Vulnerabilities > Alienvault

DATE CVE VULNERABILITY TITLE RISK
2020-01-27 CVE-2013-6056 Path Traversal vulnerability in Alienvault Open Source Security Information Management
OSSIM before 4.3.3.1 has tele_compress.php path traversal vulnerability
network
low complexity
alienvault CWE-22
7.8
2018-03-14 CVE-2018-7279 Unspecified vulnerability in Alienvault products
A remote code execution issue was discovered in AlienVault USM and OSSIM before 5.5.1.
network
low complexity
alienvault
7.5
2017-10-18 CVE-2017-14956 Cross-Site Request Forgery (CSRF) vulnerability in Alienvault Unified Security Management 4.14
AlienVault USM v5.4.2 and earlier offers authenticated users the functionality of exporting generated reports via the "/ossim/report/wizard_email.php" script.
3.5
2017-05-23 CVE-2015-4046 Command Injection vulnerability in Alienvault Open Source Security Information Management
The asset discovery scanner in AlienVault OSSIM before 5.0.1 allows remote authenticated users to execute arbitrary commands via the assets array parameter to netscan/do_scan.php.
network
low complexity
alienvault CWE-77
6.5
2017-05-23 CVE-2015-4045 Permissions, Privileges, and Access Controls vulnerability in Alienvault Open Source Security Information Management
The sudoers file in the asset discovery scanner in AlienVault OSSIM before 5.0.1 allows local users to gain privileges via a crafted nmap script.
local
low complexity
alienvault CWE-264
7.2
2017-03-22 CVE-2017-6972 Improper Check for Dropped Privileges vulnerability in multiple products
AlienVault USM and OSSIM before 5.3.7 and NfSen before 1.3.8 have an error in privilege dropping and unnecessarily execute the NfSen Perl code as root, aka AlienVault ID ENG-104945, a different vulnerability than CVE-2017-6970 and CVE-2017-6971.
network
low complexity
alienvault nfsen CWE-273
critical
10.0
2017-03-22 CVE-2017-6971 Injection vulnerability in multiple products
AlienVault USM and OSSIM before 5.3.7 and NfSen before 1.3.8 allow remote authenticated users to execute arbitrary commands in a privileged context, or launch a reverse shell, via vectors involving the PHP session ID and the NfSen PHP code, aka AlienVault ID ENG-104862.
network
low complexity
alienvault nfsen CWE-74
critical
9.0
2017-03-22 CVE-2017-6970 OS Command Injection vulnerability in multiple products
AlienVault USM and OSSIM before 5.3.7 and NfSen before 1.3.8 allow local users to execute arbitrary commands in a privileged context via an NfSen socket, aka AlienVault ID ENG-104863.
local
low complexity
alienvault nfsen CWE-78
4.6
2017-03-15 CVE-2016-7955 Permissions, Privileges, and Access Controls vulnerability in Alienvault Ossim and Unified Security Management
The logcheck function in session.inc in AlienVault OSSIM before 5.3.1, when an action has been created, and USM before 5.3.1 allows remote attackers to bypass authentication and consequently obtain sensitive information, modify the application, or execute arbitrary code as root via an "AV Report Scheduler" HTTP User-Agent header.
network
low complexity
alienvault CWE-264
7.5
2016-10-28 CVE-2016-8583 Cross-site Scripting vulnerability in Alienvault products
Multiple GET parameters in the vulnerability scan scheduler of AlienVault OSSIM and USM before 5.3.2 are vulnerable to reflected XSS.
network
alienvault CWE-79
4.3