(PVS) Signatures - Tenable Network Security

PVS ID: 5529 FAMILY: Web Clients RISK: HIGH NESSUS ID:46242
Description: Synopsis : \n\nThe remote host contains an application that is vulnerable to a buffer
overflow attack.\n\nThe remote host contains Beyond Compare, a file comparison
application. The installed version of Beyond Compare is earlier than 3.1.11. Such version
are potentially affected by a buffer overflow vulnerability when handling zip files with an
overly large filename. An attacker, exploiting this flaw, could potentially execute arbitrary
code on the remote host subject to the privileges of the user running the application.\nFor
your information, the observed version of Beyond Compare is: \n %L
Solution: Upgrade to Beyond Compare 3.1.11 or later.
CVE Not available
CMS Made Simple < 1.7.1 Cross-Site Scripting Vulnerability
PVS ID: 5530 FAMILY: CGI RISK: LOW NESSUS ID:Not Available
Description: Synopsis : \n\nThe remote web server is running a PHP application that is affected by a
cross-site scripting vulnerability.\n\nThe remote host is running CMS Made Simple, a
web-based content management application written in PHP. The installed version of CMS
Made Simple is earlier than 1.7.1. Such versions are potentially affected by a cross-site
scripting vulnerability because the application fails to properly sanitize user supplied input
to the 'date_format_string' variable of the 'admin/editprefs.php' script. An attacker with
administrator privileges, could exploit this flaw to execute arbitrary script code in a user's
browser.\nFor your information, the observed version of CMS Made Simple is: \n %L
Solution: Upgrade to CMS Made Simple 1.7.1 or later.
CVE-2010-1482
OrangeHRM < 2.5.5 Multiple Vulnerabilities
PVS ID: 5531 FAMILY: Web Servers RISK: HIGH NESSUS ID:Not Available
Description: Synopsis : \n\nThe remote host is vulnerable to multiple attack vectors\n\nThe remote host
is running OrangeHRM, a human resource management system written in PHP. The
reported version of OrangeHRM is: \n %L \n\nThe version of OrangeHRM installed on the
remote host fails to sanitize input to multiple forms which would allow an attacker to insert
HTML, execute cross-site-scripting (XSS) attacks, execute SQL injection attacks, and
execute arbitrary commands. In all instances, code/commands would be executed with the
privileges of the web process.
Solution: Upgrade to version 2.5.5 or higher when available. In the interim, either disable the service
or only allow trusted users access to the application.
CVE Not available
Passive Vulnerability Scanner (PVS) Signatures
Drupal Context module < 6.x-2.0-rc4 HTML Injection
PVS ID: 5532 FAMILY: Web Servers NESSUS ID:Not Available
Family Internet Services 1481