Recent Items
(Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password validation vulnerability in the Alpha user and root user password loops of Shell/debian-minbase-install.sh. The installer invokes mkpasswd to generate yescrypt password hashes but does not check the command's return value and unconditionally accepts the result. If mkpasswd fails to generate a yescrypt hash, for example because an incompatible mkpasswd implementation or an environment without yescrypt support i…
Published on 2026-09-04T12:59:59.743000+00:00
Updated on 2026-09-04T12:59:59.743000+00:00
Cross-Site Request Forgery via Attacker-Controlled REST Detection in MISP
Published on 2026-09-04T09:40:54.018000+00:00
Updated on 2026-09-04T09:40:54.018000+00:00
MISP Sharing Group Quick-Edit Actions Allow CSRF via State-Changing GET Requests
Published on 2026-09-04T09:27:36.525000+00:00
Updated on 2026-09-04T09:27:36.525000+00:00
MISP Attribute Deletion Authorization Bypass Allows Users Without Modify Permissions to Delete Attributes
Published on 2026-09-04T09:05:41.350000+00:00
Updated on 2026-09-04T09:05:41.350000+00:00
MISP Sharing Group Authorization Bypass via Omitted Distribution Parameter
Published on 2026-09-04T08:53:46.725000+00:00
Updated on 2026-09-04T08:53:46.725000+00:00
Server-Side Request Forgery via Favicon Redirect to Local Network Resources in PlaywrightCapture
Published on 2026-09-03T16:17:20.128000+00:00
Updated on 2026-09-03T16:17:20.128000+00:00
MISP Event Template Definition Validation Bypass Allows Persistent Denial of Service
Published on 2026-09-03T15:37:47.014000+00:00
Updated on 2026-09-03T15:37:47.014000+00:00
Session Fixation in MISP CustomAuth Authentication Allows Session Hijacking
Published on 2026-09-03T15:30:42.478000+00:00
Updated on 2026-09-03T15:30:42.478000+00:00
Missing Rate Limiting in Email OTP Verification Allows Brute-Force Authentication Bypass
Published on 2026-09-03T15:22:59.287000+00:00
Updated on 2026-09-03T15:22:59.287000+00:00
MISP cullEmptyEvents CSRF Allows Irreversible Deletion of Events via GET Request
Published on 2026-09-03T15:13:00.493000+00:00
Updated on 2026-09-03T15:13:00.493000+00:00