(PVS) Signatures - Tenable Network Security

(20110302)\n\n - Inadequate filtering causes information disclosure. (20110303)\n\n -
There is inadequate control of which files can be edited by authenticated users.
(20110304)\n\n - Inadequate token checking leads to a cross-site request forgery
vulnerability. (20110305)\n\n - Editor caching can cause a denial of service by filling up
the disk. (20110306)\n\n - Inadequate filtering exposes cross-site scripting vulnerabilities.
(20110307)\n\n - Inadequate token checking leads to a cross-site request forgery
vulnerability. (20110308)
Solution: Upgrade to Joomla! 1.6.1 or later.
CVE Not available
MyBB < 1.4.15 / 1.6 < 1.6.2 Multiple Vulnerabilities
PVS ID: 5879 FAMILY: CGI
RISK:
MEDIUM
NESSUS ID:53288
Description: Synopsis : \n\nThe remote web server is running a PHP application that is vulnerable to
multiple attack vectors.\n\nThe remote web server hosts MyBB, a web-based discussion
board application. For your information, the observed version of MyBB is : \n %L
\n\nVersions of MyBB earlier than 1.4.15, or 1.6.x earlier than 1.6.2 are potentially affected
by multiple issues : \n\n - A cross-site scripting vulnerability exists in the modcp.php script.
(1464)\n\n - A cross-site scripting vulnerabililty exists in the 'xmlhttp.php' script.
(1460)\n\n - A cross-site scripting issue exists relating to HTML content in posts. (1422)
Solution: Upgrade to MyBB 1.4.15, 1.6.2, or later.
CVE Not available
LizaMoon Malware Detection
PVS ID: 5880 FAMILY: CGI RISK: HIGH NESSUS ID:29871
Description: Synopsis :\n\nThe remote web server seems to have been compromised by
LizaMoon.\n\nThe remote web site seems to link to malicious javascript files hosted on a
third party web site related to the LizaMoon Malware. This typically means that the remote
web site has been compromised, likely through SQL injection, and it may infect its visitors
as well.
Solution: Restore your website to its original state and audit your dynamic pages for SQL injection
vulnerabilities.
CVE Not available
Joomla! 1.5 < 1.5.23 Information Disclosure Vulnerability
PVS ID: 5881 FAMILY: CGI
Passive Vulnerability Scanner (PVS) Signatures
RISK:
MEDIUM
NESSUS ID:Not Available
Family Internet Services 1597