Vulnerabilities

The asset discovery scanner in AlienVault OSSIM before 5.0.1 allows remote authenticated users to execute arbitrary commands via the assets array parameter to netscan/do_scan.php.

CVSS 3.0HIGH 7.2 Network High privileges No interaction EPSS 0.02713 Published 2017-05-23 No fix listed CWE-77

TI-2015-03411 CVE-2015-4045 · GHSA-qgc6-mjxf-r37q

The sudoers file in the asset discovery scanner in AlienVault OSSIM before 5.0.1 allows…

LOW 30

The sudoers file in the asset discovery scanner in AlienVault OSSIM before 5.0.1 allows local users to gain privileges via a crafted nmap script.

CVSS 3.0MEDIUM 6.7 Local High privileges No interaction EPSS 0.00507 Published 2017-05-23 No fix listed CWE-264

TI-2014-04386 CVE-2014-5383 · GHSA-wfh6-gvgq-pjxg

SQL injection vulnerability in AlienVault OSSIM before 4.7.0 allows remote authenticated…

MEDIUM 48

SQL injection vulnerability in AlienVault OSSIM before 4.7.0 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.21193 Published 2014-08-21 No fix listed CWE-89

TI-2014-04259 CVE-2014-5210 · GHSA-3f7x-rf2q-c7q4

The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to…

MEDIUM 59

The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to execute arbitrary commands via a crafted (1) remote_task or (2) get_license request, a different vulnerability than CVE-2014-3804 an…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.14917 Published 2014-08-21 No fix listed CWE-94

TI-2014-04211 CVE-2014-5159 · GHSA-4xq4-6mh8-33mw

SQL injection vulnerability in the ossim-framework service in AlienVault OSSIM before…

LOW 35

SQL injection vulnerability in the ossim-framework service in AlienVault OSSIM before 4.6.0 allows remote attackers to execute arbitrary SQL commands via the ws_data parameter.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.01264 Published 2014-08-21 No fix listed CWE-89

TI-2014-04210 CVE-2014-5158 · GHSA-xx3f-8qwx-w9mh

The (1) av-centerd SOAP service and (2) backup command in the ossim-framework service in…

MEDIUM 49

The (1) av-centerd SOAP service and (2) backup command in the ossim-framework service in AlienVault OSSIM before 4.6.0 allows remote attackers to execute arbitrary commands via unspecified vectors.

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.0368 Published 2014-08-21 No fix listed CWE-94

TI-2014-03392 CVE-2014-4153 · GHSA-p797-qm67-pc8g

The av-centerd SOAP service in AlienVault OSSIM before 4.8.0 allows remote attackers to…

MEDIUM 44

The av-centerd SOAP service in AlienVault OSSIM before 4.8.0 allows remote attackers to read arbitrary files via a crafted get_file request.

CVSS 2.0HIGH 7.8 Network No auth Interaction — EPSS 0.07385 Published 2014-06-18 No fix listed CWE-200

TI-2014-03391 CVE-2014-4152 · GHSA-328r-mqrg-8jf9

The av-centerd SOAP service in AlienVault OSSIM before 4.8.0 allows remote attackers to…

MEDIUM 52

The av-centerd SOAP service in AlienVault OSSIM before 4.8.0 allows remote attackers to execute arbitrary code via a crafted remote_task request, related to injecting an ssh public key.

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.05785 Published 2014-06-18 No fix listed CWE-94

TI-2014-03390 CVE-2014-4151 · GHSA-p888-ppq3-6f8c

The av-centerd SOAP service in AlienVault OSSIM before 4.8.0 allows remote attackers to…

MEDIUM 53

The av-centerd SOAP service in AlienVault OSSIM before 4.8.0 allows remote attackers to create arbitrary files and execute arbitrary code via a crafted set_file request.

