CVE-2015-5719

CriticalCVSS 9.8/10Last modified Jun 23, 2026

Description

app/Controller/TemplatesController.php in Malware Information Sharing Platform (MISP) before 2.3.92 does not properly restrict filenames under the tmp/files/ directory, which has unspecified impact and attack vectors.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/92740
https://github.com/MISP/MISP/commit/27cc167c3355ec76292235d7f5f4e0016bfd7699Issue Tracking, Patch
https://www.circl.lu/advisory/CVE-2015-5719/Third Party Advisory
http://www.securityfocus.com/bid/92740
https://github.com/MISP/MISP/commit/27cc167c3355ec76292235d7f5f4e0016bfd7699Issue Tracking, Patch
https://www.circl.lu/advisory/CVE-2015-5719/Third Party Advisory

Timeline

Published: Sep 3, 2016
Last modified: Jun 23, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-57206.1Multiple cross-site scripting (XSS) vulnerabilities in the template-creation feature in Malware Information Sharing Platform (MISP) before 2 CVE-2015-57219.8Malware Information Sharing Platform (MISP) before 2.3.90 allows remote attackers to conduct PHP object injection attacks via crafted serial CVE-2015-57227.8buffer.c in named in ISC BIND 9.x before 9.9.7-P3 and 9.10.x before 9.10.2-P4 allows remote attackers to cause a denial of service (assertio CVE-2015-57237.8Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 o CVE-2015-57259.8SQL injection vulnerability in the offset method in the Active Record class in CodeIgniter before 2.2.4 allows remote attackers to execute a CVE-2015-57267.5The BER decoder in Botan 0.10.x before 1.10.10 and 1.11.x before 1.11.19 allows remote attackers to cause a denial of service (application c CVE-2015-57277.5The BER decoder in Botan 1.10.x before 1.10.10 and 1.11.x before 1.11.19 allows remote attackers to cause a denial of service (memory consum CVE-2015-57299.8The Soft Access Point (AP) feature in Samsung Smart TVs X10P, X12, X14H, X14J, and NT14U and Xpress M288OFW printers generate weak WPA2 PSK CVE-2015-57305.0The sanitize_widget_instance function in wp-includes/class-wp-customize-widgets.php in WordPress before 4.2.4 does not use a constant-time c CVE-2015-57316.8Cross-site request forgery (CSRF) vulnerability in wp-admin/post.php in WordPress before 4.2.4 allows remote attackers to hijack the authent CVE-2015-57324.3Cross-site scripting (XSS) vulnerability in the form function in the WP_Nav_Menu_Widget class in wp-includes/default-widgets.php in WordPres CVE-2015-57334.3Cross-site scripting (XSS) vulnerability in the refreshAdvancedAccessibilityOfItem function in wp-admin/js/nav-menu.js in WordPress before 4