# Recent vulnerabilities from GNA-1 (CIRCL) ## [gcve-1-2025-0001](https://vulnerability.circl.lu/vuln/gcve-1-2025-0001) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Vulnerability-Lookup", "repo": "https://github.com/vulnerability-lookup/vulnerability-lookup", "vendor": "CIRCL", "versions": [ { "changes": [ { "at": "2.10.1", "status": "unaffected" } ], "lessThanOrEqual": "2.10.0", "status": "affected", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Devansh Chauhan" } ], "datePublic": "2025-05-27T08:57:00.000Z", "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "The absence of a password confirmation step when deactivating an account allows a CSRF request to potentially initiate the deactivation for an authenticated user.

" } ], "value": "The absence of a password confirmation step when deactivating an account allows a CSRF request to potentially initiate the deactivation for an authenticated user." } ], "impacts": [ { "capecId": "CAPEC-62", "descriptions": [ { "lang": "en", "value": "CAPEC-62 Cross Site Request Forgery" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "YES", "Recovery": "USER", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 5.3, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "CLEAR", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:N/SA:L/AU:Y/R:U/RE:L/U:Clear", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "LOW" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "tags": [ "patch" ], "url": "https://github.com/vulnerability-lookup/vulnerability-lookup/commit/cf9000ec0bb17b5d2ff8fe5177e5bd14d666bd08" }, { "tags": [ "release-notes" ], "url": "https://github.com/vulnerability-lookup/vulnerability-lookup/releases/tag/v2.10.1" } ], "source": { "discovery": "EXTERNAL" }, "title": "The absence of a password confirmation step when deactivating an account allows a CSRF request to potentially initiate the deactivation for an authenticated user.", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2025-0001", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "datePublished": "2025-05-27T08:58:00.000Z", "dateUpdated": "2025-05-30T14:27:56.273945Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2025-0001", "vulnerabilitylookup_history": [ [ "cedric.bonhomme@circl.lu", "2025-05-27T08:58:26.587622Z" ], [ "cedric.bonhomme@circl.lu", "2025-05-27T12:19:23.219289Z" ], [ "cedric.bonhomme@circl.lu", "2025-05-27T12:22:53.439544Z" ], [ "cedric.bonhomme@circl.lu", "2025-05-27T12:23:35.245899Z" ], [ "cedric.bonhomme@circl.lu", "2025-05-30T14:18:32.214488Z" ], [ "cedric.bonhomme@circl.lu", "2025-05-30T14:27:56.273945Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2025-0002](https://vulnerability.circl.lu/vuln/gcve-1-2025-0002) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "exfiltration", "vendor": "Cl0p ransomware", "versions": [ { "status": "affected" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Lorenzo Nicolodi" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "
The Python-based data-exfiltration utility used by the Cl0p ransomware group (commonly distributed as part of the toolset during the 2023 – 2024 MoveIt campaigns) constructs operating-system commands by directly concatenating attacker-supplied strings without input sanitization. An authenticated endpoint on the Cl0p operators’ staging/collection host passes file-or directory-names received from compromised machines straight into a shell-escape sequence.

No official patch or cooperation from the malware authors is expected.

