(PVS) Signatures - Tenable Network Security

Description: Synopsis : \n\nThe remote host is vulnerable to multiple attack vectors.\n\nAtlassian JIRA,
a web-based application for bug tracking, issue tracking and project management, installed
on the remote web server is affected by one or more of the following issues : \n\n - A
cross-site scripting issue due to its failure to sanitize user-supplied input that is then
returned in the HTTP response header.\n\n - A cross-site scripting issue within the 'DWR'
library\n\n - A cross-site scripting issue within the 'Charting' plugin.\n\nThe reported
version of Atlassian is: \n %L \n
Solution: Upgrade to version 3.13.3 or higher.
CVE Not available
Apache TomCat mod_jk < 1.2.27 Cross-user Information Disclosure
PVS ID: 4984 FAMILY: Web Servers RISK: LOW NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to a flaw that allows attackers to retrieve
sensitive files or data.\n\nThe remote host is running the Apache Tomcat web server with
mod_jk version %L\n\n. mod_jk is reported vulnerable to an information disclosure flaw
due to the way that it processes 'Content-Length' headers. Allegedly, an attacker supplying
a NULL content-length can view the HTTP responses of other requests. An attacker
exploiting this flaw would be able to possibly gain access to confidential data.
Solution: Upgrade to version 1.2.27 or higher.
CVE-2008-5519
phpMyAdmin file_path Parameter Multiple Vulnerabilities (PMASA-2009-1)
PVS ID: 4985 FAMILY: CGI
RISK:
MEDIUM
NESSUS ID:36083
Description: Synopsis : \n\nThe remote host is vulnerable to multiple attack vectors.\n\nThe version of
phpMyAdmin installed on the remote host fails to sanitize user-supplied input to the
'file_path' parameter of the 'bs_disp_as_mime_type.php' script before using it to read a file
and reporting it in dynamically generated HTML. An unauthenticated remote attacker may
be able to leverage this issue to read arbitrary files, possibly from third-party hosts, or to
inject arbitrary HTTP headers in responses sent to third-party users. In addition, the version
of phpMyAdmin is reportedly vulnerable to a number of other flaws. The reported version
of phpMyAdmin is: \n %L \n
Solution: Upgrade to version 3.1.3.1 or apply the patch referenced in the project's advisory.
CVE Not available
ClamAV < 0.95.1 Multiple Vulnerabilities
Passive Vulnerability Scanner (PVS) Signatures
PVS ID: 4986 FAMILY: Web Clients RISK: HIGH NESSUS ID:36131
Family Internet Services 1317