(PVS) Signatures - Tenable Network Security

Solution: Upgrade to ESET update 4036 or higher.
CVE Not available
Citrix Web Interface 4.6/5.0/5.0.1 XSS
PVS ID: 5010 FAMILY: Web Servers
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to a cross-site scripting attack.\n\nThe remote
host is running Citrix Web Interface, a tool for connecting to Citrix services through a web
browser. The reported version of Citrix Web Interface is: \n%L\n\nThe version of Citrix
Web Interface installed on the remote host is affected by an unspecfied cross-site scripting
vulnerability. An attacker, exploiting this cross-site scripting flaw, would be able to execute
script code within the browser of an unsuspecting Citrix Web Interface user.
Solution: Upgrade to Citrix Web Interface 5.1.0 or later.
CVE-2009-2454
Flash Media < 3.0.4/3.5.2 Privilege Escalation
PVS ID: 5011 FAMILY: Web Servers RISK: HIGH NESSUS ID:Not Available
Description: Synopsis : \n\nThe remote host is vulnerable to a remote 'privilege escalation' flaw\n\nThe
remote host is running Flash Media server version: \n %L \n\nThis version of Flash Media
server is vulnerable to a flaw wherein malicious script code can be injected and executed
via an RPC call. An attacker, exploiting this flaw, would need access to the application port
and the ability to send malformed requests to the service port. An attacker, exploiting this
flaw, would be able to escalate privileges on the remote system.
Solution: Adobe has released Flash Media Server versions 3.04 and 3.5.2 to address these flaws
CVE-2009-1365
MyBB < 1.4.6 Multiple Vulnerabilities
PVS ID: 5012 FAMILY: CGI
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis : \n\nThe remote host is vulnerable to multiple attack vectors\n\nThe version of
MyBB installed on the remote host is vulnerable to an html-injection flaw. An attacker,
exploiting this flaw, would be able to execute script code within the browser of an
unsuspecting user. Allegedly, the host is also vulnerable to several unspecified
vulnerabilities. While the details are sketchy, the vendor has addressed the issue. The
reported version of MyBB is: \n %L \n
Solution: Upgrade to MyBB 1.4.6 or later.
Passive Vulnerability Scanner (PVS) Signatures
Family Internet Services 1326