" } ], "value": "The Python-based data-exfiltration utility used by the Cl0p ransomware group (commonly distributed as part of the toolset during the 2023 – 2024 MoveIt campaigns) constructs operating-system commands by directly concatenating attacker-supplied strings without input sanitization. An authenticated endpoint on the Cl0p operators’ staging/collection host passes file-or directory-names received from compromised machines straight into a shell-escape sequence.\n\n\n\n\nNo official patch or cooperation from the malware authors is expected." } ], "impacts": [ { "capecId": "CAPEC-549", "descriptions": [ { "lang": "en", "value": "CAPEC-549 Local Execution of Code" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "YES", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 8.9, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:Y", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "tags": [ "related" ], "url": "https://amnwxasjtjc6e42siac6t45mhbkgtycrx5krv7sf5festvqxmnchuayd.onion" }, { "tags": [ "related" ], "url": "https://www.hackthebox.com/blog/cve-2023-34362-explained" } ], "source": { "discovery": "UNKNOWN" }, "title": "Command Injection in Cl0p Exfiltration Python Script", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2025-0002", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "datePublished": "2025-07-01T08:19:00.000Z", "dateUpdated": "2025-07-01T10:58:58.443468Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2025-0002", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2025-07-01T08:19:55.399348Z" ], [ "alexandre.dulaunoy@circl.lu", "2025-07-01T08:23:59.977382Z" ], [ "alexandre.dulaunoy@circl.lu", "2025-07-01T10:58:58.443468Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2025-0003](https://vulnerability.circl.lu/vuln/gcve-1-2025-0003) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "cerebrate", "programFiles": [ "‎src/Controller/UserSettingsController.php" ], "repo": "https://github.com/cerebrate-project/cerebrate/", "vendor": "cerebrate", "versions": [ { "status": "affected", "version": "1.27" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Jeroen Pinoy" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "Incorrect ACL for user settings edit, which previously allowed enumeration of usernames." } ], "value": "Incorrect ACL for user settings edit, which previously allowed enumeration of usernames." } ], "impacts": [ { "capecId": "CAPEC-118", "descriptions": [ { "lang": "en", "value": "CAPEC-118 Collect and Analyze Information" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.3, "baseSeverity": "CRITICAL", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-203", "description": "CWE-203 Observable Discrepancy", "lang": "en", "type": "CWE" } ] }, { "descriptions": [ { "cweId": "CWE-204", "description": "CWE-204 Observable Response Discrepancy", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "tags": [ "patch" ], "url": "https://github.com/cerebrate-project/cerebrate/commit/04fb2cd4bb45566308930029f63096942f658b86" } ], "source": { "discovery": "INTERNAL" }, "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2025-0003", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "datePublished": "2025-08-22T12:33:00.000Z", "dateUpdated": "2025-08-23T07:55:10.950332Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2025-0003", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2025-08-22T12:33:56.492006Z" ], [ "cedric.bonhomme@circl.lu", "2025-08-23T07:47:34.139577Z" ], [ "cedric.bonhomme@circl.lu", "2025-08-23T07:55:10.950332Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2025-0005](https://vulnerability.circl.lu/vuln/gcve-1-2025-0005) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "vulnerability-lookup", "vendor": "CIRCL", "versions": [ { "lessThanOrEqual": "2.16", "status": "affected" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Jeroen Pinoy - @Wachizungu" }, { "lang": "en", "type": "remediation developer", "value": "Cedric Bonhomme" }, { "lang": "en", "type": "coordinator", "value": "Alexandre Dulaunoy" } ], "datePublic": "2025-10-10T23:00:00.000Z", "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "Insecure use of Markup in views/home which leads to potential reflected XSS." } ], "value": "Insecure use of Markup in views/home which leads to potential reflected XSS." } ], "impacts": [ { "capecId": "CAPEC-549", "descriptions": [ { "lang": "en", "value": "CAPEC-549 Local Execution of Code" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "YES", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.4, "baseSeverity": "CRITICAL", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:Y", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "url": "https://github.com/vulnerability-lookup/vulnerability-lookup/commit/378ccdf95882d1a02576552e26ce222cde0bd636" } ], "source": { "discovery": "UNKNOWN" }, "title": "Reflected XSS due to insecure use of Markup", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2025-0005", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2025-0005", "datePublished": "2025-10-13T08:23:29.812914Z", "dateUpdated": "2025-10-13T08:23:29.812914Z", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2025-10-13T08:23:29.812914Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2025-0007](https://vulnerability.circl.lu/vuln/gcve-1-2025-0007) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "vulnerability-lookup", "vendor": "CIRCL", "versions": [ { "status": "affected" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Jeroen Pinoy - @Wachizungu" }, { "lang": "en", "type": "remediation developer", "value": "Cedric Bonhomme" }, { "lang": "en", "type": "coordinator", "value": "Alexandre Dulaunoy" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "Missing email validation on user management when user change his/her password which means no email validation would have been seen by the user. This GCVE vulnerability is more informational than a directly exploitable vulnerability." } ], "value": "Missing email validation on user management when user change his/her password which means no email validation would have been seen by the user. This GCVE vulnerability is more informational than a directly exploitable vulnerability." } ], "impacts": [ { "descriptions": [ { "lang": "en" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NO", "Recovery": "NOT_DEFINED", "Safety": "NEGLIGIBLE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 4.5, "baseSeverity": "MEDIUM", "privilegesRequired": "HIGH", "providerUrgency": "CLEAR", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/S:N/AU:N/U:Clear", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "url": "https://github.com/vulnerability-lookup/vulnerability-lookup/commit/326ce42d8661603b4b3b3c5d45992758de0f804a" } ], "source": { "discovery": "UNKNOWN" }, "title": "Missing email validation on user management", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2025-0007", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "datePublished": "2025-10-13T08:37:00.000Z", "dateUpdated": "2025-10-13T08:51:37.408861Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2025-0007", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2025-10-13T08:37:18.494750Z" ], [ "alexandre.dulaunoy@circl.lu", "2025-10-13T08:51:37.408861Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2025-0006](https://vulnerability.circl.lu/vuln/gcve-1-2025-0006) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "vulnerability-lookup", "vendor": "CIRCL", "versions": [ { "status": "affected" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Jeroen Pinoy - @Wachizungu" }, { "lang": "en", "type": "remediation developer", "value": "Cedric Bonhomme" }, { "lang": "en", "type": "coordinator", "value": "Alexandre Dulaunoy" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "Potential self XSS in admin in the CPE add interface in the models/organization." } ], "value": "Potential self XSS in admin in the CPE add interface in the models/organization." } ], "impacts": [ { "capecId": "CAPEC-549", "descriptions": [ { "lang": "en", "value": "CAPEC-549 Local Execution of Code" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.3, "baseSeverity": "CRITICAL", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "url": "https://github.com/vulnerability-lookup/vulnerability-lookup/commit/540366000f2fa27b08bbcc42b1e89927b68b9df6" } ], "source": { "discovery": "UNKNOWN" }, "title": "Potential XSS in admin CPE in organization model", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2025-0006", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "datePublished": "2025-10-13T08:29:00.000Z", "dateUpdated": "2025-10-13T08:52:23.411325Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2025-0006", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2025-10-13T08:29:46.581792Z" ], [ "alexandre.dulaunoy@circl.lu", "2025-10-13T08:52:23.411325Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2025-0008](https://vulnerability.circl.lu/vuln/gcve-1-2025-0008) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "vulnerability-lookup", "vendor": "CIRCL", "versions": [ { "status": "affected" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Jeroen Pinoy - @Wachizungu" }, { "lang": "en", "type": "remediation developer", "value": "Cedric Bonhomme" }, { "lang": "en", "type": "coordinator", "value": "Alexandre Dulaunoy" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "Logged users can view vulnerability disclosure comments if they know the ID instead of the limited view (date of disclosure)." } ], "value": "Logged users can view vulnerability disclosure comments if they know the ID instead of the limited view (date of disclosure)." } ], "impacts": [ { "descriptions": [ { "lang": "en" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 7, "baseSeverity": "HIGH", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "url": "https://github.com/vulnerability-lookup/vulnerability-lookup/commit/aabc899c7d76dca0cf66718bbd2fb95cfd31b0ed" } ], "source": { "discovery": "UNKNOWN" }, "title": "Logged users can view vulnerability disclosure comments if they know the ID", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2025-0008", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "datePublished": "2025-10-13T09:10:00.000Z", "dateUpdated": "2025-10-13T09:15:31.637686Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2025-0008", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2025-10-13T09:10:54.912715Z" ], [ "alexandre.dulaunoy@circl.lu", "2025-10-13T09:15:31.637686Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2025-0009](https://vulnerability.circl.lu/vuln/gcve-1-2025-0009) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "vulnerability-lookup", "vendor": "CIRCL", "versions": [ { "status": "affected" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Jeroen Pinoy - @Wachizungu" }, { "lang": "en", "type": "remediation developer", "value": "Cedric Bonhomme" }, { "lang": "en", "type": "coordinator", "value": "Alexandre Dulaunoy" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "A pre-auth user could self-assign a reporter without being authenticated" } ], "value": "A pre-auth user could self-assign a reporter without being authenticated" } ], "impacts": [ { "capecId": "CAPEC-1", "descriptions": [ { "lang": "en", "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6.4, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "url": "https://github.com/vulnerability-lookup/vulnerability-lookup/commit/6f7b4af932ebd04fa899eb7780fb6b007f442eac" } ], "source": { "discovery": "UNKNOWN" }, "title": "A pre-auth user could self-assign a reporter without being authenticated", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2025-0009", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2025-0009", "datePublished": "2025-10-13T09:20:24.800890Z", "dateUpdated": "2025-10-13T09:20:24.800890Z", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2025-10-13T09:20:24.800890Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2025-0010](https://vulnerability.circl.lu/vuln/gcve-1-2025-0010) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "misp", "vendor": "misp", "versions": [ { "lessThan": "2.5.24", "status": "affected" } ] } ], "credits": [ { "lang": "en", "type": "remediation developer", "value": "Andras Iklody" }, { "lang": "en", "type": "finder", "value": "Raphael Lob from NATO Cyber Security Center" }, { "lang": "en", "type": "coordinator", "value": "Alexandre Dulaunoy" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "
