{"api_version":"1","generated_at":"2026-07-23T02:32:51+00:00","cve":"CVE-2012-3835","urls":{"html":"https://cve.report/CVE-2012-3835","api":"https://cve.report/api/cve/CVE-2012-3835.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2012-3835","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2012-3835"},"summary":{"title":"CVE-2012-3835","description":"Multiple cross-site scripting (XSS) vulnerabilities in AlienVault Open Source Security Information Management (OSSIM) 3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) url parameter to top.php or (2) time[0][0] parameter to forensics/base_qry_main.php, which is not properly handled in an error page.","state":"PUBLISHED","assigner":"mitre","published_at":"2012-07-03 22:55:02","updated_at":"2026-04-29 01:13:23"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.securityfocus.com/bid/53331","name":"http://www.securityfocus.com/bid/53331","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"AlienVault Open Source SIEM (OSSIM) SQL Injection and Cross Site Scripting Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://secunia.com/advisories/49005","name":"http://secunia.com/advisories/49005","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Security Advisory SA49005 - OSSIM Cross-Site Scripting and SQL Injection Vulnerabilities - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.exploit-db.com/exploits/18800","name":"http://www.exploit-db.com/exploits/18800","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"Alienvault OSSIM Open Source SIEM 3.1 Multiple Security Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.koramis.com/advisories/2012/KORAMIS-ADV2012-002.txt","name":"http://www.koramis.com/advisories/2012/KORAMIS-ADV2012-002.txt","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"Seite wurde nicht gefunden. - KORAMIS - Cybersecurity by telent","mime":"text/html","httpstatus":"404","archivestatus":"200"},{"url":"http://www.darksecurity.de/index.php?/211-KORAMIS-ADV2012-002-Alienvault-OSSIM-Open-Source-SIEM-3.1-Multiple-security-vulnerabilities.html","name":"http://www.darksecurity.de/index.php?/211-KORAMIS-ADV2012-002-Alienvault-OSSIM-Open-Source-SIEM-3.1-Multiple-security-vulnerabilities.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"advisory,security,Sicherheit,xss,sql injection","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/75297","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/75297","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-3835","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-3835","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2012","cve_id":"3835","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"alienvault","cpe5":"open_source_security_information_management","cpe6":"3.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T20:21:03.279Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"53331","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/53331"},{"name":"18800","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"],"url":"http://www.exploit-db.com/exploits/18800"},{"name":"49005","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/49005"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.koramis.com/advisories/2012/KORAMIS-ADV2012-002.txt"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.darksecurity.de/index.php?/211-KORAMIS-ADV2012-002-Alienvault-OSSIM-Open-Source-SIEM-3.1-Multiple-security-vulnerabilities.html"},{"name":"alienvault-multiple-xss(75297)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/75297"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2012-04-28T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple cross-site scripting (XSS) vulnerabilities in AlienVault Open Source Security Information Management (OSSIM) 3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) url parameter to top.php or (2) time[0][0] parameter to forensics/base_qry_main.php, which is not properly handled in an error page."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-08-28T12:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"53331","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/53331"},{"name":"18800","tags":["exploit","x_refsource_EXPLOIT-DB"],"url":"http://www.exploit-db.com/exploits/18800"},{"name":"49005","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/49005"},{"tags":["x_refsource_MISC"],"url":"http://www.koramis.com/advisories/2012/KORAMIS-ADV2012-002.txt"},{"tags":["x_refsource_MISC"],"url":"http://www.darksecurity.de/index.php?/211-KORAMIS-ADV2012-002-Alienvault-OSSIM-Open-Source-SIEM-3.1-Multiple-security-vulnerabilities.html"},{"name":"alienvault-multiple-xss(75297)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/75297"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2012-3835","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple cross-site scripting (XSS) vulnerabilities in AlienVault Open Source Security Information Management (OSSIM) 3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) url parameter to top.php or (2) time[0][0] parameter to forensics/base_qry_main.php, which is not properly handled in an error page."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"53331","refsource":"BID","url":"http://www.securityfocus.com/bid/53331"},{"name":"18800","refsource":"EXPLOIT-DB","url":"http://www.exploit-db.com/exploits/18800"},{"name":"49005","refsource":"SECUNIA","url":"http://secunia.com/advisories/49005"},{"name":"http://www.koramis.com/advisories/2012/KORAMIS-ADV2012-002.txt","refsource":"MISC","url":"http://www.koramis.com/advisories/2012/KORAMIS-ADV2012-002.txt"},{"name":"http://www.darksecurity.de/index.php?/211-KORAMIS-ADV2012-002-Alienvault-OSSIM-Open-Source-SIEM-3.1-Multiple-security-vulnerabilities.html","refsource":"MISC","url":"http://www.darksecurity.de/index.php?/211-KORAMIS-ADV2012-002-Alienvault-OSSIM-Open-Source-SIEM-3.1-Multiple-security-vulnerabilities.html"},{"name":"alienvault-multiple-xss(75297)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/75297"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2012-3835","datePublished":"2012-07-03T22:00:00.000Z","dateReserved":"2012-07-03T00:00:00.000Z","dateUpdated":"2024-08-06T20:21:03.279Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2012-07-03 22:55:02","lastModifiedDate":"2026-04-29 01:13:23","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:alienvault:open_source_security_information_management:3.1:*:*:*:*:*:*:*","matchCriteriaId":"A3ABC1EE-3E54-48AF-95C1-ED9790527545"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2012","CveId":"3835","Ordinal":"1","Title":"CVE-2012-3835","CVE":"CVE-2012-3835","Year":"2012"},"notes":[{"CveYear":"2012","CveId":"3835","Ordinal":"1","NoteData":"Multiple cross-site scripting (XSS) vulnerabilities in AlienVault Open Source Security Information Management (OSSIM) 3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) url parameter to top.php or (2) time[0][0] parameter to forensics/base_qry_main.php, which is not properly handled in an error page.","Type":"Description","Title":"CVE-2012-3835"},{"CveYear":"2012","CveId":"3835","Ordinal":"2","NoteData":"2012-07-03","Type":"Other","Title":"Published"},{"CveYear":"2012","CveId":"3835","Ordinal":"3","NoteData":"2017-08-28","Type":"Other","Title":"Modified"}]}}}