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.07321 Published 2014-06-18 No fix listed CWE-94

TI-2014-03085 CVE-2014-3805 · GHSA-f68v-p32j-mqvq

The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to…

MEDIUM 57

The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to execute arbitrary commands via a crafted (1) get_license, (2) get_log_line, or (3) update_system/upgrade_pro_web request, a differen…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.13072 Published 2014-06-13 No fix listed CWE-94

TI-2014-03084 CVE-2014-3804 · GHSA-wmc3-5pmj-wx7f

The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to…

HIGH 81

The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to execute arbitrary commands via a crafted (1) update_system_info_debian_package, (2) ossec_task, (3) set_ossim_setup admin_ip, (4) sy…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.72376 Published 2014-06-13 No fix listed CWE-94

TI-2013-05087 CVE-2013-5967 · GHSA-j2fr-pq6r-hv6g

Multiple SQL injection vulnerabilities in AlienVault Open Source Security Information…

MEDIUM 51

Multiple SQL injection vulnerabilities in AlienVault Open Source Security Information Management (OSSIM) 4.3 and earlier allow remote attackers to execute arbitrary SQL commands via the date_from parameter to (1) radar-i…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.19022 Published 2013-10-09 No fix listed CWE-89

TI-2013-04559 CVE-2013-5321 · GHSA-49ch-p8j2-r7x6

Multiple SQL injection vulnerabilities in AlienVault Open Source Security Information…

LOW 36

Multiple SQL injection vulnerabilities in AlienVault Open Source Security Information Management (OSSIM) 4.1 allow remote attackers to execute arbitrary SQL commands via the (1) sensor parameter in a Query action to fore…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.01369 Published 2013-08-20 No fix listed CWE-89

TI-2013-04538 CVE-2013-5300 · GHSA-fr4p-9696-xcx8

Multiple cross-site scripting (XSS) vulnerabilities in AlienVault Open Source Security…

LOW 24

Multiple cross-site scripting (XSS) vulnerabilities in AlienVault Open Source Security Information Management (OSSIM) before 4.3.0 allow remote attackers to inject arbitrary web script or HTML via the withoutmenu paramet…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01779 Published 2013-08-15 No fix listed CWE-79

TI-2012-03317 CVE-2012-3835 · GHSA-53jh-jfqq-xpqp

Multiple cross-site scripting (XSS) vulnerabilities in AlienVault Open Source Security…

LOW 24

Multiple cross-site scripting (XSS) vulnerabilities in AlienVault Open Source Security Information Management (OSSIM) 3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) url parameter to top.php…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02201 Published 2012-07-03 No fix listed CWE-79

TI-2012-03316 CVE-2012-3834 · GHSA-wcq8-87g7-jxwc

SQL injection vulnerability in forensics/base_qry_main.php in AlienVault Open Source…

LOW 32

SQL injection vulnerability in forensics/base_qry_main.php in AlienVault Open Source Security Information Management (OSSIM) 3.1 allows remote authenticated users to execute arbitrary SQL commands via the time[0][0] para…

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.01424 Published 2012-07-03 No fix listed CWE-89

TI-2009-04138 CVE-2009-4375 · GHSA-xpwf-qvcr-m7xh

SQL injection vulnerability in repository/repository_attachment.php in AlienVault Open…

LOW 35

SQL injection vulnerability in repository/repository_attachment.php in AlienVault Open Source Security Information Management (OSSIM) 2.1.5, and possibly other versions before 2.1.5-4, allows remote attackers to execute…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.00971 Published 2009-12-21 No fix listed CWE-89

TI-2009-04137 CVE-2009-4374 · GHSA-xw5h-h3cf-m4mx

Directory traversal vulnerability in repository/repository_attachment.php in AlienVault…

LOW 36

Directory traversal vulnerability in repository/repository_attachment.php in AlienVault Open Source Security Information Management (OSSIM) 2.1.5, and possibly other versions before 2.1.5-4, allows remote attackers to up…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.01641 Published 2009-12-21 No fix listed CWE-22

TI-2009-04136 CVE-2009-4373 · GHSA-f7qg-rpxj-p56c

Unrestricted file upload vulnerability in repository/repository_attachment.php in…

LOW 38

Unrestricted file upload vulnerability in repository/repository_attachment.php in AlienVault Open Source Security Information Management (OSSIM) 2.1.5, and possibly other versions before 2.1.5-4, allows remote attackers…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.02984 Published 2009-12-21 No fix listed

TI-2009-04135 CVE-2009-4372 · GHSA-jvj4-v8pq-3c7q

AlienVault Open Source Security Information Management (OSSIM) 2.1.5, and possibly other…

MEDIUM 41

AlienVault Open Source Security Information Management (OSSIM) 2.1.5, and possibly other versions before 2.1.5-4, allows remote attackers to execute arbitrary commands via shell metacharacters in the uniqueid parameter t…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.04819 Published 2009-12-21 No fix listed CWE-20