iglocska

MISP: Site-Admin Can Repoint Redis Workers to Attacker-Controlled Server via UI/API Configuration Change

MISP sachertortephp - CakeResponse::download() HTTP Response Splitting via Unsanitized Filename Enables Stored XSS

MISP: Soft-Deleted Attributes from Other Organizations Exposed via Attribute Search and Paginated View

MISP Correlation Authorization Bypass Exposes Restricted Event and Attribute Data

MISP Information Disclosure via Related Events Listing Bypassing Per-Event Authorization

MISP Decaying Model Import Mass Assignment Allows Cross-Organization Model Overwrite and Default Flagging

MISP: JavaScript Injection via Remote Tag ID in Event Preview Inline Handler

MISP TAXII Object Viewer Stored XSS via Unescaped JSON Output

MISP ID Translator: Unescaped Remote Event ID Enables Cross-Site Scripting via Linked Server

MISP Stored XSS via Unescaped Count Field Value in Remote Event Preview Index