AlienVault OSSIM and USM Remote Command Execution Vulnerabilities

AlienVault OSSIM and USM are both products of AlienVault Corporation, U.S.A. OSSIM is an open source security information management system. USM is a security management platform that provides security monitoring, security event management and reporting, and threat awareness system. A remote...

Unspecified Vulnerability in AlienVault USM/OSSIM/NfSen

AlienVault USM and OSSIM are both products of AlienVault, Inc. in the U.S. USM is a security management platform that provides security monitoring, security event management and reporting, and a threat awareness system, among other features.OSSIM is an open-source security information management...

AlienVault OSSIM and USM SQL Injection Vulnerabilities

AlienVault OSSIM and USM are both products of AlienVault Corporation, U.S.A. OSSIM is an open source security information management system. USM is a security management platform that provides security monitoring, security event management and reporting, and threat awareness system. An SQL...

AlienVault OSSIM and USM Cross-Site Scripting Vulnerabilities

AlienVault OSSIM and USM are both products of AlienVault Corporation, U.S.A. OSSIM is an open source security information management system. USM is a security management platform that provides security monitoring, security event management and reporting, and threat awareness system. A cross-site...

AlienVault Open Source SIEM (OSSIM) 'timestamp' Parameter Directory Traversal Vulnerability

AlienVault Open Source SIEM OSSIM SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Microsoft Internet Explorer CVE-2014-1805 Remote Memory Corruption Vulnerability

Description Microsoft Internet Explorer is prone to a remote memory-corruption vulnerability. Successfully exploiting this issue may allow attackers to execute arbitrary code in the context of the application. Failed exploit attempts will result in denial-of-service conditions. Internet explorer ...

CVE-2013-5967: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in AlienVault Open Source Security Information Management OSSIM 4.3 and earlier allow remote attackers to execute arbitrary SQL commands via the datefrom parameter to 1 radar-iso27001-potential.php, 2 radar-iso27001-A12ISacquisition-pot.php, 3...

Alienvault Open Source SIEM (OSSIM) 3.1 - 'date_from' Multiple SQL Injections

source: https://www.securityfocus.com/bid/62790/info Open Source SIEM OSSIM is prone to multiple SQL-injection vulnerabilities. A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Open Sourc...

CVE-2013-5321: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in AlienVault Open Source Security Information Management OSSIM 4.1 allow remote attackers to execute arbitrary SQL commands via the 1 sensor parameter in a Query action to forensics/baseqrymain.php; the 2 tcpflags or 3 tcpport04 parameter to...

CVE-2013-5300: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in AlienVault Open Source Security Information Management OSSIM before 4.3.0 allow remote attackers to inject arbitrary web script or HTML via the withoutmenu parameter to 1 vulnmeter/index.php or 2 vulnmeter/sched.php; the 3 section parameter to...

Alienvault Open Source SIEM (OSSIM) 3.1 - Reflected Cross-Site Scripting Blind SQL Injection

Alienvault Open Source SIEM OSSIM 3.1 - Reflected Cross-Site Scripting Blind SQL Injection !/usr/bin/python ''' AlienVault has a reflected XSS vulnerability in the "url" parameter of "top.php". Proof of Concept: Enticing a logged in user to visit the following URL where an attacker is hosting an...

Alienvault Open Source SIEM (OSSIM) 3.1 - Reflected Cross-Site Scripting / Blind SQL Injection

!/usr/bin/python ''' AlienVault has a reflected XSS vulnerability in the "url" parameter of "top.php". Proof of Concept: Enticing a logged in user to visit the following URL where an attacker is hosting an cookie grabber will allow for the hijacking of the user session:...

CVE-2012-3834: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in forensics/baseqrymain.php in AlienVault Open Source Security Information Management OSSIM 3.1 allows remote authenticated users to execute arbitrary SQL commands via the time00 parameter...

CVE-2012-3835: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in AlienVault Open Source Security Information Management OSSIM 3.1 allow remote attackers to inject arbitrary web script or HTML via the 1 url parameter to top.php or 2 time00 parameter to forensics/baseqrymain.php, which is not properly handled ...

CVE-2009-4375

The CVE-2009-4375 issue affects AlienVault OSSIM 2.1.5 (and possibly earlier builds before 2.1.5-4). A SQL injection vulnerability in repository/repository_attachment.php allows remote attackers to execute arbitrary SQL commands through the id_document parameter. References and vendor entries (Re...

CVE-2009-4374: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in repository/repositoryattachment.php in AlienVault Open Source Security Information Management OSSIM 2.1.5, and possibly other versions before 2.1.5-4, allows remote attackers to upload files into arbitrary directories via a .. dot dot in the iddocument paramet...

CVE-2009-4372: Improper Input Validation

AlienVault Open Source Security Information Management OSSIM 2.1.5, and possibly other versions before 2.1.5-4, allows remote attackers to execute arbitrary commands via shell metacharacters in the uniqueid parameter to 1 wcl.php, 2 storagegraphs.php, 3 storagegraphs2.php, 4 storagegraphs3.php, a...

CVE-2009-4375: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in repository/repositoryattachment.php in AlienVault Open Source Security Information Management OSSIM 2.1.5, and possibly other versions before 2.1.5-4, allows remote attackers to execute arbitrary SQL commands via the iddocument parameter...

CVE-2009-4373: Undefined Security Weakness

Unrestricted file upload vulnerability in repository/repositoryattachment.php in AlienVault Open Source Security Information Management OSSIM 2.1.5, and possibly other versions before 2.1.5-4, allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then...