Show filters
3 Total Results
Displaying 1-3 of 3
Sort by:
Attacker Value
Unknown
CVE-2020-24085
Disclosure Date: January 26, 2021 (last updated February 22, 2025)
A cross-site scripting (XSS) vulnerability exists in MISP v2.4.128 in app/Controller/UserSettingsController.php at SetHomePage() function. Due to a lack of controller validation in "path" parameter, an attacker can execute malicious JavaScript code.
0
Attacker Value
Unknown
CVE-2020-15412
Disclosure Date: June 30, 2020 (last updated February 21, 2025)
An issue was discovered in MISP 2.4.128. app/Controller/EventsController.php lacks an event ACL check before proceeding to allow a user to send an event contact form.
0
Attacker Value
Unknown
CVE-2020-15411
Disclosure Date: June 30, 2020 (last updated November 28, 2024)
An issue was discovered in MISP 2.4.128. app/Controller/AttributesController.php has insufficient ACL checks in the attachment downloader.
0
