Alienvault vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2013-6056 OSSIM before 4.3.3.1 has tele_compress.php path traversalHigh 7.5 · Jan 27, 2020
• CVE-2018-7279 A remote code execution issue was discovered in AlienVault USM and OSSIM before 5.5.1.Critical 9.8 · Mar 14, 2018
• CVE-2015-4046 The asset discovery scanner in AlienVault OSSIM before 5.0.1 allows remote authenticated users to execute arbitrary commands via the assets array parameter to nHigh 7.2 · May 23, 2017
• CVE-2017-6972 AlienVault USM and OSSIM before 5.3.7 and NfSen before 1.3.8 have an error in privilege dropping and unnecessarily execute the NfSen Perl code as root, aka AlieCritical 9.8 · Mar 22, 2017
• CVE-2017-6971 AlienVault USM and OSSIM before 5.3.7 and NfSen before 1.3.8 allow remote authenticated users to execute arbitrary commands in a privileged context, or launch aHigh 8.8 · Mar 22, 2017
• CVE-2017-6970 AlienVault USM and OSSIM before 5.3.7 and NfSen before 1.3.8 allow local users to execute arbitrary commands in a privileged context via an NfSen socket, aka AlHigh 8.4 · Mar 22, 2017
• CVE-2016-7955 The logcheck function in session.inc in AlienVault OSSIM before 5.3.1, when an action has been created, and USM before 5.3.1 allows remote attackers to bypass aCritical 9.8 · Mar 15, 2017
• CVE-2016-8582 A vulnerability exists in gauge.php of AlienVault OSSIM and USM before 5.3.2 that allows an attacker to execute an arbitrary SQL query and retrieve database infCritical 9.8 · Oct 28, 2016
• CVE-2016-8580 PHP object injection vulnerabilities exist in multiple widget files in AlienVault OSSIM and USM before 5.3.2.Critical 9.8 · Oct 28, 2016
• CVE-2015-3446 The Framework Daemon in AlienVault Unified Security Management before 4.15 allows remote attackers to execute arbitrary Python code via a crafted plugin configuHigh 9.3 · May 1, 2015
• CVE-2014-5210 The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to execute arbitrary commands via a crafted (1) remote_task or (2) get_liceHigh 10 · Aug 21, 2014
• CVE-2014-5159 SQL injection vulnerability in the ossim-framework service in AlienVault OSSIM before 4.6.0 allows remote attackers to execute arbitrary SQL commands via the wsHigh 7.5 · Aug 21, 2014
• CVE-2014-5158 The (1) av-centerd SOAP service and (2) backup command in the ossim-framework service in AlienVault OSSIM before 4.6.0 allows remote attackers to execute arbitrHigh 10 · Aug 21, 2014
• CVE-2014-4153 The av-centerd SOAP service in AlienVault OSSIM before 4.8.0 allows remote attackers to read arbitrary files via a crafted get_file request.High 7.8 · Jun 18, 2014
• CVE-2014-4152 The av-centerd SOAP service in AlienVault OSSIM before 4.8.0 allows remote attackers to execute arbitrary code via a crafted remote_task request, related to injHigh 10 · Jun 18, 2014
• CVE-2014-4151 The av-centerd SOAP service in AlienVault OSSIM before 4.8.0 allows remote attackers to create arbitrary files and execute arbitrary code via a crafted set_fileHigh 10 · Jun 18, 2014
• CVE-2014-3805 The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to execute arbitrary commands via a crafted (1) get_license, (2) get_log_liHigh 10 · Jun 13, 2014
• CVE-2014-3804 The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to execute arbitrary commands via a crafted (1) update_system_info_debian_pHigh 10 · Jun 13, 2014
• CVE-2013-5967 Multiple SQL injection vulnerabilities in AlienVault Open Source Security Information Management (OSSIM) 4.3 and earlier allow remote attackers to execute arbitHigh 7.5 · Oct 9, 2013
• CVE-2013-5321 Multiple SQL injection vulnerabilities in AlienVault Open Source Security Information Management (OSSIM) 4.1 allow remote attackers to execute arbitrary SQL comHigh 7.5 · Aug 20, 2013
• CVE-2009-4375 SQL injection vulnerability in repository/repository_attachment.php in AlienVault Open Source Security Information Management (OSSIM) 2.1.5, and possibly other High 7.5 · Dec 21, 2009
• CVE-2009-4374 Directory traversal vulnerability in repository/repository_attachment.php in AlienVault Open Source Security Information Management (OSSIM) 2.1.5, and possibly High 7.5 · Dec 21, 2009
• CVE-2009-4373 Unrestricted file upload vulnerability in repository/repository_attachment.php in AlienVault Open Source Security Information Management (OSSIM) 2.1.5, and possHigh 7.5 · Dec 21, 2009
• CVE-2009-4372 AlienVault Open Source Security Information Management (OSSIM) 2.1.5, and possibly other versions before 2.1.5-4, allows remote attackers to execute arbitrary cHigh 7.5 · Dec 21, 2009