Threats affecting pkg:github/misp/MISP

25 threats

Severity	CVSS	Signals	Threat	Source	Published
Medium	6.1	EPSS 0.2%	CVE-2024-54674MISP · Cross-site Scripting Medium6.1EPSS 0.2%2024-12-04CVE Database V5CVE-2024-54674 app/View/GalaxyClusters/cluster_export_misp_galaxy.ctp in MISP through 2.5.2 has stored XSS when exporting custom clusters into the misp-galaxy format. EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2024-12-04
Critical	9.8	EPSS 0.4%	CVE-2024-45509MISP · Improper Access Control Critical9.8EPSS 0.4%2024-09-01CVE Database V5CVE-2024-45509 In MISP through 2.4.196, app/Controller/BookmarksController.php does not properly restrict access to bookmarks data in the case where the user is not an org admin. EPSS 0.4%Vulnerability CWE-284	CVE Database V5	2024-09-01
Critical	9.8	EPSS 0.8%	CVE-2024-29859MISP · Unrestricted File Upload Critical9.8EPSS 0.8%2024-03-21CVE Database V5CVE-2024-29859 In MISP before 2.4.187, add_misp_export in app/Controller/EventsController.php does not properly check for a valid file upload. EPSS 0.8%Vulnerability CWE-434	CVE Database V5	2024-03-21
Critical	9.8	EPSS 0.4%	CVE-2024-29858MISP · PHP Critical9.8EPSS 0.4%2024-03-21CVE Database V5CVE-2024-29858 In MISP before 2.4.187, __uploadLogo in app/Controller/OrganisationsController.php does not properly check for a valid logo upload. EPSS 0.4%Vulnerability CWE-616	CVE Database V5	2024-03-21
Critical	9.8	EPSS 0.8%	CVE-2024-25674MISP · Unrestricted File Upload Critical9.8EPSS 0.8%2024-02-09CVE Database V5CVE-2024-25674 An issue was discovered in MISP before 2.4.184. Organisation logo upload is insecure because of a lack of checks for the file extension and MIME type. EPSS 0.8%Vulnerability CWE-434	CVE Database V5	2024-02-09

Page 2 of 2