iglocska

MISP: PHP phar stream wrapper enables deserialization and code execution via caller-influenced filesystem paths

MISP: Disabled-user check ineffective in pre-authentication TOTP login branch

MISP Unauthenticated Blind SSRF via XML Body Processing

MISP CSRF vulnerability in workflow moduleStatelessExecution allows cross-site execution of workflow modules

MISP Reflected XSS via Unvalidated Object Type in AnalystData Overmind Thread

MISP Reflected Cross-Site Scripting in Attribute Histogram via Unescaped URL-Supplied Type List

MISP Reflected Cross-Site Scripting in Event Export Confirmation Form via Unescaped JSON

MISP Installer Log and FIFO Created World-Readable, Exposing Sensitive Credentials

MISP Collections: Missing Authorization Check for Sharing Group on PUT Request in collections/add

MISP EventsController queryEnrichment allows querying unavailable or legacy modules without validation