OSSIM 2.2.1 - '$_SERVER['PHP_SELF']' Cross-Site Scripting

source: https://www.securityfocus.com/bid/39145/info OSSIM is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of t...

OSSIM what参数远程命令执行漏洞

BUGTRAQ ID: 38779 OSSIM即开源安全信息管理（Open Source Security Information Management），是一个非常流行和完整的开源安全管理系统。 OSSIM没有正确地过滤传送给sem/storagegraphs.php、sem/storagegraphs2.php、sem /storagegraphs3.php和sem/storagegraphs4.php页面的what参数便在命令行中使用，远程攻击者可以通过提交恶意请求导致注入并执行任意命令。 AlienVault OSSIM 2.2 厂商补丁： AlienVault --------...

OSSIM file参数目录遍历漏洞

BUGTRAQ ID: 38780 OSSIM即开源安全信息管理（Open Source Security Information Management），是一个非常流行和完整的开源安全管理系统。 OSSIM没有正确地过滤传送给repository/download.php页面的file参数，远程用户可以通过提交包含有目录遍历序列的特制请求从受影响系统下载任意本地文件。 AlienVault OSSIM 2.2 厂商补丁： AlienVault ---------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

OSSIM repository_attachment.php页面任意文件上传漏洞

BUGTRAQ ID: 37377 OSSIM即开源安全信息管理（Open Source Security Information Management），是一个非常流行和完整的开源安全管理系统。 OSSIM的ossiminstall/repository/repositoryattachment.php脚本没有正确地执行安全检查，用户可以向Webroot中的文件夹上传带有任意扩展名的文件。如果用户上传了包含有某些Web Shell的PHP脚本，就会导致执行任意PHP代码。 AlienVault OSSIM 2.2 AlienVault OSSIM 2.1.5 厂商补丁：...

OSSIM 'file' Parameter Directory Traversal Vulnerability

OSSIM is prone to a directory traversal vulnerability because it fails to sufficiently sanitize user-supplied input data. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

OSSIM (repository_attachment.php) Arbitrary File Upload Vulnerability

Exploit for unknown platform in category web applications ===================================================================== OSSIM repositoryattachment.php Arbitrary File Upload Vulnerability ===================================================================== Vulnerable: OSSIM os-sim 2.1.5...

OSSIM (file) Parameter Directory Traversal Vulnerability

Exploit for unknown platform in category web applications ======================================================== OSSIM file Parameter Directory Traversal Vulnerability ======================================================== Vulnerable: OSSIM os-sim 2.2 Not Vulnerable: OSSIM os-sim 2.2.1...

OSSIM (what) Parameter Multiple Command Execution Vulnerability

Exploit for unknown platform in category web applications ======================================================================== OSSIM 'what' Parameter Multiple Remote Command Execution Vulnerabilities ======================================================================== Vulnerable: OSSIM...

OSSIM v2.2 Multiple Vulnerabilities

Exploit for unknown platform in category web applications =================================== OSSIM v2.2 Multiple Vulnerabilities =================================== Advisory Name: Arbitrary File Download in OSSIM Vulnerability Class: Arbitrary File Download Release Date: 03-16-2010 Affected...

OSSIM download.php Directory Traversal

The version of OSSIM hosted on the remote host has a directory traversal vulnerability. Input to the 'file' parameter of the 'ossim/repository/download.php' script is not properly sanitized. A remote attacker could exploit this to download arbitrary files, subject to the privileges under which th...

OSSIM 2.2 - Multiple Vulnerabilities

OSSIM 2.2 - Multiple Vulnerabilities Advisory Name: Arbitrary File Download in OSSIM Vulnerability Class: Arbitrary File Download Release Date: 03-16-2010 Affected Applications: Confirmed in OSSIM 2.2. Other versions may also be affected. Affected Platforms: Multiple Local / Remote: Remote...

CVE-2009-4372

AlienVault Open Source Security Information Management OSSIM 2.1.5, and possibly other versions before 2.1.5-4, allows remote attackers to execute arbitrary commands via shell metacharacters in the uniqueid parameter to 1 wcl.php, 2 storagegraphs.php, 3 storagegraphs2.php, 4 storagegraphs3.php, a...

Design/Logic Flaw

AlienVault Open Source Security Information Management OSSIM 2.1.5, and possibly other versions before 2.1.5-4, allows remote attackers to execute arbitrary commands via shell metacharacters in the uniqueid parameter to 1 wcl.php, 2 storagegraphs.php, 3 storagegraphs2.php, 4 storagegraphs3.php, a...

Unrestricted file upload

Unrestricted file upload vulnerability in repository/repositoryattachment.php in AlienVault Open Source Security Information Management OSSIM 2.1.5, and possibly other versions before 2.1.5-4, allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then...

CVE-2009-4373

Unrestricted file upload vulnerability in repository/repositoryattachment.php in AlienVault Open Source Security Information Management OSSIM 2.1.5, and possibly other versions before 2.1.5-4, allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then...

CVE-2009-4375

SQL injection vulnerability in repository/repositoryattachment.php in AlienVault Open Source Security Information Management OSSIM 2.1.5, and possibly other versions before 2.1.5-4, allows remote attackers to execute arbitrary SQL commands via the iddocument parameter...

Sql injection

SQL injection vulnerability in repository/repositoryattachment.php in AlienVault Open Source Security Information Management OSSIM 2.1.5, and possibly other versions before 2.1.5-4, allows remote attackers to execute arbitrary SQL commands via the iddocument parameter...

Directory traversal

Directory traversal vulnerability in repository/repositoryattachment.php in AlienVault Open Source Security Information Management OSSIM 2.1.5, and possibly other versions before 2.1.5-4, allows remote attackers to upload files into arbitrary directories via a .. dot dot in the iddocument paramet...

CVE-2009-4374

Directory traversal vulnerability in repository/repositoryattachment.php in AlienVault Open Source Security Information Management OSSIM 2.1.5, and possibly other versions before 2.1.5-4, allows remote attackers to upload files into arbitrary directories via a .. dot dot in the iddocument paramet...

CVE-2009-4372

AlienVault Open Source Security Information Management OSSIM 2.1.5, and possibly other versions before 2.1.5-4, allows remote attackers to execute arbitrary commands via shell metacharacters in the uniqueid parameter to 1 wcl.php, 2 storagegraphs.php, 3 storagegraphs2.php, 4 storagegraphs3.php, a...