A remote code execution issue was discovered in AlienVault USM and OSSIM before 5.5.1.
The logcheck function in session.inc in AlienVault OSSIM before 5.3.1, when an action has been created, and USM before 5.3.1 allows remote attackers to bypass authentication and consequently obtain sensitive information, modify the application, or execute arbitrary code as root via an "AV Report Scheduler" HTTP User-Agent header.
The av-centerd SOAP service in AlienVault OSSIM before 4.8.0 allows remote attackers to read arbitrary files via a crafted getfile request.
The av-centerd SOAP service in AlienVault OSSIM before 4.8.0 allows remote attackers to execute arbitrary code via a crafted remotetask request, related to injecting an ssh public key.
The av-centerd SOAP service in AlienVault OSSIM before 4.8.0 allows remote attackers to create arbitrary files and execute arbitrary code via a crafted setfile request.
The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to execute arbitrary commands via a crafted (1) getlicense, (2) getlogline, or (3) updatesystem/upgradeproweb request, a different vulnerability than CVE-2014-3804.
The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to execute arbitrary commands via a crafted (1) updatesysteminfodebianpackage, (2) ossectask, (3) setossimsetup adminip, (4) syncrserver, or (5) setossimsetup frameworkip request, a different vulnerability than CVE-2014-3805.
Multiple SQL injection vulnerabilities in AlienVault Open Source Security Information Management (OSSIM) 4.1 allow remote attackers to execute arbitrary SQL commands via the (1) sensor parameter in a Query action to forensics/baseqrymain.php; the (2) tcpflags[] or (3) tcpport[0][4] parameter to forensics/basestatalerts.php; the (4) ipaddr[1][8] or (5) porttype parameter to forensics/basestatports.php; or the (6) sortby or (7) rvalue parameter in a search action to vulnmeter/index.php.
Unrestricted file upload vulnerability in repository/repositoryattachment.php in AlienVault Open Source Security Information Management (OSSIM) 2.1.5, and possibly other versions before 2.1.5-4, allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in ossiminstall/uploads/.
Multiple SQL injection vulnerabilities in Open Source Security Information Management (OSSIM) before 2.1.2 allow remote authenticated users to execute arbitrary SQL commands via the iddocument parameter to (1) repositorydocument.php, (2) repositorylinks.php, and (3) repositoryeditdocument.php in repository/; the (4) group parameter to policy/getpolicy.php; the name parameter to (5) host/newhostgroupform.php and (6) net/modifynetform.php; and unspecified other vectors related to the policy menu.
Cross-site scripting (XSS) vulnerability in Open Source Security Information Management (OSSIM) before 2.1.2 allows remote attackers to inject arbitrary web script or HTML via the option parameter to the default URI (aka the main menu).
Open Source Security Information Management (OSSIM) before 2.1.2 allows remote attackers to bypass authentication, and read graphs or infrastructure information, via a direct request to (1) graphs/alarmsevents.php or (2) host/drawtree.php.