(PVS) Signatures - Tenable Network Security

Solution: Upgrade to version 5.1.18 or higher.
CVE-2007-2693
vBulletin < 3.6.7 calendar.php title Parameter Persistent HTML Injection
PVS ID: 3994 FAMILY: CGI
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to an HTML injection attack.\n\nThe version
of vBulletin installed on the remote host fails to properly sanitize user-supplied input.
Specifically, the 'title' parameter of the calendar.php script can be used by an attacker to
inject script code into a public section of the bulletin board. An attacker exploiting this flaw
would only need the ability to post data to the calendar.php script. When an unsuspecting
user browses the site, the script code would be executed within the client browser.
Solution: Upgrade to version 3.6.7 or higher.
CVE-2007-2908
WordPress < 2.1.4 wp-admin/admin-ajax.php cookie Parameter SQL Injection
PVS ID: 3995 FAMILY: CGI RISK: HIGH NESSUS ID:Not Available
Description: Synopsis : \n\nThe remote host is vulnerable to a SQL injection attack.\n\nThe version of
WordPress installed on the remote host is vulnerable to a SQL injection attack. The
reported version is: \n %L \n\nAn attacker exploiting this flaw would only need to be able
to send data to the 'wp-admin/admin-ajax.php' script. Successful exploitation would result
in the attacker executing SQL commands on the remote database server
Solution: Upgrade to version 2.1.4 or higher.
CVE-2007-2821
Opera < 9.21 Multiple Vulnerabilities
PVS ID: 3996 FAMILY: Web Clients RISK: HIGH NESSUS ID:25290
Description: Synopsis :\n\nThe remote host contains a web browser that is prone to a buffer overflow
attack.\n\nThe version of Opera installed on the remote host reportedly contains a buffer
overflow vulnerability that can be triggered by a malicious Torrent file. Successful
exploitation requires that a user on the affected host right-click on the torrent entry in the
transfer manager rather than simply click on a torrent link and may allow a remote attacker
to execute arbitrary code subject to the privileges of the user.
Solution: Upgrade to version 9.21 or higher.
CVE-2007-2274
Symantec Discovery Client Detection
Passive Vulnerability Scanner (PVS) Signatures
Family Internet Services 1036