Arbitrary file-hash inclusion via templates in the template engine in MispAttribute allows a web user to obtain the MD5 hash of any file accessible to them via inclusion of tmp_name in templates.
" } ], "value": "Arbitrary file-hash inclusion via templates in the template engine in MispAttribute allows a web user to obtain the MD5 hash of any file accessible to them via inclusion of tmp_name in templates." } ], "impacts": [ { "descriptions": [ { "lang": "en", "value": "Collect" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6.3, "baseSeverity": "MEDIUM", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-829", "description": "CWE-829 Inclusion of Functionality from Untrusted Control Sphere", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "url": "https://github.com/misp/misp/commit/015fd1e7988579120b6bd95ca72c7bce4bb7b902" } ], "source": { "discovery": "UNKNOWN" }, "title": "Arbitrary file hash inclusion via templates accessible to all users", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2025-0010", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2025-0010", "datePublished": "2025-11-04T06:25:11.108987Z", "dateUpdated": "2025-11-04T06:25:11.108987Z", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2025-11-04T06:25:11.108987Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2025-0011](https://vulnerability.circl.lu/vuln/gcve-1-2025-0011) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "misp", "vendor": "misp", "versions": [ { "lessThan": "2.5.24", "status": "affected" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Raphael Lob from NATO Cyber Security Center" }, { "lang": "en", "type": "remediation developer", "value": "Andras Iklody" }, { "lang": "en", "type": "coordinator", "value": "Alexandre Dulaunoy" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "Invalid check for uploaded file validity in EventsController can lead to arbitrary file inclusion / deletion via import modules by spoofing the tmp_name of the request" } ], "value": "Invalid check for uploaded file validity in EventsController can lead to arbitrary file inclusion / deletion via import modules by spoofing the tmp_name of the request" } ], "impacts": [ { "descriptions": [ { "lang": "en" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.4, "baseSeverity": "CRITICAL", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "lang": "en" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "url": "https://github.com/misp/misp/commit/6867f0d3157a1959154bdad9ddac009dec6a19f5" } ], "source": { "discovery": "UNKNOWN" }, "title": "Arbitrary file inclusion / deletion via import modules by spoofing the tmp_name of the request", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2025-0011", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2025-0011", "datePublished": "2025-11-04T07:01:25.464225Z", "dateUpdated": "2025-11-04T07:01:25.464225Z", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2025-11-04T07:01:25.464225Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2025-0013](https://vulnerability.circl.lu/vuln/gcve-1-2025-0013) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "misp", "vendor": "misp", "versions": [ { "lessThan": "2.5.24", "status": "affected" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Jeroen Pinoy from NATO Cyber Security Center" }, { "lang": "en", "type": "remediation developer", "value": "Andras Iklody" }, { "lang": "en", "type": "coordinator", "value": "Alexandre Dulaunoy" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "Authorization bypass / improper access control in app/Controller/SharingGroupBlueprintsController.php in MISP on web application /or API allows an authenticated low-privilege user to inject arbitrary organizations into existing sharing groups (including groups that should not be extendable), thereby granting those organizations access to shared resources and escalating access via crafted sharing-group blueprints or API requests that bypass validation." } ], "value": "Authorization bypass / improper access control in app/Controller/SharingGroupBlueprintsController.php in MISP on web application /or API allows an authenticated low-privilege user to inject arbitrary organizations into existing sharing groups (including groups that should not be extendable), thereby granting those organizations access to shared resources and escalating access via crafted sharing-group blueprints or API requests that bypass validation." } ], "impacts": [ { "descriptions": [ { "lang": "en" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.4, "baseSeverity": "CRITICAL", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "lang": "en" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "url": "https://github.com/misp/misp/commit/d6cc16e8cacb70d23515a85e0e81c95c096d9dd0" } ], "source": { "discovery": "UNKNOWN" }, "title": "Vulnerability in sharing group blueprints allowing sharing group injection", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2025-0013", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2025-0013", "datePublished": "2025-11-04T08:49:21.558087Z", "dateUpdated": "2025-11-04T08:49:21.558087Z", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2025-11-04T08:49:21.558087Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2025-0014](https://vulnerability.circl.lu/vuln/gcve-1-2025-0014) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "misp", "vendor": "misp", "versions": [ { "status": "affected", "version": "2.5.24" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Jeroen Pinoy" }, { "lang": "en", "type": "coordinator", "value": "Alexandre Dulaunoy" }, { "lang": "en", "type": "remediation developer", "value": "Andras Iklody" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "Cross-site scripting in Mermaid chart rendering component in MISP event report allows a remote attacker part of a MISP community to execute arbitrary JavaScript in the victim’s browser via injection of HTML tags in raw Mermaid charts synchronized through event reports." } ], "value": "Cross-site scripting in Mermaid chart rendering component in MISP event report allows a remote attacker part of a MISP community to execute arbitrary JavaScript in the victim’s browser via injection of HTML tags in raw Mermaid charts synchronized through event reports." } ], "impacts": [ { "descriptions": [ { "lang": "en" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.4, "baseSeverity": "CRITICAL", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "url": "https://github.com/misp/misp/commit/bb909aff9503c8c8d4bfe6de94f54d7c90dce8ac" } ], "source": { "discovery": "UNKNOWN" }, "title": "XSS in event report via Mermaid diagram", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2025-0014", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2025-0014", "datePublished": "2025-11-04T08:58:00.024516Z", "dateUpdated": "2025-11-04T08:58:00.024516Z", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2025-11-04T08:58:00.024516Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2025-0015](https://vulnerability.circl.lu/vuln/gcve-1-2025-0015) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "misp", "vendor": "misp", "versions": [ { "lessThan": "2.5.24", "status": "affected" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Jeroen Pinoy" }, { "lang": "en", "type": "remediation developer", "value": "Andras Iklody" }, { "lang": "en", "type": "coordinator", "value": "Alexandre Dulaunoy" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "Cross-site scripting in decaying tool simulation UI/component in MISP on web application allows an attacker/org who can set an organization's display name to execute arbitrary JavaScript in other users' browsers when they view or run simulations via a crafted organization name containing a script payload that is rendered unsanitized when a specific attribute is chosen for the simulation." } ], "value": "Cross-site scripting in decaying tool simulation UI/component in MISP on web application allows an attacker/org who can set an organization's display name to execute arbitrary JavaScript in other users' browsers when they view or run simulations via a crafted organization name containing a script payload that is rendered unsanitized when a specific attribute is chosen for the simulation." } ], "impacts": [ { "descriptions": [ { "lang": "en" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9, "baseSeverity": "CRITICAL", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "url": "https://github.com/misp/misp/commit/7651b5b8b16279322422aa0f45b68c680c15e42b" } ], "source": { "discovery": "UNKNOWN" }, "title": "Potential XSS in decaying simulation tool", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2025-0015", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "datePublished": "2025-11-04T09:06:00.000Z", "dateUpdated": "2025-11-04T09:06:59.216121Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2025-0015", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2025-11-04T09:06:35.083637Z" ], [ "alexandre.dulaunoy@circl.lu", "2025-11-04T09:06:59.216121Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2025-0016](https://vulnerability.circl.lu/vuln/gcve-1-2025-0016) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "misp", "vendor": "misp", "versions": [ { "lessThan": "2.5.24", "status": "affected" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Jeroen Pinoy" }, { "lang": "en", "type": "finder", "value": "Raphael Lob from NATO Cyber Security Center" }, { "lang": "en", "type": "coordinator", "value": "Alexandre Dulaunoy" }, { "lang": "en", "type": "remediation developer", "value": "Andras Iklody" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "Local file inclusion in [ImportFromUrl() URL handling component in MISP event report (with pandoc support) on server-side document import feature / web application allows an attacker who can supply a URL to read local filesystem documents and disclose sensitive information (limited to document file types) via providing file:// URLs to ImportFromUrl() that are fetched without proper scheme/host validation." } ], "value": "Local file inclusion in [ImportFromUrl() URL handling component in MISP event report (with pandoc support) on server-side document import feature / web application allows an attacker who can supply a URL to read local filesystem documents and disclose sensitive information (limited to document file types) via providing file:// URLs to ImportFromUrl() that are fetched without proper scheme/host validation." } ], "impacts": [ { "descriptions": [ { "lang": "en" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 6, "baseSeverity": "MEDIUM", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-552", "description": "CWE-552 Files or Directories Accessible to External Parties", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "url": "https://github.com/misp/misp/commit/6b67f8e853dcf8e40cb87d35a0f6d55df80928df" } ], "source": { "discovery": "UNKNOWN" }, "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2025-0016", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "datePublished": "2025-11-04T09:20:00.000Z", "dateUpdated": "2025-11-04T09:56:38.383646Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2025-0016", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2025-11-04T09:20:56.074344Z" ], [ "alexandre.dulaunoy@circl.lu", "2025-11-04T09:56:38.383646Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2025-0018](https://vulnerability.circl.lu/vuln/gcve-1-2025-0018) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "lookyloo", "vendor": "lookyloo", "versions": [ { "lessThanOrEqual": "1.35.0", "status": "affected" } ] } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "

A HTML injection issue was identified in Lookyloo’s web interface helper function shorten_string (website/web/__init__.py). The function was used to truncate and render user-controlled values inside HTML (for example in a <span title=\"...\"> attribute) without first escaping the string. This allowed crafted input containing HTML to be injected into the rendered page.

On a standard Lookyloo installation, the configured Content Security Policy (CSP) significantly limited the impact and prevented direct script execution in most scenarios, but the underlying HTML injection bug was still present and could become exploitable if CSP was relaxed or modified.

" } ], "value": "A HTML injection issue was identified in Lookyloo’s web interface helper function shorten_string (website/web/__init__.py). The function was used to truncate and render user-controlled values inside HTML (for example in a  attribute) without first escaping the string. This allowed crafted input containing HTML to be injected into the rendered page.\n\nOn a standard Lookyloo installation, the configured Content Security Policy (CSP) significantly limited the impact and prevented direct script execution in most scenarios, but the underlying HTML injection bug was still present and could become exploitable if CSP was relaxed or modified." } ], "impacts": [ { "descriptions": [ { "lang": "en" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.4, "baseSeverity": "CRITICAL", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-74", "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "tags": [ "patch" ], "url": "https://github.com/Lookyloo/lookyloo/commit/ac2f73dbfcad88b815b18c42cca77a1c645f1726" }, { "tags": [ "vendor-advisory" ], "url": "https://github.com/Lookyloo/lookyloo/security/advisories/GHSA-m9g6-23c8-vrxf" } ], "source": { "discovery": "UNKNOWN" }, "title": "HTML injection issue was identified in Lookyloo’s web interface helper function", "workarounds": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "If you don't upgrade, a proper CSP policy will avoid this vulnerability." } ], "value": "If you don't upgrade, a proper CSP policy will avoid this vulnerability." } ], "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2025-0018", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "cveId": "CVE-2025-65095", "datePublished": "2025-11-18T15:33:00.000Z", "dateUpdated": "2025-11-18T20:39:45.579295Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2025-0018", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2025-11-18T15:33:07.767301Z" ], [ "alexandre.dulaunoy@circl.lu", "2025-11-18T15:49:02.564916Z" ], [ "alexandre.dulaunoy@circl.lu", "2025-11-18T20:39:45.579295Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2025-0029](https://vulnerability.circl.lu/vuln/gcve-1-2025-0029) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "misp", "vendor": "misp", "versions": [ { "status": "affected" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Dawid Czarnecki of Zigrin Security" }, { "lang": "en", "type": "remediation developer", "value": "Andras Iklody" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "

MISP contained two reflected cross-site scripting (XSS) vulnerabilities affecting:

\n
    \n
  1. \n

    EventGraph deletion confirmation form (eventGraph_delete_form.ctp)

    \n
    2. \n
  2. \n

    Template file upload form (upload_file.ctp)

    \n
    3. \n
\n

Before commit bd3ef20956e680fe12b3faf529efaaaee3e412dc, both templates used unvalidated numeric identifiers ($id and $element_id) directly in the rendered page. An attacker could craft a malicious request with a specially crafted non-numeric value for these parameters, causing untrusted data to be reflected into the HTML or JavaScript context of the forms—triggering arbitrary JavaScript execution in the browser of a logged-in user.


" } ], "value": "MISP contained two reflected cross-site scripting (XSS) vulnerabilities affecting:\n\n\n\n * \nEventGraph deletion confirmation form (eventGraph_delete_form.ctp)\n\n\n\n\n * \nTemplate file upload form (upload_file.ctp)\n\n\n\n\n\nBefore commit bd3ef20956e680fe12b3faf529efaaaee3e412dc, both templates used unvalidated numeric identifiers ($id and $element_id) directly in the rendered page. An attacker could craft a malicious request with a specially crafted non-numeric value for these parameters, causing untrusted data to be reflected into the HTML or JavaScript context of the forms—triggering arbitrary JavaScript execution in the browser of a logged-in user." } ], "impacts": [ { "descriptions": [ { "lang": "en" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6.3, "baseSeverity": "MEDIUM", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "url": "https://github.com/MISP/MISP/commit/bd3ef20956e680fe12b3faf529efaaaee3e412dc" } ], "source": { "discovery": "UNKNOWN" }, "title": "Reflected cross-site scripting (XSS) vulnerabilities in EventGraph and Template Upload", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2025-0029", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "datePublished": "2025-11-27T12:41:00.000Z", "dateUpdated": "2025-11-27T12:48:51.085860Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2025-0029", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2025-11-27T12:41:37.265185Z" ], [ "alexandre.dulaunoy@circl.lu", "2025-11-27T12:42:20.272359Z" ], [ "alexandre.dulaunoy@circl.lu", "2025-11-27T12:48:51.085860Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2025-0012](https://vulnerability.circl.lu/vuln/gcve-1-2025-0012) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "misp", "vendor": "misp", "versions": [ { "lessThan": "2.5.24", "status": "affected" } ] } ], "credits": [ { "lang": "en", "type": "remediation developer", "value": "Andras Iklody" }, { "lang": "en", "type": "finder", "value": "Raphael Lob from NATO Cyber Security Center" }, { "lang": "en", "type": "coordinator", "value": "Alexandre Dulaunoy" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "
Potential vulnerability in file check upload but this vulnerability is non-exploitable as the code is never executed. This vulnerability information is kept for archiving. 


