First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2020-10246

MediumCVSS 6.1/10Last modified Jun 22, 2026

Description

MISP 2.4.122 has reflected XSS via unsanitized URL parameters. This is related to app/View/Users/statistics_orgs.ctp.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/MISP/MISP/commit/43a0757fb33769d9ad4ca09e8f2ac572f9f6a491Patch, Third Party Advisory
https://github.com/MISP/MISP/releases/tag/v2.4.123Release Notes, Third Party Advisory
https://github.com/MISP/MISP/commit/43a0757fb33769d9ad4ca09e8f2ac572f9f6a491Patch, Third Party Advisory
https://github.com/MISP/MISP/releases/tag/v2.4.123Release Notes, Third Party Advisory

Timeline

Published: Mar 9, 2020
Last modified: Jun 22, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-102476.1MISP 2.4.122 has Persistent XSS in the sighting popover tool. This is related to app/View/Elements/Events/View/sighting_field.ctp.CVE-2020-102487.5BWA DiREX-Pro 1.2181 devices allow remote attackers to discover passwords via a direct request to val_users.php3.CVE-2020-102495.3BWA DiREX-Pro 1.2181 devices allow full path disclosure via an invalid name array parameter to val_soft.php3.CVE-2020-10259.8An elevation of privilege vulnerability exists when Microsoft SharePoint Server and Skype for Business Server improperly handle OAuth token CVE-2020-102509.8BWA DiREX-Pro 1.2181 devices allow remote attackers to execute arbitrary OS commands via shell metacharacters in the PKG parameter to uninst CVE-2020-102515.5In ImageMagick 7.0.9, an out-of-bounds read vulnerability exists within the ReadHEICImageByID function in coders\heic.c. It can be triggered CVE-2020-102528.3An issue was discovered in ownCloud before 10.4. Because of an SSRF issue (via the apps/files_sharing/external remote parameter), an authent CVE-2020-102545.9An issue was discovered in ownCloud before 10.4. An attacker can bypass authentication on a password-protected image by displaying its previ CVE-2020-102559.0Modern DRAM chips (DDR4 and LPDDR4 after 2015) are affected by a vulnerability in deployment of internal mitigations against RowHammer attac CVE-2020-102569.8An issue was discovered in beta versions of the 1Password command-line tool prior to 0.5.5 and in beta versions of the 1Password SCIM bridge CVE-2020-102579.8The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allow CVE-2020-10269.8A Security Feature Bypass vulnerability exists in the MSR JavaScript Cryptography Library that is caused by multiple bugs in the libraryâ€™s