alienvault unified security management vulnerabilities and exploits

(subscribe to this query)

10

CVSSv2

AlienVault USM and OSSIM prior to 5.3.7 and NfSen prior to 1.3.8 have an error in privilege dropping and unnecessarily execute the NfSen Perl code as root, aka AlienVault ID ENG-104945, a different vulnerability than CVE-2017-6970 and CVE-2017-6971.

Alienvault Ossim Alienvault Unified Security Management Nfsen Nfsen

1 EDB exploit

9.3

CVSSv2

The Framework Daemon in AlienVault Unified Security Management prior to 4.15 allows remote malicious users to execute arbitrary Python code via a crafted plugin configuration file (.cfg).

Alienvault Unified Security Management

9

CVSSv2

AlienVault USM and OSSIM prior to 5.3.7 and NfSen prior to 1.3.8 allow remote authenticated users to execute arbitrary commands in a privileged context, or launch a reverse shell, via vectors involving the PHP session ID and the NfSen PHP code, aka AlienVault ID ENG-104862.

Alienvault Ossim Alienvault Unified Security Management Nfsen Nfsen

1 EDB exploit1 Github repository

7.5

CVSSv2

A remote code execution issue exists in AlienVault USM and OSSIM prior to 5.5.1.

Alienvault Unified Security Management Alienvault Open Source Security Information Management

7.5

CVSSv2

The logcheck function in session.inc in AlienVault OSSIM prior to 5.3.1, when an action has been created, and USM prior to 5.3.1 allows remote malicious users to bypass authentication and consequently obtain sensitive information, modify the application, or execute arbitrary code...

Alienvault Unified Security Management Alienvault Ossim

7.5

CVSSv2

PHP object injection vulnerabilities exist in multiple widget files in AlienVault OSSIM and USM prior to 5.3.2. These vulnerabilities allow arbitrary PHP code execution via magic methods in included classes.

Alienvault Unified Security Management Alienvault Open Source Security Information And Event Management

2 EDB exploits

7.5

CVSSv2

A vulnerability exists in gauge.php of AlienVault OSSIM and USM prior to 5.3.2 that allows an malicious user to execute an arbitrary SQL query and retrieve database information or read local system files via MySQL's LOAD_FILE.

Alienvault Unified Security Management Alienvault Open Source Security Information And Event Management

1 EDB exploit

4.6

CVSSv2

AlienVault USM and OSSIM prior to 5.3.7 and NfSen prior to 1.3.8 allow local users to execute arbitrary commands in a privileged context via an NfSen socket, aka AlienVault ID ENG-104863.

Alienvault Unified Security Management Alienvault Ossim Nfsen Nfsen

1 EDB exploit

4.3

CVSSv2

A persistent XSS vulnerability exists in the User-Agent header of the login process of AlienVault OSSIM and USM prior to 5.3.2 that allows an malicious user to steal session IDs of logged in users when the current sessions are viewed by an administrator.

Alienvault Unified Security Management Alienvault Open Source Security Information And Event Management

1 EDB exploit

4.3

CVSSv2

Multiple GET parameters in the vulnerability scan scheduler of AlienVault OSSIM and USM prior to 5.3.2 are vulnerable to reflected XSS.

Alienvault Open Source Security Information And Event Management Alienvault Unified Security Management

Get Started

1 2 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook