DeutschShown in its original language — a full translation is planned for a future version.
MISP: Mehrere Schwachstellen
view advisory published 2026-10-04
Ein Angreifer kann mehrere Schwachstellen in MISP ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder Cross-Site-Scripting-Angriffe durchzuführen.
01
describes (8)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-104914US | —OT elevated | — | ||
MISP contains an improper access control vulnerability in its attribute search and paginated attribute view endpoints.
When a user queries for soft-deleted attributes (e.g., via t… | ||||
| CVE-2026-104912US | —OT elevated | — | ||
MISP contains an authorization flaw in its correlation handling during attribute searches. When a user performs an attribute search that triggers correlation lookups, the system au… | ||||
| CVE-2026-104910US | —OT elevated | — | ||
MISP contains an authorization bypass in the related events listing functionality. When a user requests the list of events correlated to a given event, the system retrieved related… | ||||
| CVE-2026-104908US | — | — | ||
MISP contains an improper input validation vulnerability in the decaying model import functionality. The import endpoint was intended to create a new decaying model belonging exclu… | ||||
| CVE-2026-104907US | — | — | ||
MISP contains a cross-site scripting (XSS) vulnerability in the remote event preview page. When a linked (remote) MISP server is configured, the event preview renders tag identifie… | ||||
| CVE-2026-104906US | — | — | ||
MISP contains a cross-site scripting (XSS) vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON content of string properties was rendered direc… | ||||
| CVE-2026-104901US | — | — | ||
MISP contains a cross-site scripting (XSS) vulnerability in the ID Translator feature. When a user views the ID Translator page, the application queries linked (remote) MISP server… | ||||
| CVE-2026-104900US | — | — | ||
MISP contains a stored cross-site scripting (XSS) vulnerability in the index table rendering of the remote event preview. The count field template escaped the associated link URL b… | ||||
02
references
External citations — patches, advisories, analysis.
- GitHub Advisory Database vom 2026-10-04external
- GitHub Advisory Database vom 2026-10-04external
- GitHub Advisory Database vom 2026-10-04external
- GitHub Advisory Database vom 2026-10-04external
- GitHub Advisory Database vom 2026-10-04external
- GitHub Advisory Database vom 2026-10-04external
- GitHub Advisory Database vom 2026-10-04external
- GitHub Advisory Database vom 2026-10-04external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan