VendorsAlienVaultopen_source_security_information_management4.2.3
Vulnerabilities

AlienVault Open Source Security Information Management (OSSIM) 4.2.3

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

7CVEs
CVE-2014-3804
The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to execute arbitrary commands via a crafted (1) update_system_info_debian_package, (2) ossec_task, (3) set_ossim_setup admin_ip, (4) sync_rserver, or (5) set_ossim_setup framework_ip request, a different vulnerability than CVE-2014-3805.
Published 2014-06-13 · Modified
10.02 PoCEPSS 0.724
CVE-2014-5210
The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to execute arbitrary commands via a crafted (1) remote_task or (2) get_license request, a different vulnerability than CVE-2014-3804 and CVE-2014-3805.
Published 2014-08-21 · Modified
10.01 PoCEPSS 0.149
CVE-2014-3805
The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to execute arbitrary commands via a crafted (1) get_license, (2) get_log_line, or (3) update_system/upgrade_pro_web request, a different vulnerability than CVE-2014-3804.
Published 2014-06-13 · Modified
10.02 PoCEPSS 0.131
CVE-2014-5158
The (1) av-centerd SOAP service and (2) backup command in the ossim-framework service in AlienVault OSSIM before 4.6.0 allows remote attackers to execute arbitrary commands via unspecified vectors.
Published 2014-08-21 · Modified
10.0EPSS 0.037
CVE-2013-5967
Multiple SQL injection vulnerabilities in AlienVault Open Source Security Information Management (OSSIM) 4.3 and earlier allow remote attackers to execute arbitrary SQL commands via the date_from parameter to (1) radar-iso27001-potential.php, (2) radar-iso27001-A12IS_acquisition-pot.php, (3) radar-iso27001-A11AccessControl-pot.php, (4) radar-iso27001-A10Com_OP_Mgnt-pot.php, or (5) radar-pci-potential.php in RadarReport/.
Published 2013-10-09 · Modified
7.51 PoCEPSS 0.190
CVE-2014-5159
SQL injection vulnerability in the ossim-framework service in AlienVault OSSIM before 4.6.0 allows remote attackers to execute arbitrary SQL commands via the ws_data parameter.
Published 2014-08-21 · Modified
7.5EPSS 0.013
CVE-2014-5383
SQL injection vulnerability in AlienVault OSSIM before 4.7.0 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Published 2014-08-21 · Modified
6.51 PoCEPSS 0.212