Openvas Manager vulnerabilities
5 known vulnerabilities affecting openvas/openvas_manager.
Total CVEs
5
CISA KEV
0
Public exploits
2
Exploited in wild
0
Severity breakdown
CRITICAL1HIGH4
Vulnerabilities
Page 1 of 1
CVE-2013-6765P2HIGHCVSS 7.5PoCv4.0v4.0.0+11 more2014-05-19
CVE-2013-6765 [HIGH] CWE-287 CVE-2013-6765: OpenVAS Manager 3.0 before 3.0.7 and 4.0 before 4.0.4 allows remote attackers to bypass the OMP auth
OpenVAS Manager 3.0 before 3.0.7 and 4.0 before 4.0.4 allows remote attackers to bypass the OMP authentication restrictions and execute OMP commands via a crafted OMP request for version information, which causes the state to be set to CLIENT_AUTHENTIC, as demonstrated by the omp_xml_handle_end_element function in omp.c.
nvd
CVE-2011-0018P2CRITICALCVSS 9.0PoCv1.0.0v1.0.1+3 more2011-01-28
CVE-2011-0018 [CRITICAL] CWE-20 CVE-2011-0018: The email function in manage_sql.c in OpenVAS Manager 1.0.x through 1.0.3 and 2.0.x through 2.0rc2 a
The email function in manage_sql.c in OpenVAS Manager 1.0.x through 1.0.3 and 2.0.x through 2.0rc2 allows remote authenticated users to execute arbitrary commands via the (1) To or (2) From e-mail address in an OMP request to the Greenbone Security Assistant (GSA).
nvd
CVE-2011-1597P3HIGHCVSS 8.8v2.0.32020-02-06
CVE-2011-1597 [HIGH] CWE-434 CVE-2011-1597: OpenVAS Manager v2.0.3 allows plugin remote code execution.
OpenVAS Manager v2.0.3 allows plugin remote code execution.
nvd
CVE-2012-5520P3HIGHCVSS 7.5v3.0v3.0.0+3 more2012-11-26
CVE-2012-5520 [HIGH] CWE-20 CVE-2012-5520: The send_to_sourcefire function in manage_sql.c in OpenVAS Manager 3.x before 3.0.4 allows remote at
The send_to_sourcefire function in manage_sql.c in OpenVAS Manager 3.x before 3.0.4 allows remote attackers to execute arbitrary commands via the (1) IP address or (2) port number field in an OMP request.
nvd
CVE-2014-9220P3HIGHCVSS 7.5≤ 4.0.5v5.0.0+6 more2014-12-03
CVE-2014-9220 [HIGH] CWE-89 CVE-2014-9220: SQL injection vulnerability in OpenVAS Manager before 4.0.6 and 5.x before 5.0.7 allows remote attac
SQL injection vulnerability in OpenVAS Manager before 4.0.6 and 5.x before 5.0.7 allows remote attackers to execute arbitrary SQL commands via the timezone parameter in a modify_schedule OMP command.
nvd