(PVS) Signatures - Tenable Network Security

Description: The remote client was just logged editing the following Wikipedia article: '%L'\nYou
should ensure that such actions are in alignment with Corporate policies and guidelines.
Solution: N/A
CVE Not available
Microsoft .NET Verbose Error Reporting Detection
PVS ID: 5876 FAMILY: Policy
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis : \n\nThe remote host may give an attacker information useful for future
attacks\n\nThe remote .NET server has enabled verbose error reporting. By default, such
reports are only accessible via localhost (127.0.0.1). If enabled, remote attackers can gain
useful information for future attacks. Information displayed includes: source code, stack
trace, physical path of the application, error codes, and more. In addition, there have been
flaws in the way that .NET 'ValidateRequest' handles malicious inputs. The request which
generated the verbose error was: \n%P\n\nAnd the error was generated in: \n %L
Solution: Disable verbose error reporting in .NET applications
CVE Not available
Web Server iFrame Source Hosted on 3rd-party Server
PVS ID: 5877 FAMILY: Policy RISK: INFO NESSUS ID:Not Available
Description: The remote web server has an iFrame tag which pulls its source from another web server.
The iFrame in question is: %L\n\nThe location of the code which embeds this iFrame is:
%P
Solution: Ensure that the iFrame points to a web server which is a trusted site.
CVE Not available
Joomla! 1.6 < 1.6.1 Multiple Vulnerabilities
PVS ID: 5878 FAMILY: CGI
Passive Vulnerability Scanner (PVS) Signatures
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis : \n\nThe remote web server has an application that is vulnerable to multiple
attack vectors.\n\nThe remote web server is hosting Joomla!, a content management system
written in PHP. For your information, the observed version of Joomla! is : \n %L
.\n\nVersions of Joomla 1.6 earlier than 1.6.1 are potentially affected by multiple
vulnerabilities : \n\n - An unspecified SQL injection and path disclosure issue.
(20110201)\n\n - An uncaught exception could cause full path disclosure. (20110202)\n\n -
Inadequate checking for double URI encoding could lead to cross-site scripting
vulnerabilities. (20110203)\n\n - Inadequate filtering exposes cross-site scripting
vulnerabilities. (20110204)\n\n - Inadequate access checking leads to information
disclosure. (20110301)\n\n - There is inadequate checking of redirect URLs.
Family Internet Services 1596