Skip to content
Noroxi

misp-project records

141 published records for vendor misp-project.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
1
With a fix record
7.1%
Median publish → KEV
No record has entered KEV

Records by year

  1. 17
  2. 18
  3. 19
  4. 20
  5. 21
  6. 22
  7. 23
  8. 24
  9. 25
  10. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

141 records
  • CVE-2018-19908
    40Plan

    An issue was discovered in MISP 2.4.9x before 2.4.99.

    HighCVSS 8.8Proof of conceptEPSS 17%

    misp-project · mispDec 6, 2018

  • CVE-2015-5721
    40Plan

    Malware Information Sharing Platform (MISP) before 2.3.90 allows remote attackers to conduct PHP object injection attacks via crafted serial

    CriticalCVSS 9.8No exploitEPSS 3%

    misp-project · mispSep 3, 2016

  • CVE-2015-5719
    40Plan

    app/Controller/TemplatesController.php in Malware Information Sharing Platform (MISP) before 2.3.92 does not properly restrict filenames und

    CriticalCVSS 9.8No exploitEPSS 2%

    misp-project · mispSep 3, 2016

  • CVE-2022-29528
    40Plan

    An issue was discovered in MISP before 2.4.158.

    CriticalCVSS 9.8No exploitEPSS 2%

    misp-project · mispApr 20, 2022

  • CVE-2021-41326
    40Plan

    In MISP before 2.4.148, app/Lib/Export/OpendataExport.php mishandles parameter data that is used in a shell_exec call.

    CriticalCVSS 9.8No exploitEPSS 2%

    misp-project · mispSep 17, 2021

  • CVE-2018-12649
    39Monitor

    An issue was discovered in app/Controller/UsersController.php in MISP 2.4.92.

    CriticalCVSS 9.8No exploitEPSS 1%

    misp-project · mispJun 22, 2018

  • CVE-2020-15411
    39Monitor

    An issue was discovered in MISP 2.4.128.

    CriticalCVSS 9.8No exploitEPSS 1%

    misp-project · mispJun 30, 2020

  • CVE-2022-48328
    39Monitor

    app/Controller/Component/IndexFilterComponent.php in MISP before 2.4.167 mishandles ordered_url_params and additional_delimiters.

    CriticalCVSS 9.8No exploitEPSS 1%

    misp-project · mispFeb 20, 2023

  • CVE-2020-29006
    39Monitor

    MISP before 2.4.135 lacks an ACL check, related to app/Controller/GalaxyElementsController.php and app/Model/GalaxyElement.php.

    CriticalCVSS 9.8No exploitEPSS 1%

    misp-project · mispNov 24, 2020

  • CVE-2021-35502
    39Monitor

    app/View/Elements/genericElements/IndexTable/Fields/generic_field.ctp in MISP 2.4.144 does not sanitize certain data related to generic-temp

    CriticalCVSS 9.8No exploitEPSS 1%

    misp-project · mispJun 25, 2021

  • CVE-2021-39302
    39Monitor

    MISP 2.4.148, in certain configurations, allows SQL injection via the app/Model/Log.php $conditions['org'] value.

    CriticalCVSS 9.8No exploitEPSS 1%

    misp-project · mispAug 19, 2021

  • CVE-2022-48329
    39Monitor

    MISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/M

    CriticalCVSS 9.8No exploitEPSS 1%

    misp-project · mispFeb 20, 2023

  • CVE-2023-48655
    39Monitor

    An issue was discovered in MISP before 2.4.176.

    CriticalCVSS 9.8No exploitEPSS 1%

    misp-project · mispNov 17, 2023

  • CVE-2023-48657
    39Monitor

    An issue was discovered in MISP before 2.4.176.

    CriticalCVSS 9.8No exploitEPSS 1%

    misp-project · mispNov 17, 2023

  • CVE-2023-48656
    39Monitor

    An issue was discovered in MISP before 2.4.176.

    CriticalCVSS 9.8No exploitEPSS 1%

    misp-project · mispNov 17, 2023

  • CVE-2023-48658
    39Monitor

    An issue was discovered in MISP before 2.4.176.

    CriticalCVSS 9.8No exploitEPSS 1%

    misp-project · mispNov 17, 2023

  • CVE-2023-48659
    39Monitor

    An issue was discovered in MISP before 2.4.176.

    CriticalCVSS 9.8No exploitEPSS 1%

    misp-project · mispNov 17, 2023

  • CVE-2024-25675
    39Monitor

    An issue was discovered in MISP before 2.4.184.

    CriticalCVSS 9.8No exploitEPSS 1%

    misp-project · mispFeb 9, 2024

  • CVE-2024-29859
    39Monitor

    In MISP before 2.4.187, add_misp_export in app/Controller/EventsController.php does not properly check for a valid file upload.

    CriticalCVSS 9.8No exploitEPSS 1%

    misp-project · mispMar 21, 2024

  • CVE-2023-50918
    39Monitor

    app/Controller/AuditLogsController.php in MISP before 2.4.182 mishandles ACLs for audit logs.

    CriticalCVSS 9.8No exploitEPSS 1%

    misp-project · mispDec 15, 2023

  • CVE-2024-25674
    39Monitor

    An issue was discovered in MISP before 2.4.184.

    CriticalCVSS 9.8No exploitEPSS 1%

    misp-project · mispFeb 9, 2024

  • CVE-2023-24028
    39Monitor

    In MISP 2.4.167, app/Controller/Component/ACLComponent.php has incorrect access control for the decaying import function.

    CriticalCVSS 9.8No exploitEPSS 1%

    misp-project · mispJan 20, 2023

  • CVE-2024-29858
    39Monitor

    In MISP before 2.4.187, __uploadLogo in app/Controller/OrganisationsController.php does not properly check for a valid logo upload.

    CriticalCVSS 9.8No exploitEPSS 0%

    misp-project · mispMar 21, 2024

  • CVE-2026-85216
    38Monitor

    MISP LDAP and LinOTP Authentication Bypass via Empty or Invalid Credentials

    CriticalCVSS 9.5No exploitEPSS 1%

    misp-project · mispSep 3, 2026

  • CVE-2026-44381
    37Monitor

    MISP: SQL injection via unvalidated ordering parameters in event and shadow attribute listings

    CriticalCVSS 9.3Proof of conceptEPSS 1%

    misp-project · mispMay 13, 2026