Vulnerabilities > Misp Project > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2018-03-23 | CVE-2018-8948 | Cross-site Scripting vulnerability in Misp-Project Misp In MISP before 2.4.89, app/View/Events/resolved_attributes.ctp has multiple XSS issues via a malicious MISP module. | 4.3 |
| 2017-10-10 | CVE-2017-15216 | Cross-site Scripting vulnerability in Misp-Project Misp MISP before 2.4.81 has a potential reflected XSS in a quickDelete action that is used to delete a sighting, related to app/View/Sightings/ajax/quickDeleteConfirmationForm.ctp and app/webroot/js/misp.js. | 4.3 |
| 2017-09-12 | CVE-2017-14337 | Improper Authentication vulnerability in Misp-Project Misp When MISP before 2.4.80 is configured with X.509 certificate authentication (CertAuth) in conjunction with a non-MISP external user management ReST API, if an external user provides X.509 certificate authentication and this API returns an empty value, the unauthenticated user can be granted access as an arbitrary user. | 6.8 |
| 2017-03-21 | CVE-2017-7215 | Cross-site Scripting vulnerability in Misp Project Misp Cross site scripting in some view elements in the index filter tool in app/webroot/js/misp2.4.68.js and the organisation landing page in app/View/Organisations/ajax/landingpage.ctp of MISP before 2.4.69 allows remote attackers to inject arbitrary web script or HTML. | 4.3 |
| 2016-09-03 | CVE-2015-5720 | Cross-site Scripting vulnerability in Misp-Project Malware Information Sharing Platform Multiple cross-site scripting (XSS) vulnerabilities in the template-creation feature in Malware Information Sharing Platform (MISP) before 2.3.90 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) add.ctp, (2) edit.ctp, and (3) ajaxification.js. | 4.3 |