The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to execute arbitrary commands via a crafted (1) getlicense, (2) getlogline, or (3) updatesystem/upgradeproweb request, a different vulnerability than CVE-2014-3804.

The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to execute arbitrary commands via a crafted (1) updatesysteminfodebianpackage, (2) ossectask, (3) setossimsetup adminip, (4) syncrserver, or (5) setossimsetup frameworkip request, a different vulnerability than CVE-2014-3805.

Multiple SQL injection vulnerabilities in AlienVault Open Source Security Information Management (OSSIM) 4.1 allow remote attackers to execute arbitrary SQL commands via the (1) sensor parameter in a Query action to forensics/baseqrymain.php; the (2) tcpflags[] or (3) tcpport[0][4] parameter to forensics/basestatalerts.php; the (4) ipaddr[1][8] or (5) porttype parameter to forensics/basestatports.php; or the (6) sortby or (7) rvalue parameter in a search action to vulnmeter/index.php.