27.02.2013 Views

(PVS) Signatures - Tenable Network Security

(PVS) Signatures - Tenable Network Security

(PVS) Signatures - Tenable Network Security

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

Description: Synopsis : \n\nThe remote web server contains a PHP application that is vulnerable to<br />

cross-site scripting attacks.\n\nThe installation of Horde is using the Passwd module which<br />

provides support for changing passwords. The installed version of this module is earlier<br />

than 3.1.1. Such versions are reportedly affected by a cross-site scripting vulnerability that<br />

affects the 'backend' parameter of the 'main.php' script. An attacker can exploit this to<br />

execute arbitrary script code in the browser of an authenticated user.\nFor your<br />

information, the reported version of the Horde Passwd module is: \n %L<br />

Solution: Upgrade to Passwd H3 3.1.1 or later.<br />

CVE-2009-2360<br />

SMTP Client Account Detection<br />

<strong>PVS</strong> ID: 5093 FAMILY: Generic RISK: INFO NESSUS ID:Not Available<br />

Description: The host is an SMTP client using the following email address.<br />

realtime<br />

Solution: N/A<br />

CVE Not available<br />

Safari < 4.0.2 Multiple Vulnerabilities<br />

<strong>PVS</strong> ID: 5094 FAMILY: Web Clients RISK: HIGH NESSUS ID:Not Available<br />

Description: Synopsis : \n\nThe remote host is vulnerable to multiple attack vectors.\n\nThe version of<br />

Safari installed on the remote host is earlier than 4.0.2. Such versions are potentially<br />

affected by two issues : \n\n - A vulnerability in WebKit's handling of parent and top<br />

objects may allow for cross-site scripting attacks. (CVE-2009-1724)\n\n - A memory<br />

corruption in WebKit's handling of numeric character references could lead to a crash or<br />

arbitrary code execution. (CVE-2009-1725)\n\nFor your information, the reported version<br />

of Safari is: \n %L<br />

Solution: Upgrade to Safari 4.0.2 or later.<br />

CVE-2009-1725<br />

Bugzilla < 3.2.4/3.4 RC1 <strong>Security</strong>-Bypass Vulnerability<br />

<strong>PVS</strong> ID: 5095 FAMILY: CGI<br />

Passive Vulnerability Scanner (<strong>PVS</strong>) <strong>Signatures</strong><br />

RISK:<br />

MEDIUM<br />

NESSUS ID:Not Available<br />

Description: Synopsis : \n\nThe remote host is affected by a security bypass vulnerability.\n\nThe<br />

remote web server is running a version of Bugzilla earlier than 3.2.4/3.4 RC1. Such<br />

versions reportedly allow authenticated users who do not belong to the 'canconfirm' group<br />

to modify the status of bugs. An attacker could exploit this to change the status of bug<br />

reports. The reported version of Bugzilla is: \n %L<br />

Family Internet Services 1351

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!