" } ], "value": "Potential vulnerability in file check upload but this vulnerability is non-exploitable as the code is never executed. This vulnerability information is kept for archiving." } ], "exploits": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html" } ] } ], "impacts": [ { "descriptions": [ { "lang": "en" } ] } ], "metrics": [ { "other": { "type": "Evaluation not possible due to dead-code" } } ], "problemTypes": [ { "descriptions": [ { "lang": "en" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "url": "https://github.com/misp/misp/commit/ed3fa4b4c7a16648d2b102f58b81c735a99e8986" } ], "source": { "discovery": "UNKNOWN" }, "title": "Potential vulnerability in file check upload but non-exploitable", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2025-0012", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "cveId": "CVE-2025-66384", "datePublished": "2025-11-04T07:20:00.000Z", "dateUpdated": "2025-11-28T07:16:21.589449Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2025-0012", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2025-11-04T07:20:07.378032Z" ], [ "alexandre.dulaunoy@circl.lu", "2025-11-28T07:16:21.589449Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2025-0017](https://vulnerability.circl.lu/vuln/gcve-1-2025-0017) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "cerebrate", "vendor": "cerebrate", "versions": [ { "lessThan": "1.30", "status": "affected" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "ENISA" }, { "lang": "en", "type": "remediation developer", "value": "Sami Mokaddem" }, { "lang": "en", "type": "coordinator", "value": "Alexandre Dulaunoy" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "Privilege escalation in UsersController::edit in Cerebrate Project (until version v1.29) allows an authenticated non-privileged user to escalate their privileges (e.g., obtain a higher role such as admin) via the user-edit endpoint by supplying or modifying role_id/organisation_id fields in the edit request." } ], "value": "Privilege escalation in UsersController::edit in Cerebrate Project (until version v1.29) allows an authenticated non-privileged user to escalate their privileges (e.g., obtain a higher role such as admin) via the user-edit endpoint by supplying or modifying role_id/organisation_id fields in the edit request." } ], "exploits": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html" } ] } ], "impacts": [ { "capecId": "CAPEC-233", "descriptions": [ { "lang": "en", "value": "CAPEC-233 Privilege Escalation" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.4, "baseSeverity": "CRITICAL", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "url": "https://github.com/cerebrate-project/cerebrate/commit/c9bfa90abc85d4a20a9cc2f282959b72bef829bb" } ], "solutions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html" } ] } ], "source": { "discovery": "UNKNOWN" }, "title": "Privilege escalation in Cerebrate allows an authenticated non-privileged user to escalate their privileges", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2025-0017", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "cveId": "CVE-2025-66385", "datePublished": "2025-11-12T08:15:00.000Z", "dateUpdated": "2025-11-28T07:22:08.205835Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "gcve-1-2025-0017", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2025-11-12T08:15:46.336994Z" ], [ "alexandre.dulaunoy@circl.lu", "2025-11-28T07:20:30.439115Z" ], [ "alexandre.dulaunoy@circl.lu", "2025-11-28T07:22:08.205835Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2025-0019](https://vulnerability.circl.lu/vuln/gcve-1-2025-0019) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "misp", "vendor": "misp", "versions": [ { "lessThanOrEqual": "2.5.26", "status": "affected" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Esteban (Zerotistic) Tonglet during Hack the Government 2025 in Belgium" }, { "lang": "en", "type": "remediation developer", "value": "Sami Mokaddem" }, { "lang": "en", "type": "coordinator", "value": "Alexandre Dulaunoy" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "The “view picture” functionality in EventReport for site-administrators suffered from a path traversal vulnerability. When a specially crafted filename or alias was provided, the application could be tricked into returning arbitrary files from the server’s file system rather than only allowed image assets." } ], "value": "The “view picture” functionality in EventReport for site-administrators suffered from a path traversal vulnerability. When a specially crafted filename or alias was provided, the application could be tricked into returning arbitrary files from the server’s file system rather than only allowed image assets." } ], "impacts": [ { "capecId": "CAPEC-73", "descriptions": [ { "lang": "en", "value": "CAPEC-73 User-Controlled Filename" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 4, "baseSeverity": "MEDIUM", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-552", "description": "CWE-552 Files or Directories Accessible to External Parties", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "url": "https://github.com/MISP/MISP/commit/7f4a0386d38672eddc139f5735d71c3b749623ce" } ], "source": { "discovery": "UNKNOWN" }, "title": "Path traversal vulnerability in EventReport for site-admin", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2025-0019", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "cveId": "CVE-2025-66386", "datePublished": "2025-11-26T14:47:00.000Z", "dateUpdated": "2025-11-28T07:27:42.721350Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "gcve-1-2025-0019", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2025-11-26T14:47:47.489637Z" ], [ "alexandre.dulaunoy@circl.lu", "2025-11-26T14:48:49.272047Z" ], [ "alexandre.dulaunoy@circl.lu", "2025-11-28T07:23:06.918616Z" ], [ "alexandre.dulaunoy@circl.lu", "2025-11-28T07:27:42.721350Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2025-0020](https://vulnerability.circl.lu/vuln/gcve-1-2025-0020) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "misp", "vendor": "misp", "versions": [ { "lessThan": "2.5.12", "status": "affected" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Lassi Kapanen of Second Nature Security" }, { "lang": "en", "type": "remediation developer", "value": "Andras Iklody" }, { "lang": "en", "type": "finder", "value": "Teemu Hakkarainen of Second Nature Security" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "
The “Galaxy element JSON view\", a functionality that renders JSON representations of “galaxy elements”, contained a cross-site scripting (XSS) vulnerability. 

