AlienVault OSSIM Cross-Site Request Forgery Vulnerability

AlienVault OSSIM is an open source security information management system. AlienVault OSSIM suffers from a cross-site request forgery vulnerability that allows remote attackers to construct malicious URIs, trick users into parsing them, and can perform malicious actions in the context of the targ...

AlienVault OSSIM 4.3 Cross Site Request Forgery

Exploit Title: AlienVault - ossim CSRF Date: 10-5-2015 Exploit Author: MohamadReza Mohajerani Vendor Homepage: www.alienvault.com Software Link: https://www.alienvault.com/products/ossim Version: Tested on 4.3 Vulnerability Details: ===================== Multiple CSRF vectors exists within...

How to Protect Yourself against XcodeGhost like iOS Malware Attacks

Recently, Chinese iOS developers have discovered a new OS X and iOS malware dubbed XcodeGhost that has appeared in malicious versions of Xcode, Apple’s official toolkit for developing iOS and OS X apps. The hack of Apple’s Xcode involves infecting the compiler with malware and then passing that...

Alienvault Open Source SIEM (OSSIM) 4.3 - Cross-Site Request Forgery

Alienvault Open Source SIEM OSSIM 4.3 - Cross-Site Request Forgery Exploit Title: AlienVault - ossim CSRF Date: 10-5-2015 Exploit Author: MohamadReza Mohajerani Vendor Homepage: www.alienvault.com Software Link: https://www.alienvault.com/products/ossim Version: Tested on 4.3 Vulnerability Detail...

Alienvault Open Source SIEM (OSSIM) 4.3 - Cross-Site Request Forgery

Exploit Title: AlienVault - ossim CSRF Date: 10-5-2015 Exploit Author: MohamadReza Mohajerani Vendor Homepage: www.alienvault.com Software Link: https://www.alienvault.com/products/ossim Version: Tested on 4.3 Vulnerability Details: ===================== Multiple CSRF vectors exists within...

How to Detect IE Zero-day Exploit Used to Deploy Korplug Malware

Recently, Microsoft issued an Emergency patch for a zero-day vulnerability in Internet Explorer that is being exploited to deploy Korplug malware on vulnerable PCs. Korplug, a known variant of PlugX, is a Trojan that creates a backdoor used for information stealing on infected computers. In one o...

FBI’s Cyber Task Force Identifies Stealthy FF-RATs used in Cyber Attack

In both April and June this year, a series of cyber attacks was conducted against the United States Office of Personnel Management OPM. These attacks resulted in 21 million current and former Federal government employees’ information being stolen. After months of investigation, the FBI’s Cyber Ta...

Volatile Cedar — Global Cyber Espionage Campaign Discovered

Security firm Check Point has uncovered what seems to be a successful, and long-running, cyber-surveillance campaign called “Volatile Cedar.” Check Point found that targets of the attack included, but were not limited to, defense contractors, media companies, telecommunications, and educational...

AlienVault OSSIM NBE Protocol SQL Injection Vulnerability

AlienVault OSSIM or Open Source Security Information Management is a popular open source security management system. AlienVault OSSIM handles the NBE protocol with an SQL injection vulnerability that allows remote attackers to exploit the vulnerability by submitting specially crafted SQL queries ...

AlienVault OSSIM NBE hostname/IP handling command execution vulnerability

AlienVault OSSIM or Open Source Security Information Management is a popular open source security management system. AlienVault OSSIM handles the existence of an input validation vulnerability in NBE hostname/IP, which allows remote attackers to exploit the vulnerability by submitting a specially...

AlienVault OSSIM NBE import hostname/IP cross-site scripting vulnerability

AlienVault OSSIM or Open Source Security Information Management is a popular open source security management system. AlienVault OSSIM handles NBE imported hostname/ip with a cross-site scripting vulnerability that allows remote attackers to exploit the vulnerability to inject malicious scripts or...

Alienvault OSSIM/USM Multiple Vulnerabilities

Details ======= Product: Alienvault OSSIM/USM Vulnerability: Multiple Vulnerabilities XSS, SQLi, Command Execution Author: Peter Lapp, [email protected] CVE: None assigned Vulnerable Versions: Tested on 4.14, 4.15, and 5.0. It likely affects all previous versions as well. Fixed Version: No fix ha...

Alienvault OSSIMUSM 4.144.155.0 - Multiple Vulnerabilities

Alienvault OSSIMUSM 4.144.155.0 - Multiple Vulnerabilities Details ======= Product: Alienvault OSSIM/USM Vulnerability: Multiple Vulnerabilities XSS, SQLi, Command Execution Author: Peter Lapp, [email protected] CVE: None assigned Vulnerable Versions: Tested on 4.14, 4.15, and 5.0. It likely...

Alienvault OSSIM/USM 4.14/4.15/5.0 - Multiple Vulnerabilities

Details ======= Product: Alienvault OSSIM/USM Vulnerability: Multiple Vulnerabilities XSS, SQLi, Command Execution Author: Peter Lapp, [email protected] CVE: None assigned Vulnerable Versions: Tested on 4.14, 4.15, and 5.0. It likely affects all previous versions as well. Fixed Version: No fix ha...

Alienvault OSSIM/USM 4.x / 5.0 XSS / SQL Injection / Command Execution

Details ======= Product: Alienvault OSSIM/USM Vulnerability: Multiple Vulnerabilities XSS, SQLi, Command Execution Author: Peter Lapp, [email protected] CVE: None assigned Vulnerable Versions: Tested on 4.14, 4.15, and 5.0. It likely affects all previous versions as well. Fixed Version: No fix ha...

Code injection

The Framework Daemon in AlienVault Unified Security Management before 4.15 allows remote attackers to execute arbitrary Python code via a crafted plugin configuration file .cfg...

CVE-2015-3446

Affected software/component: AlienVault Unified Security Management (USM) — Framework Daemon. Vulnerability: remote attackers can execute arbitrary Python code by sending a crafted plugin configuration file (.cfg). Root cause/impact: the flaw allows code execution with root privileges and does no...

AlienVault Unified Security Management Remote Code Execution Vulnerability

AlienVault Unified Security Management is a security management platform that provides security monitoring, security event management and reporting, and a threat awareness system. A remote code execution vulnerability exists in the AlienVault Framework backend process of AlienVault USM that allow...

CVE-2015-3446: Improper Control of Generation of Code

The Framework Daemon in AlienVault Unified Security Management before 4.15 allows remote attackers to execute arbitrary Python code via a crafted plugin configuration file .cfg...

PT-2015-6231

Name of the Vulnerable Software and Affected Versions AlienVault Unified Security Management versions prior to 4.15 Description The issue allows remote attackers to execute arbitrary Python code via a crafted plugin configuration file. This can be achieved by manipulating the plugin configuration...