CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 18/03/2023 |
| CVE-2023-28606 | 中危6.1 | js/event-graph.js in MISP before 2.4.169 allows XSS via event-graph node tooltips. | 18/03/2023 |
| CVE-2022-48329 | 严重9.8 | MISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/Model/Workflow.php, and app/Plugin/Assets/models/behaviors/LogableBehavior.php. | 20/02/2023 |
| CVE-2022-48328 | 严重9.8 | app/Controller/Component/IndexFilterComponent.php in MISP before 2.4.167 mishandles ordered_url_params and additional_delimiters. | 20/02/2023 |
| CVE-2023-24070 | 中危6.1 | app/View/AuthKeys/authkey_display.ctp in MISP through 2.4.167 has an XSS in authkey add via a Referer field. | 23/01/2023 |
| CVE-2023-24028 | 严重9.8 | In MISP 2.4.167, app/Controller/Component/ACLComponent.php has incorrect access control for the decaying import function. | 20/01/2023 |
| CVE-2023-24027 | 中危6.1 | In MISP 2.4.167, app/webroot/js/action_table.js allows XSS via a network history name. | 20/01/2023 |
| CVE-2023-24026 | 中危6.1 | In MISP 2.4.167, app/webroot/js/event-graph.js has an XSS vulnerability via an event-graph preview payload. | 20/01/2023 |
| CVE-2022-47928 | 中危6.1 | In MISP before 2.4.167, there is XSS in the template file uploads in app/View/Templates/upload_file.ctp. | 22/12/2022 |
| CVE-2022-42724 | 中危4.3 | app/Controller/UsersController.php in MISP before 2.4.164 allows attackers to discover role names (this is information that only the site admin should have). | 10/10/2022 |
| CVE-2022-29534 | 高危7.5 | An issue was discovered in MISP before 2.4.158. In UsersController.php, password confirmation can be bypassed via vectors involving an "Accept: application/json" header. | 20/04/2022 |
| CVE-2022-29533 | 中危6.1 | An issue was discovered in MISP before 2.4.158. There is XSS in app/Controller/OrganisationsController.php in a situation with a "weird single checkbox page." | 20/04/2022 |
| CVE-2022-29532 | 中危4.8 | An issue was discovered in MISP before 2.4.158. There is XSS in the cerebrate view if one administrator puts a javascript: URL in the URL field, and another administrator clicks on it. | 20/04/2022 |
| CVE-2022-29531 | 中危5.4 | An issue was discovered in MISP before 2.4.158. There is stored XSS in the event graph via a tag name. | 20/04/2022 |
| CVE-2022-29530 | 中危5.4 | An issue was discovered in MISP before 2.4.158. There is stored XSS in the galaxy clusters. | 20/04/2022 |
| CVE-2022-29529 | 中危5.4 | An issue was discovered in MISP before 2.4.158. There is stored XSS via the LinOTP login field. | 20/04/2022 |
| CVE-2022-29528 | 严重9.8 | An issue was discovered in MISP before 2.4.158. PHAR deserialization can occur. | 20/04/2022 |