The issue could allow a malicious user (with the ability to influence galaxy element data) to inject JavaScript payloads that would execute in the browser of another user viewing the JSON view. 
" } ], "value": "The “Galaxy element JSON view\", a functionality that renders JSON representations of “galaxy elements”, contained a cross-site scripting (XSS) vulnerability. \n\n\n\n\nThe issue could allow a malicious user (with the ability to influence galaxy element data) to inject JavaScript payloads that would execute in the browser of another user viewing the JSON view." } ], "impacts": [ { "descriptions": [ { "lang": "en" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.4, "baseSeverity": "CRITICAL", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "url": "https://github.com/misp/misp/commit/aa882b23425dd4ef45d0a5f33ff0b5eed36ec9a4" } ], "source": { "discovery": "UNKNOWN" }, "title": "cross-site scripting (XSS) in Galaxy element JSON view", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2025-0020", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "datePublished": "2025-11-26T15:49:00.000Z", "dateUpdated": "2025-12-02T08:47:41.151429Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "gcve-1-2025-0020", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2025-11-26T15:49:06.903712Z" ], [ "alexandre.dulaunoy@circl.lu", "2025-12-02T08:47:41.151429Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2025-0021](https://vulnerability.circl.lu/vuln/gcve-1-2025-0021) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "misp", "vendor": "misp", "versions": [ { "lessThan": "2.5.12", "status": "affected" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Lassi Kapanen of Second Nature Security" }, { "lang": "en", "type": "remediation developer", "value": "Andras Iklody" }, { "lang": "en", "type": "finder", "value": "Teemu Hakkarainen of Second Nature Security" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "In MISP, the “REST client” interface that allows viewing data returned by modules suffered from a cross-site scripting (XSS) vulnerability when presenting “HTML view” of arbitrary JSON data. Prior to commit d718c026d5d69a50e3bbd51847a05ad8f386ec6c, the application did not sufficiently validate or restrict the type of response before offering to render it as HTML, allowing malicious JSON responses to be rendered in HTML context. This could allow an attacker (via a compromised or malicious module) to supply JSON containing content that, when interpreted as HTML, executes as script in the user’s browser." } ], "value": "In MISP, the “REST client” interface that allows viewing data returned by modules suffered from a cross-site scripting (XSS) vulnerability when presenting “HTML view” of arbitrary JSON data. Prior to commit d718c026d5d69a50e3bbd51847a05ad8f386ec6c, the application did not sufficiently validate or restrict the type of response before offering to render it as HTML, allowing malicious JSON responses to be rendered in HTML context. This could allow an attacker (via a compromised or malicious module) to supply JSON containing content that, when interpreted as HTML, executes as script in the user’s browser." } ], "impacts": [ { "descriptions": [ { "lang": "en" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.4, "baseSeverity": "CRITICAL", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "url": "https://github.com/misp/misp/commit/d718c026d5d69a50e3bbd51847a05ad8f386ec6c" } ], "source": { "discovery": "UNKNOWN" }, "title": "XSS in MISP ReST client in HTML view", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2025-0021", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "datePublished": "2025-11-26T15:55:00.000Z", "dateUpdated": "2025-12-02T08:48:41.869838Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2025-0021", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2025-11-26T15:55:16.468388Z" ], [ "alexandre.dulaunoy@circl.lu", "2025-12-02T08:48:41.869838Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2025-0022](https://vulnerability.circl.lu/vuln/gcve-1-2025-0022) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "misp", "vendor": "misp", "versions": [ { "lessThan": "2.5.12", "status": "affected" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Lassi Kapanen of Second Nature Security" }, { "lang": "en", "type": "remediation developer", "value": "Andras Iklody" }, { "lang": "en", "type": "finder", "value": "Teemu Hakkarainen of Second Nature Security" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "download_attachments_on_load is set to true by default, but setting this to false introduces a potential security risk. Clarified this in the setting" } ], "value": "download_attachments_on_load is set to true by default, but setting this to false introduces a potential security risk. Clarified this in the setting" } ], "impacts": [ { "descriptions": [ { "lang": "en" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.4, "baseSeverity": "CRITICAL", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "lang": "en" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "url": "https://github.com/misp/misp/commit/5410685896b89aed11ace870b9c22c17752d1807" } ], "source": { "discovery": "UNKNOWN" }, "title": "Clarified setting's impact on download_attachments_on_load", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2025-0022", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "datePublished": "2025-11-26T16:04:00.000Z", "dateUpdated": "2025-12-02T08:49:04.510294Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2025-0022", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2025-11-26T16:04:54.084661Z" ], [ "alexandre.dulaunoy@circl.lu", "2025-12-02T08:49:04.510294Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2025-0023](https://vulnerability.circl.lu/vuln/gcve-1-2025-0023) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "misp", "vendor": "misp", "versions": [ { "lessThan": "2.5.12", "status": "affected" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Lassi Kapanen of Second Nature Security" }, { "lang": "en", "type": "remediation developer", "value": "Andras Iklody" }, { "lang": "en", "type": "finder", "value": "Teemu Hakkarainen of Second Nature Security" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "MISP contained a cross-site scripting (XSS) vulnerability in the Server Comparison tool. Prior to commit 83cc0b50971798bbf4be674e9ba744a8e874233a, certain fields displayed in the comparison view were not properly sanitized before being inserted into the HTML output. A malicious or compromised site-admin could inject crafted HTML/JavaScript payloads into comparison content, which would then execute in the browser of another site-admin viewing the Server Comparison interface." } ], "value": "MISP contained a cross-site scripting (XSS) vulnerability in the Server Comparison tool. Prior to commit 83cc0b50971798bbf4be674e9ba744a8e874233a, certain fields displayed in the comparison view were not properly sanitized before being inserted into the HTML output. A malicious or compromised site-admin could inject crafted HTML/JavaScript payloads into comparison content, which would then execute in the browser of another site-admin viewing the Server Comparison interface." } ], "impacts": [ { "descriptions": [ { "lang": "en" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.4, "baseSeverity": "CRITICAL", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "url": "https://github.com/misp/misp/commit/83cc0b50971798bbf4be674e9ba744a8e874233a" } ], "source": { "discovery": "UNKNOWN" }, "title": "XSS in MISP server comparison tool", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2025-0023", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "datePublished": "2025-11-26T16:10:00.000Z", "dateUpdated": "2025-12-02T08:49:24.626168Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2025-0023", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2025-11-26T16:10:30.111214Z" ], [ "alexandre.dulaunoy@circl.lu", "2025-12-02T08:49:24.626168Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2025-0024](https://vulnerability.circl.lu/vuln/gcve-1-2025-0024) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "misp", "vendor": "misp", "versions": [ { "lessThan": "2.5.12", "status": "affected" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Lassi Kapanen of Second Nature Security" }, { "lang": "en", "type": "remediation developer", "value": "Andras Iklody" }, { "lang": "en", "type": "finder", "value": "Teemu Hakkarainen of Second Nature Security" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "MISP contained a reflected cross-site scripting (XSS) vulnerability in the showAttributeTag / tag selection UI." } ], "value": "MISP contained a reflected cross-site scripting (XSS) vulnerability in the showAttributeTag / tag selection UI." } ], "impacts": [ { "descriptions": [ { "lang": "en" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.4, "baseSeverity": "CRITICAL", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "url": "https://github.com/misp/misp/commit/cbfcf1cdd2797de8f3da439f217bb8b9f0cd8cef" } ], "source": { "discovery": "UNKNOWN" }, "title": "cross-site scripting (XSS) vulnerability in the MISP showAttributeTag", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2025-0024", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "datePublished": "2025-11-26T16:14:00.000Z", "dateUpdated": "2025-12-02T08:50:01.482327Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2025-0024", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2025-11-26T16:14:57.013842Z" ], [ "alexandre.dulaunoy@circl.lu", "2025-11-26T16:15:27.131244Z" ], [ "alexandre.dulaunoy@circl.lu", "2025-12-02T08:50:01.482327Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2025-0025](https://vulnerability.circl.lu/vuln/gcve-1-2025-0025) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "misp", "vendor": "misp", "versions": [ { "lessThan": "2.5.12", "status": "affected" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Lassi Kapanen of Second Nature Security" }, { "lang": "en", "type": "remediation developer", "value": "Andras Iklody" }, { "lang": "en", "type": "finder", "value": "Teemu Hakkarainen of Second Nature Security" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "MISP contained a reflected cross-site scripting (XSS) vulnerability in the Attribute Replacement Tool. Prior to commit f20e93e289998290946d56273528d2a4dc1c57fc, the event_id parameter was inserted into both the form action URL and an inline JavaScript handler without proper HTML-escaping. A malicious actor could craft a link with a specially crafted event_id value containing JavaScript, which would then be reflected back to the user and executed when the page was rendered." } ], "value": "MISP contained a reflected cross-site scripting (XSS) vulnerability in the Attribute Replacement Tool. Prior to commit f20e93e289998290946d56273528d2a4dc1c57fc, the event_id parameter was inserted into both the form action URL and an inline JavaScript handler without proper HTML-escaping. A malicious actor could craft a link with a specially crafted event_id value containing JavaScript, which would then be reflected back to the user and executed when the page was rendered." } ], "impacts": [ { "descriptions": [ { "lang": "en" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.4, "baseSeverity": "CRITICAL", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "url": "https://github.com/misp/misp/commit/f20e93e289998290946d56273528d2a4dc1c57fc" } ], "source": { "discovery": "UNKNOWN" }, "title": "Reflected cross-site scripting (XSS) vulnerability in the MISP Attribute Replacement Tool", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2025-0025", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "datePublished": "2025-11-26T16:27:00.000Z", "dateUpdated": "2025-12-02T08:50:18.897756Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2025-0025", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2025-11-26T16:27:43.742150Z" ], [ "alexandre.dulaunoy@circl.lu", "2025-11-26T16:29:13.941057Z" ], [ "alexandre.dulaunoy@circl.lu", "2025-12-02T08:50:18.897756Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2025-0026](https://vulnerability.circl.lu/vuln/gcve-1-2025-0026) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "misp", "vendor": "misp", "versions": [ { "lessThan": "2.5.12", "status": "affected" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Lassi Kapanen of Second Nature Security" }, { "lang": "en", "type": "remediation developer", "value": "Andras Iklody" }, { "lang": "en", "type": "finder", "value": "Teemu Hakkarainen of Second Nature Security" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "MISP contained a reflected cross-site scripting (XSS) vulnerability in the Server Edit interface, specifically within the JavaScript initialization code of the push and pull filtering rule elements. Prior to commit b24e37a6c78199a4c68bb3b95f53d37962973d86, the id parameter (server ID) was embedded directly into a JavaScript string without HTML escaping. A maliciously crafted id value containing JavaScript or special characters could be reflected into the page and executed when an authenticated user visited the server edit page." } ], "value": "MISP contained a reflected cross-site scripting (XSS) vulnerability in the Server Edit interface, specifically within the JavaScript initialization code of the push and pull filtering rule elements. Prior to commit b24e37a6c78199a4c68bb3b95f53d37962973d86, the id parameter (server ID) was embedded directly into a JavaScript string without HTML escaping. A maliciously crafted id value containing JavaScript or special characters could be reflected into the page and executed when an authenticated user visited the server edit page." } ], "impacts": [ { "descriptions": [ { "lang": "en" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.4, "baseSeverity": "CRITICAL", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "url": "https://github.com/misp/misp/commit/b24e37a6c78199a4c68bb3b95f53d37962973d86" } ], "source": { "discovery": "UNKNOWN" }, "title": "Reflected cross-site scripting (XSS) vulnerability in the Server Edit interface,", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2025-0026", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "datePublished": "2025-11-26T16:35:00.000Z", "dateUpdated": "2025-12-02T08:50:46.381572Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2025-0026", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2025-11-26T16:35:06.666237Z" ], [ "alexandre.dulaunoy@circl.lu", "2025-12-02T08:50:46.381572Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2025-0027](https://vulnerability.circl.lu/vuln/gcve-1-2025-0027) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "misp", "vendor": "misp", "versions": [ { "lessThan": "2.5.12", "status": "affected" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Lassi Kapanen of Second Nature Security" }, { "lang": "en", "type": "remediation developer", "value": "Andras Iklody" }, { "lang": "en", "type": "finder", "value": "Teemu Hakkarainen of Second Nature Security" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "A reflected cross-site scripting (XSS) vulnerability was discovered in the server edit functionality of MISP. In serverRuleElements/pull.ctp and serverRuleElements/push.ctp, the id (server ID) value was written directly into an inline JavaScript variable (var serverID = \"…\"), without HTML escaping. A remote attacker could craft a URL with a malicious id value that, when visited by an authenticated user with access to the server edit interface, would result in arbitrary JavaScript execution in the victim’s browser.
" } ], "value": "A reflected cross-site scripting (XSS) vulnerability was discovered in the server edit functionality of MISP. In serverRuleElements/pull.ctp and serverRuleElements/push.ctp, the id (server ID) value was written directly into an inline JavaScript variable (var serverID = \"…\"), without HTML escaping. A remote attacker could craft a URL with a malicious id value that, when visited by an authenticated user with access to the server edit interface, would result in arbitrary JavaScript execution in the victim’s browser." } ], "impacts": [ { "descriptions": [ { "lang": "en" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.4, "baseSeverity": "CRITICAL", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "url": "https://github.com/misp/misp/commit/b24e37a6c78199a4c68bb3b95f53d37962973d86" } ], "source": { "discovery": "UNKNOWN" }, "title": "Reflected cross-site scripting (XSS) vulnerability in the server edit functionality of MISP", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2025-0027", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "datePublished": "2025-11-27T07:17:00.000Z", "dateUpdated": "2025-12-02T08:51:04.323899Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "gcve-1-2025-0027", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2025-11-27T07:17:57.069969Z" ], [ "alexandre.dulaunoy@circl.lu", "2025-11-27T07:24:10.363842Z" ], [ "alexandre.dulaunoy@circl.lu", "2025-12-02T08:51:04.323899Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2025-0028](https://vulnerability.circl.lu/vuln/gcve-1-2025-0028) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "misp", "vendor": "misp", "versions": [ { "lessThan": "2.5.12", "status": "affected" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Lassi Kapanen of Second Nature Security" }, { "lang": "en", "type": "remediation developer", "value": "Andras Iklody" }, { "lang": "en", "type": "finder", "value": "Teemu Hakkarainen of Second Nature Security" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "MISP contained an information leakage vulnerability in the Feed configuration interface when tag collections were used and the “JSONified list” view was accessed. As a result, sensitive fields such as full user records, organisation metadata, or other internal attributes could be exposed to users who should not have had access to them when viewing the JSON output of feed configurations." } ], "value": "MISP contained an information leakage vulnerability in the Feed configuration interface when tag collections were used and the “JSONified list” view was accessed. As a result, sensitive fields such as full user records, organisation metadata, or other internal attributes could be exposed to users who should not have had access to them when viewing the JSON output of feed configurations." } ], "impacts": [ { "descriptions": [ { "lang": "en" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.5, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "url": "https://github.com/misp/misp/commit/ffe3be4da6fa99fffc85534d730a469c06cd38d8" } ], "source": { "discovery": "UNKNOWN" }, "title": "Information leakage vulnerability in the MISP Feed configuration interface", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2025-0028", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "datePublished": "2025-11-27T07:23:00.000Z", "dateUpdated": "2025-12-02T08:51:35.429494Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "gcve-1-2025-0028", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2025-11-27T07:23:20.592344Z" ], [ "alexandre.dulaunoy@circl.lu", "2025-12-02T08:51:35.429494Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2025-0030](https://vulnerability.circl.lu/vuln/gcve-1-2025-0030) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "misp", "vendor": "misp", "versions": [ { "lessThan": "2.5.27", "status": "affected" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Louis PLUVIOSE" }, { "lang": "en", "type": "finder", "value": "Mathis FRANEL" }, { "lang": "en", "type": "remediation developer", "value": "Andras Iklody" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "
A cross-site scripting (XSS) vulnerability in the “actions” table element template in app/View/Elements/genericElements/IndexTable/Fields/actions.ctp allows an attacker to inject arbitrary JavaScript code into the generated HTML.

