(PVS) Signatures - Tenable Network Security

PVS ID: 5633 FAMILY: Database RISK: INFO NESSUS ID:Not Available
Description: The PVS has observed a failed SQL login to an MySQL server. The following UserID has
just failed to login: %L
Solution: N/A
realtimeonly
CVE Not available
Drupal Ubercart Module < 5.x-1.10 / 6.x-2.4 Multiple Vulnerabilities
PVS ID: 5634 FAMILY: CGI
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote web server is hosting a web application that is affected by an
authentication bypass vulnerability.\n\nThe remote web server hosts a Drupal install that
uses the Ubercart, an e-commerce module for Drupal CMS. For your information, the
observed version of Drupal Ubercart module is %L.\n\nVersions of Ubercart earlier than
5.x-1.10 / 6.x-2.4 are potentially affected by multiple vulnerabilities :\n\n - The 2Checkout
gateway module does not properly verify payment notification information. Note that this
module must be enabled for the Drupal install to be affected.\n\n - The Paypal module's
WPS payment method does not properly verify the payment notification information. Note
that this module must be enabled for the Drupal install to be affected.\n\n - The Ubercart
Cart Links module is vulnerable to both an Access Bypass and Cross Site Request Forgery
where a malicious user can trick other users into adding or removing items from their cart
and add items to a cart which are not published on the site. Note that this module must be
enabled for the Drupal install to be affected.
Solution: Upgrade to Drupal Ubercart Module 5.x-1.10 / 6.x-2.4 or later.
CVE Not available
Serv-U < 10.2.0.0 Multiple Vulnerabilities
PVS ID: 5635 FAMILY: FTP Servers
Passive Vulnerability Scanner (PVS) Signatures
RISK:
MEDIUM
NESSUS ID:48435
Description: Synopsis :\n\nThe remote FTP server is vulnerable to multiple attack vectors.\n\nThe
remote host is running Serv-U File Server, an FTP Server for Windows. For your
information, the observed version Serv-U is %L.\n\nVersions of Serv-U earlier than
10.2.0.0 are potentially affected by multiple vulnerabilities :\n\n - It is possible to create a
directory, when using virtual paths and various combinations of permissions, where the
end-user does not have permission to create the directory. Note that this issue was
introduced in Serv-U 9.2.0.1 and does not affect earlier version.\n\n - Certain web client
invalid URL parameters could cause the affected application to crash.
Solution: Upgrade to Serv-U version 10.2.0.0 or later.
Family Internet Services 1516