Description
Multiple cross-site scripting (XSS) vulnerabilities in AlienVault Open Source Security Information Management (OSSIM) before 4.3.0 allow remote attackers to inject arbitrary web script or HTML via the withoutmenu parameter to (1) vulnmeter/index.php or (2) vulnmeter/sched.php; the (3) section parameter to av_inventory/task_edit.php; the (4) profile parameter to nfsen/rrdgraph.php; or the (5) scan_server or (6) targets parameter to vulnmeter/simulate.php.
References
- 95814 vdb-entry
- 95818 vdb-entry
- 54264 third-party-advisory
- 95816 vdb-entry
- http://packetstormsecurity.com/files/122547/Alienvault-OSSIM-Cross-Site-Scripting.html
- 54287 third-party-advisory
- 61456 vdb-entry
- 95813 vdb-entry
- alienvault-ossim-multiple-xss(85994) vdb-entry
- http://forums.alienvault.com/discussion/1609/patch-release-4-3-1
- 95817 vdb-entry