.4.118, users can bypass intended restrictions on tagging data.
CVE-2019-16202 1 Misp 1 Misp 2024-11-21 6.5 Medium
MISP before 2.4.115 allows privilege escalation in certain situations. After updating to 2.4.115, escalation attempts are blocked by the __checkLoggedActions function with a "This could be an indication of an attempted privilege escalation on older vulnerable versions of MISP (<2.4.115)" message.
CVE-2024-45509 1 Misp 1 Misp 2024-09-04 9.8 Critical
In MISP through 2.4.196, app/Controller/BookmarksController.php does not properly restrict access to bookmarks data in the case where the user is not an org admin.