Vulnerabilities > Alienvault

DATE CVE VULNERABILITY TITLE RISK
2014-06-18 CVE-2014-4152 Code Injection vulnerability in Alienvault Open Source Security Information Management
The av-centerd SOAP service in AlienVault OSSIM before 4.8.0 allows remote attackers to execute arbitrary code via a crafted remote_task request, related to injecting an ssh public key.
network
low complexity
alienvault CWE-94
critical
10.0
2014-06-18 CVE-2014-4151 Code Injection vulnerability in Alienvault Open Source Security Information Management
The av-centerd SOAP service in AlienVault OSSIM before 4.8.0 allows remote attackers to create arbitrary files and execute arbitrary code via a crafted set_file request.
network
low complexity
alienvault CWE-94
critical
10.0
2014-06-13 CVE-2014-3805 Code Injection vulnerability in Alienvault Open Source Security Information Management
The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to execute arbitrary commands via a crafted (1) get_license, (2) get_log_line, or (3) update_system/upgrade_pro_web request, a different vulnerability than CVE-2014-3804.
network
low complexity
alienvault CWE-94
critical
10.0
2014-06-13 CVE-2014-3804 Code Injection vulnerability in Alienvault Open Source Security Information Management
The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to execute arbitrary commands via a crafted (1) update_system_info_debian_package, (2) ossec_task, (3) set_ossim_setup admin_ip, (4) sync_rserver, or (5) set_ossim_setup framework_ip request, a different vulnerability than CVE-2014-3805.
network
low complexity
alienvault CWE-94
critical
10.0
2013-10-09 CVE-2013-5967 SQL Injection vulnerability in Alienvault Open Source Security Information Management
Multiple SQL injection vulnerabilities in AlienVault Open Source Security Information Management (OSSIM) 4.3 and earlier allow remote attackers to execute arbitrary SQL commands via the date_from parameter to (1) radar-iso27001-potential.php, (2) radar-iso27001-A12IS_acquisition-pot.php, (3) radar-iso27001-A11AccessControl-pot.php, (4) radar-iso27001-A10Com_OP_Mgnt-pot.php, or (5) radar-pci-potential.php in RadarReport/.
network
low complexity
alienvault CWE-89
7.5
2013-08-20 CVE-2013-5321 SQL Injection vulnerability in Alienvault Open Source Security Information Management 4.1
Multiple SQL injection vulnerabilities in AlienVault Open Source Security Information Management (OSSIM) 4.1 allow remote attackers to execute arbitrary SQL commands via the (1) sensor parameter in a Query action to forensics/base_qry_main.php; the (2) tcp_flags[] or (3) tcp_port[0][4] parameter to forensics/base_stat_alerts.php; the (4) ip_addr[1][8] or (5) port_type parameter to forensics/base_stat_ports.php; or the (6) sortby or (7) rvalue parameter in a search action to vulnmeter/index.php.
network
low complexity
alienvault CWE-89
7.5
2013-08-15 CVE-2013-5300 Cross-Site Scripting vulnerability in Alienvault Open Source Security Information Management
Multiple cross-site scripting (XSS) vulnerabilities in AlienVault Open Source Security Information Management (OSSIM) before 4.3.0 allow remote attackers to inject arbitrary web script or HTML via the withoutmenu parameter to (1) vulnmeter/index.php or (2) vulnmeter/sched.php; the (3) section parameter to av_inventory/task_edit.php; the (4) profile parameter to nfsen/rrdgraph.php; or the (5) scan_server or (6) targets parameter to vulnmeter/simulate.php.
network
alienvault CWE-79
4.3
2012-07-03 CVE-2012-3835 Cross-Site Scripting vulnerability in Alienvault Open Source Security Information Management 3.1
Multiple cross-site scripting (XSS) vulnerabilities in AlienVault Open Source Security Information Management (OSSIM) 3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) url parameter to top.php or (2) time[0][0] parameter to forensics/base_qry_main.php, which is not properly handled in an error page.
network
alienvault CWE-79
4.3
2012-07-03 CVE-2012-3834 SQL Injection vulnerability in Alienvault Open Source Security Information Management 3.1
SQL injection vulnerability in forensics/base_qry_main.php in AlienVault Open Source Security Information Management (OSSIM) 3.1 allows remote authenticated users to execute arbitrary SQL commands via the time[0][0] parameter.
network
low complexity
alienvault CWE-89
6.5
2009-12-21 CVE-2009-4375 SQL Injection vulnerability in Alienvault Open Source Security Information Management
SQL injection vulnerability in repository/repository_attachment.php in AlienVault Open Source Security Information Management (OSSIM) 2.1.5, and possibly other versions before 2.1.5-4, allows remote attackers to execute arbitrary SQL commands via the id_document parameter.
network
low complexity
alienvault CWE-89
7.5