Vulnerabilities > Alienvault > Open Source Security Information Management > Critical

DATE CVE VULNERABILITY TITLE RISK
2014-08-21 CVE-2014-5158 Code Injection vulnerability in Alienvault Open Source Security Information Management
The (1) av-centerd SOAP service and (2) backup command in the ossim-framework service in AlienVault OSSIM before 4.6.0 allows remote attackers to execute arbitrary commands via unspecified vectors.
network
low complexity
alienvault CWE-94
critical
10.0
2014-08-21 CVE-2014-5210 Code Injection vulnerability in Alienvault Open Source Security Information Management
The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to execute arbitrary commands via a crafted (1) remote_task or (2) get_license request, a different vulnerability than CVE-2014-3804 and CVE-2014-3805.
network
low complexity
alienvault CWE-94
critical
10.0
2014-06-18 CVE-2014-4151 Code Injection vulnerability in Alienvault Open Source Security Information Management
The av-centerd SOAP service in AlienVault OSSIM before 4.8.0 allows remote attackers to create arbitrary files and execute arbitrary code via a crafted set_file request.
network
low complexity
alienvault CWE-94
critical
10.0
2014-06-18 CVE-2014-4152 Code Injection vulnerability in Alienvault Open Source Security Information Management
The av-centerd SOAP service in AlienVault OSSIM before 4.8.0 allows remote attackers to execute arbitrary code via a crafted remote_task request, related to injecting an ssh public key.
network
low complexity
alienvault CWE-94
critical
10.0
2014-06-13 CVE-2014-3804 Code Injection vulnerability in Alienvault Open Source Security Information Management
The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to execute arbitrary commands via a crafted (1) update_system_info_debian_package, (2) ossec_task, (3) set_ossim_setup admin_ip, (4) sync_rserver, or (5) set_ossim_setup framework_ip request, a different vulnerability than CVE-2014-3805.
network
low complexity
alienvault CWE-94
critical
10.0
2014-06-13 CVE-2014-3805 Code Injection vulnerability in Alienvault Open Source Security Information Management
The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to execute arbitrary commands via a crafted (1) get_license, (2) get_log_line, or (3) update_system/upgrade_pro_web request, a different vulnerability than CVE-2014-3804.
network
low complexity
alienvault CWE-94
critical
10.0