Andras Iklody

MISP Event Template Definition Validation Bypass Allows Persistent Denial of Service

Session Fixation in MISP CustomAuth Authentication Allows Session Hijacking

Missing Rate Limiting in Email OTP Verification Allows Brute-Force Authentication Bypass

MISP cullEmptyEvents CSRF Allows Irreversible Deletion of Events via GET Request

MISP LDAP and LinOTP Authentication Bypass via Empty or Invalid Credentials

MISP CurlClient TLS Peer Verification Disabled by Default Enables Man-in-the-Middle Attacks

MISP OnDemand Correlation Engine Missing Access Control Allows Disclosure of Restricted Correlations

Reflected Cross-Site Scripting in MISP Event Filtering via taggedAttributes and galaxyAttachedAttributes Parameters

MISP Dashboard Button Widget Allows Persistent JavaScript URL Injection

MISP Sharing Group Quick-Edit Actions Allow CSRF via State-Changing GET Requests