\nSuccessful exploitation allows execution of arbitrary JavaScript in the context of the affected web application, potentially leading to session hijacking, data exfiltration, or UI redressing, depending on the permissions of the targeted user.
" } ], "value": "A cross-site scripting (XSS) vulnerability in the “actions” table element template in app/View/Elements/genericElements/IndexTable/Fields/actions.ctp allows an attacker to inject arbitrary JavaScript code into the generated HTML.\n\n\n\n\n\nSuccessful exploitation allows execution of arbitrary JavaScript in the context of the affected web application, potentially leading to session hijacking, data exfiltration, or UI redressing, depending on the permissions of the targeted user." } ], "impacts": [ { "descriptions": [ { "lang": "en" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6.2, "baseSeverity": "MEDIUM", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "url": "https://github.com/MISP/MISP/commit/c7b833839138fd3cef1a225f54863540d72a2fac" } ], "source": { "discovery": "UNKNOWN" }, "title": "A cross-site scripting (XSS) vulnerability in the MISP “actions” table element template", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2025-0030", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "datePublished": "2025-12-03T10:53:00.000Z", "dateUpdated": "2025-12-03T10:58:55.845341Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "gcve-1-2025-0030", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2025-12-03T10:53:30.664179Z" ], [ "alexandre.dulaunoy@circl.lu", "2025-12-03T10:58:55.845341Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ``` ## [gcve-1-2025-0033](https://vulnerability.circl.lu/vuln/gcve-1-2025-0033) ```json { "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "vulnerability-lookup", "vendor": "CIRCL", "versions": [ { "lessThan": "2.18.0", "status": "affected" } ] } ], "credits": [ { "lang": "en", "type": "remediation developer", "value": "Cedric Bonhomme" }, { "lang": "en", "type": "finder", "value": "ENISA" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "

