OpenVAS Manager OMP Request Handling Command Injection Vulnerability

OpenVAS Manager is prone to a command injection vulnerability. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

omp2-brute NSE Script

Performs brute force password auditing against the OpenVAS manager using OMPv2. Script Arguments passdb, unpwdb.passlimit, unpwdb.timelimit, unpwdb.userlimit, userdb See the documentation for the unpwdb library. creds.service, creds.global See the documentation for the creds library...

omp2-enum-targets NSE Script

Attempts to retrieve the list of target systems and networks from an OpenVAS Manager server. The script authenticates on the manager using provided or previously cracked credentials and gets the list of defined targets for each account. These targets will be added to the scanning queue in case...

OpenVAS Manager - Command Injection

OpenVAS Manager - Command Injection Source: http://securityreason.com/securityalert/8048 Summary It has been identified that OpenVAS Manager is vulnerable to command injection due to insufficient validation of user supplied data when processing OMP requests. It has been identified that this...

CVE-2011-0650

Cross-site request forgery CSRF vulnerability in Greenbone Security Assistant GSA before 2.0+rc3 allows remote attackers to hijack the authentication of users for requests that send email via an OMP request to OpenVAS Manager. NOTE: this issue can be leveraged to bypass authentication requirement...

CVE-2011-0018

The email function in managesql.c in OpenVAS Manager 1.0.x through 1.0.3 and 2.0.x through 2.0rc2 allows remote authenticated users to execute arbitrary commands via the 1 To or 2 From e-mail address in an OMP request to the Greenbone Security Assistant GSA...

Cross site request forgery (csrf)

The email function in managesql.c in OpenVAS Manager 1.0.x through 1.0.3 and 2.0.x through 2.0rc2 allows remote authenticated users to execute arbitrary commands via the 1 To or 2 From e-mail address in an OMP request to the Greenbone Security Assistant GSA...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Greenbone Security Assistant GSA before 2.0+rc3 allows remote attackers to hijack the authentication of users for requests that send email via an OMP request to OpenVAS Manager. NOTE: this issue can be leveraged to bypass authentication requirement...

CVE-2011-0650

CVE-2011-0650 concerns Greenbone Security Assistant (GSA) prior to 2.0+rc3. The issue is a CSRF vulnerability that allows an attacker to hijack the user’s authenticated session to issue OMP requests to OpenVAS Manager (e.g., sending email). This is tied to exploitation of CVE-2011-0018 via the GS...

CVE-2011-0018

The email function in managesql.c in OpenVAS Manager 1.0.x through 1.0.3 and 2.0.x through 2.0rc2 allows remote authenticated users to execute arbitrary commands via the 1 To or 2 From e-mail address in an OMP request to the Greenbone Security Assistant GSA...

CVE-2011-0650

Cross-site request forgery CSRF vulnerability in Greenbone Security Assistant GSA before 2.0+rc3 allows remote attackers to hijack the authentication of users for requests that send email via an OMP request to OpenVAS Manager. NOTE: this issue can be leveraged to bypass authentication requirement...

CVE-2011-0650: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in Greenbone Security Assistant GSA before 2.0+rc3 allows remote attackers to hijack the authentication of users for requests that send email via an OMP request to OpenVAS Manager. NOTE: this issue can be leveraged to bypass authentication requirement...

CVE-2011-0018: Improper Input Validation

The email function in managesql.c in OpenVAS Manager 1.0.x through 1.0.3 and 2.0.x through 2.0rc2 allows remote authenticated users to execute arbitrary commands via the 1 To or 2 From e-mail address in an OMP request to the Greenbone Security Assistant GSA...