PatchTheCVEossec vulnerabilities
Recent CVEs affecting ossec products. 12 tracked.
ossec has 12 tracked vulnerabilities, 4 critical. A fixed release or vendor patch exists for 10. Most recent: 2021-03-05. Highest priority: CVE-2020-8443 (score 66/100).
- CVE-2021-28040 HIGH 7.5 DOWNGRADE An issue was discovered in OSSEC 3.6.0
- CVE-2020-8448 MEDIUM 5.5 UPGRADE In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulner
- CVE-2020-8447 CRITICAL 9.8 UPGRADE In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulner
- CVE-2020-8446 MEDIUM 5.5 UPGRADE In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulner
- CVE-2020-8445 CRITICAL 9.8 UPGRADE In OSSEC-HIDS 2.7 through 3.5.0, the OS_CleanMSG function in ossec-analysisd doesn't remove or encode terminal
- CVE-2020-8444 CRITICAL 9.8 UPGRADE In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulner
- CVE-2020-8443 CRITICAL 9.8 UPGRADE In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulner
- CVE-2020-8442 HIGH 8.8 UPGRADE In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulner
- CVE-2018-19666 HIGH 7.8 UPGRADE UPGRADE The agent in OSSEC through 3.1.0 on Windows allows local users to gain NT AUTHORITY\SYSTEM access via Director
- CVE-2016-4847 MEDIUM 6.1 UPGRADE Cross-site scripting (XSS) vulnerability in site/search.php in OSSEC Web UI before 0.9 allows remote attackers
- CVE-2015-3222 HIGH 7.0 DOWNGRADE syscheck/seechanges.c in OSSEC 2.7 through 2.8.1 on NIX systems allows local users to execute arbitrary code a
- CVE-2014-5284 HIGH 7.2 UPGRADE host-deny.sh in OSSEC before 2.8.1 writes to temporary files with predictable filenames without verifying owne
FAQ
How do I fix ossec vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is ossec being exploited right now?
None of the tracked ossec CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which ossec CVE should I patch first?
CVE-2020-8443 currently ranks highest (66/100): In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulner.