27.02.2013 Views

(PVS) Signatures - Tenable Network Security

(PVS) Signatures - Tenable Network Security

(PVS) Signatures - Tenable Network Security

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

CVE Not available<br />

SQLiteManager include/config.inc.php SQLiteManager_currentTheme Cookie Local File Inclusion<br />

<strong>PVS</strong> ID: 3925 FAMILY: Web Servers<br />

RISK:<br />

MEDIUM<br />

NESSUS ID:24726<br />

Description: Synopsis :\n\nThe remote web server contains a PHP script that is susceptible to a local file<br />

inclusion attack. \n\nThe remote host is running SQLiteManager, a web-based application<br />

for managing SQLite databases. The version of SQLiteManager installed on the remote<br />

host fails to sanitize user input to the 'SQLiteManager_currentTheme' cookie before using it<br />

to include PHP code in 'include/config.inc.php'. An unauthenticated remote attacker may be<br />

able to exploit this issue to view arbitrary files or to execute arbitrary PHP code on the<br />

remote host, subject to the privileges of the web server user ID.<br />

Solution: No solution is known at this time.<br />

CVE-2007-1232<br />

Xbox Console Detection<br />

<strong>PVS</strong> ID: 3926 FAMILY: Policy RISK: INFO NESSUS ID:Not Available<br />

Description: <strong>PVS</strong> detected an Xbox gaming console on the local network. The version of software<br />

is: \n %L<br />

Solution: Ensure that such systems are authorized with respect to corporate policies.<br />

CVE Not available<br />

SeaMonkey < 1.0.8 Multiple Vulnerabilities<br />

<strong>PVS</strong> ID: 3927 FAMILY: Web Clients RISK: HIGH NESSUS ID:24735<br />

Description: Synopsis :\n\nA web browser on the remote host is prone to multiple flaws.\n\nThe<br />

installed version of SeaMonkey contains various security issues, some of which may lead<br />

to execution of arbitrary code on the affected host subject to the user's privileges.<br />

Solution: Upgrade to version 1.0.8 or higher.<br />

CVE-2007-0994<br />

Passive Vulnerability Scanner (<strong>PVS</strong>) <strong>Signatures</strong><br />

OrangeHRM < 2.1 alpha 5 login.php txtUserName Parameter SQL Injection<br />

<strong>PVS</strong> ID: 3928 FAMILY: Web Servers RISK: HIGH NESSUS ID:24743<br />

Description: Synopsis :\n\nThe remote web server contains a PHP script that is affected by a SQL<br />

injection vulnerability.\n\n The remote host is running OrangeHRM, a human resource<br />

management system written in PHP. The version of OrangeHRM installed on the remote<br />

host fails to sanitize input to the 'txtUserName' parameter of the 'login.php' script before<br />

Family Internet Services 1017

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!