Vulnerabilities > Openvas

DATE CVE VULNERABILITY TITLE RISK
2020-02-06 CVE-2011-1597 Unrestricted Upload of File with Dangerous Type vulnerability in Openvas Manager 2.0.3
OpenVAS Manager v2.0.3 allows plugin remote code execution.
network
low complexity
openvas CWE-434
6.5
2019-11-25 CVE-2011-3351 Link Following vulnerability in Openvas Openvas-Scanner
openvas-scanner before 2011-09-11 creates a temporary file insecurely when generating OVAL system characteristics document with the ovaldi integrated tool enabled.
local
low complexity
openvas CWE-59
6.6
2014-12-03 CVE-2014-9220 SQL Injection vulnerability in multiple products
SQL injection vulnerability in OpenVAS Manager before 4.0.6 and 5.x before 5.0.7 allows remote attackers to execute arbitrary SQL commands via the timezone parameter in a modify_schedule OMP command.
network
low complexity
fedoraproject openvas opensuse CWE-89
7.5
2014-05-19 CVE-2013-6766 Improper Authentication vulnerability in Openvas Administrator
OpenVAS Administrator 1.2 before 1.2.2 and 1.3 before 1.3.2 allows remote attackers to bypass the OAP authentication restrictions and execute OAP commands via a crafted OAP request for version information, which causes the state to be set to CLIENT_AUTHENTIC.
network
low complexity
openvas CWE-287
7.5
2014-05-19 CVE-2013-6765 Improper Authentication vulnerability in Openvas Manager
OpenVAS Manager 3.0 before 3.0.7 and 4.0 before 4.0.4 allows remote attackers to bypass the OMP authentication restrictions and execute OMP commands via a crafted OMP request for version information, which causes the state to be set to CLIENT_AUTHENTIC, as demonstrated by the omp_xml_handle_end_element function in omp.c.
network
low complexity
openvas CWE-287
7.5
2012-11-26 CVE-2012-5520 Improper Input Validation vulnerability in Openvas Manager
The send_to_sourcefire function in manage_sql.c in OpenVAS Manager 3.x before 3.0.4 allows remote attackers to execute arbitrary commands via the (1) IP address or (2) port number field in an OMP request.
network
low complexity
openvas CWE-20
7.5
2011-01-28 CVE-2011-0018 Improper Input Validation vulnerability in Openvas Manager
The email function in manage_sql.c in OpenVAS Manager 1.0.x through 1.0.3 and 2.0.x through 2.0rc2 allows remote authenticated users to execute arbitrary commands via the (1) To or (2) From e-mail address in an OMP request to the Greenbone Security Assistant (GSA).
network
low complexity
openvas CWE-20
critical
9.0