In affected versions, vulnerability-lookup did not track or limit failed One-Time Password (OTP) attempts during Two-Factor Authentication (2FA) verification. An attacker who already knew or guessed a valid username and password could submit an arbitrary number of OTP codes without causing the account to be locked or generating any specific alert for administrators.

\n

This lack of rate-limiting and lockout on OTP failures significantly lowers the cost of online brute-force attacks against 2FA codes and increases the risk of successful account takeover, especially if OTP entropy is reduced (e.g. short numeric codes, user reuse, or predictable tokens). Additionally, administrators had no direct visibility into accounts experiencing repeated 2FA failures, making targeted attacks harder to detect and investigate.

\n

The patch introduces a persistent failed_otp_attempts counter on user accounts, locks the user after 5 invalid OTP submissions, resets the counter on successful verification, and surfaces failed 2FA attempts in the admin user list. This enforces an account lockout policy for OTP brute-force attempts and improves monitoring capabilities for suspicious 2FA activity.


" } ], "value": "In affected versions, vulnerability-lookup did not track or limit failed One-Time Password (OTP) attempts during Two-Factor Authentication (2FA) verification. An attacker who already knew or guessed a valid username and password could submit an arbitrary number of OTP codes without causing the account to be locked or generating any specific alert for administrators.\n\n\nThis lack of rate-limiting and lockout on OTP failures significantly lowers the cost of online brute-force attacks against 2FA codes and increases the risk of successful account takeover, especially if OTP entropy is reduced (e.g. short numeric codes, user reuse, or predictable tokens). Additionally, administrators had no direct visibility into accounts experiencing repeated 2FA failures, making targeted attacks harder to detect and investigate.\n\n\nThe patch introduces a persistent failed_otp_attempts counter on user accounts, locks the user after 5 invalid OTP submissions, resets the counter on successful verification, and surfaces failed 2FA attempts in the admin user list. This enforces an account lockout policy for OTP brute-force attempts and improves monitoring capabilities for suspicious 2FA activity." } ], "impacts": [ { "capecId": "CAPEC-115", "descriptions": [ { "lang": "en", "value": "CAPEC-115 Authentication Bypass" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.1, "baseSeverity": "HIGH", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-307", "description": "CWE-307 Improper Restriction of Excessive Authentication Attempts", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "00000000-0000-4000-9000-000000000000" }, "references": [ { "url": "https://github.com/vulnerability-lookup/vulnerability-lookup/commit/113b1fe49fea2dd964a7da6b1e7f300be0fa3dfc" } ], "source": { "discovery": "UNKNOWN" }, "title": "Vulnerability-lookup did not track or limit failed One-Time Password (OTP) attempts during Two-Factor Authentication (2FA) verification.", "x_generator": { "engine": "Vulnogram 0.2.0" }, "x_gcve": [ { "vulnId": "gcve-1-2025-0033", "recordType": "advisory" } ] } }, "cveMetadata": { "assignerOrgId": "00000000-0000-4000-9000-000000000000", "cveId": "CVE-2025-42615", "datePublished": "2025-12-08T10:11:00.000Z", "dateUpdated": "2025-12-08T12:12:53.235996Z", "requesterUserId": "00000000-0000-4000-9000-000000000000", "serial": 1, "state": "PUBLISHED", "vulnId": "GCVE-1-2025-0033", "vulnerabilitylookup_history": [ [ "alexandre.dulaunoy@circl.lu", "2025-12-08T10:11:44.833694Z" ], [ "alexandre.dulaunoy@circl.lu", "2025-12-08T12:12:53.235996Z" ] ] }, "dataType": "CVE_RECORD", "dataVersion": "5.1" } ```