← Vulnerability feed

Vulnerability record · CVE-2013-5300 · published 15 August 2013

CVE-2013-5300: Alienvault open source security information management cross-site scripting vulnerability

Alienvault · Open Source Security Information Management

Multiple cross-site scripting (XSS) vulnerabilities in AlienVault Open Source Security Information Management (OSSIM) before 4.3.0 allow remote attackers to inject arbitrary web script or HTML via the withoutmenu parameter to (1) vulnmeter/index.php or (2) vulnmeter/sched.php; the (3) section parameter to av_inventory/task_edit.php; the (4) profile parameter to nfsen/rrdgraph.php; or the (5) scan_server or (6) targets parameter to vulnmeter/simulate.php.

4.3 CVSS 2.0 Medium EPSS 1.8% · top 22.6% CWE-79 · Cross-site scripting
4.3CVSS 2.0 base score
1.8%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
22References
16 Jun 2026Last modified by NVD

Description

Multiple cross-site scripting (XSS) vulnerabilities in AlienVault Open Source Security Information Management (OSSIM) before 4.3.0 allow remote attackers to inject arbitrary web script or HTML via the withoutmenu parameter to (1) vulnmeter/index.php or (2) vulnmeter/sched.php; the (3) section parameter to av_inventory/task_edit.php; the (4) profile parameter to nfsen/rrdgraph.php; or the (5) scan_server or (6) targets parameter to vulnmeter/simulate.php.

AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://forums.alienvault.com/discussion/1609/patch-release-4-3-1
http://packetstormsecurity.com/files/122547/Alienvault-OSSIM-Cross-Site-Scripting.html
http://secunia.com/advisories/54264 Vendor Advisory
http://secunia.com/advisories/54287 Vendor Advisory
http://www.osvdb.org/show/osvdb/95813
http://www.osvdb.org/show/osvdb/95814
http://www.osvdb.org/show/osvdb/95816
http://www.osvdb.org/show/osvdb/95817
http://www.osvdb.org/show/osvdb/95818
http://www.securityfocus.com/bid/61456
https://exchange.xforce.ibmcloud.com/vulnerabilities/85994
http://forums.alienvault.com/discussion/1609/patch-release-4-3-1
http://packetstormsecurity.com/files/122547/Alienvault-OSSIM-Cross-Site-Scripting.html
http://secunia.com/advisories/54264 Vendor Advisory
http://secunia.com/advisories/54287 Vendor Advisory
http://www.osvdb.org/show/osvdb/95813
http://www.osvdb.org/show/osvdb/95814
http://www.osvdb.org/show/osvdb/95816
http://www.osvdb.org/show/osvdb/95817
http://www.osvdb.org/show/osvdb/95818
http://www.securityfocus.com/bid/61456
https://exchange.xforce.ibmcloud.com/vulnerabilities/85994

Track CVE-2013-5300 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2014-5158Alienvault open source security information management code injection vulnerabilityThe (1) av-centerd SOAP service and (2) backup command in the ossim-framework service in AlienVault OSSIM before 4.6.0 allows remote attackers to exe…EPSS 3.7%10.0CVE-2014-5210Alienvault open source security information management code injection vulnerabilityThe av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to execute arbitrary commands via a crafted (1) remote_task or (…EPSS 15%10.0CVE-2014-4151Alienvault open source security information management code injection vulnerabilityThe av-centerd SOAP service in AlienVault OSSIM before 4.8.0 allows remote attackers to create arbitrary files and execute arbitrary code via a craft…EPSS 7.3%10.0CVE-2014-4152Alienvault open source security information management code injection vulnerabilityThe av-centerd SOAP service in AlienVault OSSIM before 4.8.0 allows remote attackers to execute arbitrary code via a crafted remote_task request, rel…EPSS 5.8%10.0CVE-2014-3804AlienVault OSSIM av-centerd SOAP service command injectionThe av-centerd SOAP service in AlienVault OSSIM before 4.7.0 fails to properly validate input in several request types, allowing remote command injec…EPSS 72%analysed10.0CVE-2014-3805Alienvault open source security information management code injection vulnerabilityThe av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to execute arbitrary commands via a crafted (1) get_license, (2)…EPSS 13%9.8CVE-2018-7279Alienvault open source security information management vulnerabilityA remote code execution issue was discovered in AlienVault USM and OSSIM before 5.5.1.EPSS 2.4%7.8CVE-2014-4153Alienvault open source security information management information exposure vulnerabilityThe av-centerd SOAP service in AlienVault OSSIM before 4.8.0 allows remote attackers to read arbitrary files via a crafted get_file request.EPSS 7.4%

Source: NIST National Vulnerability Database (record CVE-2013-5300), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.