CVE-2019-11812

MediumCVSS 6.1/10Last modified Jun 22, 2026

Description

A persistent XSS issue was discovered in app/View/Helper/CommandHelper.php in MISP before 2.4.107. JavaScript can be included in the discussion interface, and can be triggered by clicking on the link.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/MISP/MISP/commit/3a085a6ceea00b3ab674a984dd56c1846ef775ffPatch, Third Party Advisory
https://github.com/MISP/MISP/commit/3a085a6ceea00b3ab674a984dd56c1846ef775ffPatch, Third Party Advisory

Timeline

Published: May 8, 2019
Last modified: Jun 22, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-118136.1An issue was discovered in app/View/Elements/Events/View/value_field.ctp in MISP before 2.4.107. There is persistent XSS via link type attri CVE-2019-118146.1An issue was discovered in app/webroot/js/misp.js in MISP before 2.4.107. There is persistent XSS via image names in titles, as demonstrated CVE-2019-118158.1An issue was discovered in rds_tcp_kill_sock in net/rds/tcp.c in the Linux kernel before 5.0.8. There is a race condition leading to a use-a CVE-2019-118167.2Incorrect access control in the WebUI in OPNsense before version 19.1.8, and pfsense before 2.4.4-p3 allows remote authenticated users to es CVE-2019-118186.1Alkacon OpenCMS v10.5.4 and before is affected by stored cross site scripting (XSS) in the module New User (/opencms/system/workplace/admin/CVE-2019-118197.8Alkacon OpenCMS v10.5.4 and before is affected by CSV (aka Excel Macro) Injection in the module New User (/opencms/system/workplace/admin/ac CVE-2019-11829.8A remote code execution vulnerability exists in Remote Desktop Services – formerly known as Terminal Services – when an unauthenticated atta CVE-2019-118205.5Information exposure through process environment vulnerability in Synology Calendar before 2.3.3-0620 allows local users to obtain credentia CVE-2019-118219.8SQL injection vulnerability in synophoto_csPhotoDB.php in Synology Photo Station before 6.8.11-3489 and before 6.3-2977 allows remote attack CVE-2019-118226.5Relative path traversal vulnerability in SYNO.PhotoStation.File in Synology Photo Station before 6.8.11-3489 and before 6.3-2977 allows remo CVE-2019-118237.5CRLF injection vulnerability in Network Center in Synology Router Manager (SRM) before 1.2.3-8017-2 allows remote attackers to cause a denia CVE-2019-118255.4Cross-site scripting (XSS) vulnerability in Event Editor in Synology Calendar before 2.3.0-0615 allows remote attackers to inject arbitrary