(PVS) Signatures - Tenable Network Security

Description: Synopsis : \n\nThe remote host is running a web application that is affected by a cross-site
scripting vulnerability.\n\nAccording to its banner, the version of CUPS installed on the
remote host is earlier than 1.4.2. Such versions are potentially affected by a cross-site
scripting vulnerability because the application fails to properly sanitize the 'kerberos'
parameter. For your information, the observed version of CUPS is: \n %L
Solution: Upgrade to CUPS version 1.4.2 or later.
CVE-2009-2820
Ingenico Point of Sales (POS) Device Detection
PVS ID: 5231 FAMILY: Generic RISK: INFO NESSUS ID:Not Available
Description: The remote host is an Ingenico Point of Sales device.
Solution: N/A
CVE Not available
Safari < 4.0.4 Multiple Vulnerabilities
PVS ID: 5232 FAMILY: Web Clients RISK: HIGH NESSUS ID:42478
Description: Synopsis : \n\nThe remote host is vulnerable to multiple attack vectors.\n\nThe version of
Safari installed on the remote host is earlier than 4.0.4. Such versions are potentially
affected by multiple issues : \n\n - An integer overflow exists in the handling of images
with an embedded color profile, which may lead to a heap buffer overflow.
(CVE-2009-2804)\n\n - Multiple use-after-free issues exist in libxml2, the most serious of
which may lead to an unexpected application termination. (CVE-2009-2414,
CVE-2009-2416)\n\n - An issue exists in Safari's handling of navigations initiated via the
"Open Image in New Tab", "Open Image in New Window", or "Open Link in New Tab"
shortcut menu options. Using these options within a maliciously crafted website could load
a local HTML file, leading to the disclosure of sensitive information. (CVE-2009-2842)\n\n
- An issue exists in WebKit's implementation of Cross-Origin Resource Sharing which
could lead to cross-site request forger attacks. (CVE-2009-2816)\n\n - Multiple
vulnerabilities exist in WebKit's handling of FTP directory listings. Accessing a
maliciously crafted FTP server may lead to information disclosure, unexpected application
termination, or execution of arbitrary code. (CVE-2009-3384)\n\n - When WebKit
encounters an HTML 5 Media Element pointing to an external resource, it does not issue a
resource load callback to determine if the resource should be loaded. This may result in
undesired requests to remote servers. (CVE-2009-2841)\n\nFor your information, the
observed version of Safari is: \n %L \nIAVT Reference : 2009-T-0049\nSTIG Finding
Severity : Category I
Solution: Upgrade to Safari 4.0.4 or later.
CVE-2009-3384
WordPress < 2.8.6 Multiple Vulnerabilities
Passive Vulnerability Scanner (PVS) Signatures
Family Internet Services 1395