CVE-2016-8581

CVE-2016-8581 is a stored XSS vulnerability in the User-Agent header of the login process of AlienVault OSSIM/USM up to version 5.3.1, allowing an attacker to steal session IDs when an admin views current sessions. Root cause: improper handling of the User-Agent header enabling script injection. ...

CVE-2016-8580

Summary (concrete details): AlienVault OSSIM/USM before 5.3.2 is affected by a PHP object injection vulnerability caused by unsafe unserialize() usage in multiple widgets (flow_chart.php, gauge.php, honeypot.php, image.php, inventory.php, otx.php, rss.php, security.php, siem.php, taxonomy.php, ti...

CVE-2016-8582

A vulnerability exists in gauge.php of AlienVault OSSIM and USM before 5.3.2 that allows an attacker to execute an arbitrary SQL query and retrieve database information or read local system files via MySQL's LOADFILE...

CVE-2016-8580

PHP object injection vulnerabilities exist in multiple widget files in AlienVault OSSIM and USM before 5.3.2. These vulnerabilities allow arbitrary PHP code execution via magic methods in included classes...

CVE-2016-8581

A persistent XSS vulnerability exists in the User-Agent header of the login process of AlienVault OSSIM and USM before 5.3.2 that allows an attacker to steal session IDs of logged in users when the current sessions are viewed by an administrator...

PT-2016-7511

Name of the Vulnerable Software and Affected Versions AlienVault OSSIM and USM versions prior to 5.3.2 Description A vulnerability exists that allows an attacker to execute an arbitrary SQL query, potentially leading to the retrieval of database information or the reading of local system files vi...

PT-2016-7510

Name of the Vulnerable Software and Affected Versions AlienVault OSSIM and USM versions prior to 5.3.2 Description A persistent XSS issue exists in the login process, specifically in the User-Agent header, allowing an attacker to steal session IDs of logged-in users when an administrator views...

PT-2016-7512

Name of the Vulnerable Software and Affected Versions AlienVault OSSIM and USM versions prior to 5.3.2 Description The vulnerability scan scheduler in AlienVault OSSIM and USM contains a reflected XSS issue due to multiple vulnerable GET parameters. Recommendations For versions prior to 5.3.2,...

CVE-2016-8581: Improper Neutralization of Input During Web Page Generation

A persistent XSS vulnerability exists in the User-Agent header of the login process of AlienVault OSSIM and USM before 5.3.2 that allows an attacker to steal session IDs of logged in users when the current sessions are viewed by an administrator...

CVE-2016-8582: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability exists in gauge.php of AlienVault OSSIM and USM before 5.3.2 that allows an attacker to execute an arbitrary SQL query and retrieve database information or read local system files via MySQL's LOADFILE...

CVE-2016-8580: Improper Access Control

PHP object injection vulnerabilities exist in multiple widget files in AlienVault OSSIM and USM before 5.3.2. These vulnerabilities allow arbitrary PHP code execution via magic methods in included classes...

CVE-2016-8583: Improper Neutralization of Input During Web Page Generation

Multiple GET parameters in the vulnerability scan scheduler of AlienVault OSSIM and USM before 5.3.2 are vulnerable to reflected XSS...

PT-2016-7509

Name of the Vulnerable Software and Affected Versions AlienVault OSSIM and USM versions prior to 5.3.2 Description The issue allows for arbitrary PHP code execution via magic methods in included classes, which can be exploited through PHP object injection vulnerabilities found in multiple widget...

AlienVault OSSIM and USM SQL Injection Vulnerabilities

AlienVault OSSIM and USM are both products of AlienVault Corporation, U.S.A. OSSIM is an open source security information management system. USM is a security management platform that provides security monitoring, security event management and reporting, and threat awareness system. An SQL...

Alienvault OSSIM and USM Cross-Site Scripting Vulnerabilities

AlienVault OSSIM and USM are both products of AlienVault Corporation, U.S.A. OSSIM is an open source security information management system. USM is a security management platform that provides security monitoring, security event management and reporting, and threat awareness system. A cross-site...

Alienvault OSSIM and USM cross-site scripting vulnerabilities (CNVD-2016-10451)

AlienVault OSSIM is an open source security information management system.USM is a security management platform that provides security monitoring, security event management and reporting, and a threat awareness system. A cross-site scripting vulnerability exists in Alienvault OSSIM and USM, which...

CVE-2016-6913

Cross-site scripting XSS vulnerability in AlienVault OSSIM before 5.3 and USM before 5.3 allows remote attackers to inject arbitrary web script or HTML via the back parameter to ossim/conf/reload.php...

CVE-2016-6913

Cross-site scripting XSS vulnerability in AlienVault OSSIM before 5.3 and USM before 5.3 allows remote attackers to inject arbitrary web script or HTML via the back parameter to ossim/conf/reload.php...

Cross site scripting

Cross-site scripting XSS vulnerability in AlienVault OSSIM before 5.3 and USM before 5.3 allows remote attackers to inject arbitrary web script or HTML via the back parameter to ossim/conf/reload.php...

CVE-2016-6913

Cross-site scripting XSS vulnerability in AlienVault OSSIM before 5.3 and USM before 5.3 allows remote attackers to inject arbitrary web script or HTML via the back parameter to ossim/conf/reload.php...