(PVS) Signatures - Tenable Network Security

Description: The remote host is running the QNX embedded operating system. The reported version
information (via the qconn service) is: %L
Solution: Verify that the software is up to date
QNX Detection
CVE Not available
PVS ID: 5641 FAMILY: FTP Servers RISK: INFO NESSUS ID:Not Available
Description: The remote host is running the QNX embedded Operating System.
Solution: Manually inspect the service to ensure that it is patched and necessary on your network
CVE Not available
CouchDB < 0.11.2 Futon Admin Interface Cross-Site Request Forgery
PVS ID: 5642 FAMILY: Database
RISK:
MEDIUM
NESSUS ID:48382
Description: Synopsis :\n\nThe remote database server is vulnerable to a cross-site request forgery
attack.\n\nThe remote host is running CouchDB, a document-oriented database. For your
information, the observed version of CouchDB is %L.\n\nVersions of CouchDB earlier
than 0.11.2 are potentially affected by a cross-site request forgery vulnerability. The
application fails to properly sanitize user-supplied input before it is used in the Futon
administrative interface.\n\n remote attacker could exploit this to execute arbitrary script
code in the security context of CouchDB's admin interface.
Solution: Upgrade to CouchDB 0.11.2 or later.
CVE-2010-2234
Drupal CCK "Node Reference" Module < 6.x-2.8 Security Bypass Vulnerability
PVS ID: 5643 FAMILY: CGI
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote web server is hosting a web application that is vulnerable to a
security bypass attack.\n\nThe remote web server hosts a Drupal install that uses the CCK
"Node Reference" module. Versions of the CCK Module earlier than 6.x-2.8 are potentially
affected by a security bypass vulnerability. The application provides a backend URL that is
used for asynchronous requests by the 'autocomplete' widget which fails to correctly check
that the user had field level access to the source field.
Solution: Upgrade to Drupal CCK module 6.x-2.8 or later.
CVE Not available
Passive Vulnerability Scanner (PVS) Signatures
Family Internet Services 1518