Andras Iklody

MISP OnDemand Correlation Engine Missing Access Control Allows Disclosure of Restricted Correlations

MISP LDAP and LinOTP Authentication Bypass via Empty or Invalid Credentials

MISP CurlClient TLS Peer Verification Disabled by Default Enables Man-in-the-Middle Attacks

MISP: Improper sharing group authorization check when adding attributes

Authenticated Remote Code Execution via Arbitrary NDJSON Error Log Path in MISP

MISP Core: Broken access control allows instance-wide unauthorized deletion of event reports and sharing groups via bulk deletion endpoints

Broken access control in MISP core allows cross-organization unauthorized modification or deletion of analyst data, event reports, collections, templates, and decaying models

MISP AAD authentication plugin - Improper OAuth State Handling, Missing Session Rotation, Insecure Redirect URI Validation, and Log Injection

MISP Core: Mass Assignment and Object Re-ownership via Unvalidated Request Fields

MISP remote code execution via arbitrary rdkafka configuration path