OSSIM 2.1.5 - SQL Injection

Advisory Name: SQL injection in OSSIM Vulnerability Class: SQL injection Release Date: 12-16-2009 Affected Applications: Confirmed in OSSIM 2.1.5. Other versions may also be affected. Affected Platforms: Multiple Local / Remote: Remote Severity: High – CVSS: 9 AV:N/AC:L/Au:S/C:C/I:C/A:C Researche...

OSSIM 2.1.5 - Remote Command Execution

Advisory Name: Remote Command Execution in OSSIM Vulnerability Class: Remote Command Execution Release Date: 12-16-2009 Affected Applications: Confirmed in OSSIM 2.1.5. Other versions may also be affected. Affected Platforms: Multiple Local / Remote: Remote Severity: High – CVSS: 9...

OSSIM 'host/draw_tree.php' Access Restriction Weakness Information Disclosure

The version of OSSIM running on the remote host has an unauthorized access vulnerability. It is possible to access the 'host/drawtree.php' page without providing authentication. This page includes information about the network's topology. A remote attacker could use this information to mount...

AlienVault OSSIM Web Front End Detection

The AlienVault Open Source Security Information Management OSSIM web front end was detected on the remote host. OSSIM is a suite of security tools used to monitor and maintain a network. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid42336; scriptversion"1.12";...

OSSIM Web Frontend Default Credentials

It is possible to log into the remote OSSIM web frontend by providing the default credentials. A remote attacker could exploit this to gain administrative control of the OSSIM web frontend. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc';...

CVE-2009-3440

Cross-site scripting XSS vulnerability in Open Source Security Information Management OSSIM before 2.1.2 allows remote attackers to inject arbitrary web script or HTML via the option parameter to the default URI aka the main menu...

Cross site scripting

Cross-site scripting XSS vulnerability in Open Source Security Information Management OSSIM before 2.1.2 allows remote attackers to inject arbitrary web script or HTML via the option parameter to the default URI aka the main menu...

Authentication flaw

Open Source Security Information Management OSSIM before 2.1.2 allows remote attackers to bypass authentication, and read graphs or infrastructure information, via a direct request to 1 graphs/alarmsevents.php or 2 host/drawtree.php...

Sql injection

Multiple SQL injection vulnerabilities in Open Source Security Information Management OSSIM before 2.1.2 allow remote authenticated users to execute arbitrary SQL commands via the iddocument parameter to 1 repositorydocument.php, 2 repositorylinks.php, and 3 repositoryeditdocument.php in...

CVE-2009-3439

Multiple SQL injection vulnerabilities in Open Source Security Information Management OSSIM before 2.1.2 allow remote authenticated users to execute arbitrary SQL commands via the iddocument parameter to 1 repositorydocument.php, 2 repositorylinks.php, and 3 repositoryeditdocument.php in...

CVE-2009-3441

Open Source Security Information Management OSSIM before 2.1.2 allows remote attackers to bypass authentication, and read graphs or infrastructure information, via a direct request to 1 graphs/alarmsevents.php or 2 host/drawtree.php...

CVE-2009-3440

The CVE-2009-3440 entry describes a Cross-Site Scripting (XSS) vulnerability in Open Source Security Information Management (OSSIM) prior to version 2.1.2. The issue arises from insufficient input validation on the option parameter of the default URI (the main menu), allowing remote attackers to ...

CVE-2009-3441

OSSIM (Open Source Security Information Management) is affected by CVE-2009-3441. Before version 2.1.2, remote attackers can bypass authentication and read graphs or infrastructure information by directly requesting (1) graphs/alarms_events.php or (2) host/draw_tree.php. The vulnerability arises ...

CVE-2009-3439

CVE-2009-3439 involves multiple SQL injection vulnerabilities in OSSIM prior to 2.1.2. Remote authenticated users can execute arbitrary SQL commands via parameters in several PHP scripts: repository_document.php, repository_links.php, repository_editdocument.php (repository/); policy/getpolicy.ph...

CVE-2009-3439

Multiple SQL injection vulnerabilities in Open Source Security Information Management OSSIM before 2.1.2 allow remote authenticated users to execute arbitrary SQL commands via the iddocument parameter to 1 repositorydocument.php, 2 repositorylinks.php, and 3 repositoryeditdocument.php in...

CVE-2009-3441

Open Source Security Information Management OSSIM before 2.1.2 allows remote attackers to bypass authentication, and read graphs or infrastructure information, via a direct request to 1 graphs/alarmsevents.php or 2 host/drawtree.php...

CVE-2009-3440

Cross-site scripting XSS vulnerability in Open Source Security Information Management OSSIM before 2.1.2 allows remote attackers to inject arbitrary web script or HTML via the option parameter to the default URI aka the main menu...

OSSIM 2.1 SQL Injection / XSS

OSSIM - Open Source Security Information Management is vulnerable to multiple security vulnerabilities. 1. SQL Injections 2. Linked XSS 3. Unauthorized access Digital Security Research Group DSecRG Advisory DSECRG-09-055 Application: OSSIM Versions Affected: 2.1 and may be 2.1.1 Vendor URL:...

OSSIM 2.1 SQL Injection and xss

Exploit for unknown platform in category web applications =============================== OSSIM 2.1 SQL Injection and xss =============================== OSSIM - Open Source Security Information Management is vulnerable to multiple security vulnerabilities. 1. SQL Injections 2. Linked XSS 3...

OSSIM 2.1 - SQL Injection Cross-Site Scripting

OSSIM 2.1 - SQL Injection Cross-Site Scripting OSSIM - Open Source Security Information Management is vulnerable to multiple security vulnerabilities. 1. SQL Injections 2. Linked XSS 3. Unauthorized access Digital Security Research Group DSecRG Advisory DSECRG-09-055 Application: OSSIM Versions...