Vulnerabilities (CVE)

Join the Common Vulnerabilities and Exposures (CVE) community and start to get notified about new vulnerabilities.

Filtered by vendor Alienvault Subscribe
Filtered by product Ossim
Total 7 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2017-6972 2 Alienvault, Nfsen 3 Ossim, Unified Security Management, Nfsen 2019-10-02 10.0 HIGH 9.8 CRITICAL
AlienVault USM and OSSIM before 5.3.7 and NfSen before 1.3.8 have an error in privilege dropping and unnecessarily execute the NfSen Perl code as root, aka AlienVault ID ENG-104945, a different vulnerability than CVE-2017-6970 and CVE-2017-6971.
CVE-2017-6970 2 Alienvault, Nfsen 3 Ossim, Unified Security Management, Nfsen 2019-10-02 4.6 MEDIUM 8.4 HIGH
AlienVault USM and OSSIM before 5.3.7 and NfSen before 1.3.8 allow local users to execute arbitrary commands in a privileged context via an NfSen socket, aka AlienVault ID ENG-104863.
CVE-2017-6971 2 Alienvault, Nfsen 3 Ossim, Unified Security Management, Nfsen 2019-10-02 9.0 HIGH 8.8 HIGH
AlienVault USM and OSSIM before 5.3.7 and NfSen before 1.3.8 allow remote authenticated users to execute arbitrary commands in a privileged context, or launch a reverse shell, via vectors involving the PHP session ID and the NfSen PHP code, aka AlienVault ID ENG-104862.
CVE-2009-3440 1 Alienvault 1 Ossim 2018-10-10 4.3 MEDIUM N/A
Cross-site scripting (XSS) vulnerability in Open Source Security Information Management (OSSIM) before 2.1.2 allows remote attackers to inject arbitrary web script or HTML via the option parameter to the default URI (aka the main menu).
CVE-2009-3441 1 Alienvault 1 Ossim 2018-10-10 5.0 MEDIUM N/A
Open Source Security Information Management (OSSIM) before 2.1.2 allows remote attackers to bypass authentication, and read graphs or infrastructure information, via a direct request to (1) graphs/alarms_events.php or (2) host/draw_tree.php.
CVE-2009-3439 1 Alienvault 1 Ossim 2018-10-10 6.5 MEDIUM N/A
Multiple SQL injection vulnerabilities in Open Source Security Information Management (OSSIM) before 2.1.2 allow remote authenticated users to execute arbitrary SQL commands via the id_document parameter to (1) repository_document.php, (2) repository_links.php, and (3) repository_editdocument.php in repository/; the (4) group parameter to policy/getpolicy.php; the name parameter to (5) host/newhostgroupform.php and (6) net/modifynetform.php; and unspecified other vectors related to the policy menu.
CVE-2016-7955 1 Alienvault 2 Ossim, Unified Security Management 2018-10-09 7.5 HIGH 9.8 CRITICAL
The logcheck function in session.inc in AlienVault OSSIM before 5.3.1, when an action has been created, and USM before 5.3.1 allows remote attackers to bypass authentication and consequently obtain sensitive information, modify the application, or execute arbitrary code as root via an "AV Report Scheduler" HTTP User-Agent header.