https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 21:53:22 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-95659 <p>MISP contains a reflected cross-site scripting (XSS) vulnerability in the AnalystDataController::viewForObject action. The method accepted a parent object type parameter from the URL without validation and passed it to the Overmind-themed AnalystData thread view element, where it was interpolated into two translated strings and rendered into the HTML response without output encoding. An authenticated attacker who can induce a victim to navigate to a crafted URL can inject arbitrary JavaScript that executes in the victim&#39;s browser within the MISP application context. This may allow the attacker to read session data, manipulate the page, or perform actions on behalf of the victim.</p> <p>The vulnerability requires the victim to be authenticated to MISP and to actively visit the attacker-supplied URL. The affected component is the AnalystData controller and the Overmind theme&#39;s AnalystData thread element.</p> <p>Version affected: &lt;2.5.47</p> <p>MISP contains a reflected cross-site scripting (XSS) vulnerability in the AnalystDataController::viewForObject action. The method accepted a parent object type parameter from the URL without validation and passed it to the Overmind-themed AnalystData thread view element, where it was interpolated into two translated strings and rendered into the HTML response without output encoding. An authenticated attacker who can induce a victim to navigate to a crafted URL can inject arbitrary JavaScript that executes in the victim&#39;s browser within the MISP application context. This may allow the attacker to read session data, manipulate the page, or perform actions on behalf of the victim.</p> <p>The vulnerability requires the victim to be authenticated to MISP and to actively visit the attacker-supplied URL. The affected component is the AnalystData controller and the Overmind theme&#39;s AnalystData thread element.</p> <p>Version affected: &lt;2.5.47</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-95659 https://vulnerability.circl.lu/vuln/gcve-1-2026-20234 <p><strong>Affected:</strong> MISP</p> <p>MISP contains a reflected cross-site scripting (XSS) vulnerability in the AnalystDataController::viewForObject action. The method accepted a parent object type parameter from the URL without validation and passed it to the Overmind-themed AnalystData thread view element, where it was interpolated into two translated strings and rendered into the HTML response without output encoding. An authenticated attacker who can induce a victim to navigate to a crafted URL can inject arbitrary JavaScript that executes in the victim&#39;s browser within the MISP application context. This may allow the attacker to read session data, manipulate the page, or perform actions on behalf of the victim.</p> <p>The vulnerability requires the victim to be authenticated to MISP and to actively visit the attacker-supplied URL. The affected component is the AnalystData controller and the Overmind theme&#39;s AnalystData thread element.</p> <p>Version affected: &lt;2.5.47</p> <p><strong>Affected:</strong> MISP</p> <p>MISP contains a reflected cross-site scripting (XSS) vulnerability in the AnalystDataController::viewForObject action. The method accepted a parent object type parameter from the URL without validation and passed it to the Overmind-themed AnalystData thread view element, where it was interpolated into two translated strings and rendered into the HTML response without output encoding. An authenticated attacker who can induce a victim to navigate to a crafted URL can inject arbitrary JavaScript that executes in the victim&#39;s browser within the MISP application context. This may allow the attacker to read session data, manipulate the page, or perform actions on behalf of the victim.</p> <p>The vulnerability requires the victim to be authenticated to MISP and to actively visit the attacker-supplied URL. The affected component is the AnalystData controller and the Overmind theme&#39;s AnalystData thread element.</p> <p>Version affected: &lt;2.5.47</p> https://vulnerability.circl.lu/vuln/gcve-1-2026-20234 https://vulnerability.circl.lu/vuln/ghsa-296v-9jwc-w27h <p>MISP contains a reflected cross-site scripting (XSS) vulnerability in the AnalystDataController::viewForObject action. The method accepted a parent object type parameter from the URL without validation and passed it to the Overmind-themed AnalystData thread view element, where it was interpolated into two translated strings and rendered into the HTML response without output encoding. An authenticated attacker who can induce a victim to navigate to a crafted URL can inject arbitrary JavaScript that executes in the victim&#39;s browser within the MISP application context. This may allow the attacker to read session data, manipulate the page, or perform actions on behalf of the victim.</p> <p>The vulnerability requires the victim to be authenticated to MISP and to actively visit the attacker-supplied URL. The affected component is the AnalystData controller and the Overmind theme&#39;s AnalystData thread element.</p> <p>Version affected: &lt;2.5.47</p> <p>MISP contains a reflected cross-site scripting (XSS) vulnerability in the AnalystDataController::viewForObject action. The method accepted a parent object type parameter from the URL without validation and passed it to the Overmind-themed AnalystData thread view element, where it was interpolated into two translated strings and rendered into the HTML response without output encoding. An authenticated attacker who can induce a victim to navigate to a crafted URL can inject arbitrary JavaScript that executes in the victim&#39;s browser within the MISP application context. This may allow the attacker to read session data, manipulate the page, or perform actions on behalf of the victim.</p> <p>The vulnerability requires the victim to be authenticated to MISP and to actively visit the attacker-supplied URL. The affected component is the AnalystData controller and the Overmind theme&#39;s AnalystData thread element.</p> <p>Version affected: &lt;2.5.47</p> https://vulnerability.circl.lu/vuln/ghsa-296v-9jwc-w27h