(PVS) Signatures - Tenable Network Security

Solution: Upgrade to Flash Player 10.3.183.10 or later.
CVE-2011-2444
phpMyAdmin 3.4.x < 3.4.5 Cross-site Scripting (PMASA-2011-14)
PVS ID: 6026 FAMILY: CGI RISK: LOW NESSUS ID:56379
Description: Synopsis : \n\nThe remote web server contains a PHP application that is affected by
multiple cross-site scripting vulnerabilities.\n\nFor your information, the observed version
of phpMyAdmin is : \n %L \n\nVersions of phpMyAdmin 3.4.x earlier than 3.4.5 are
potentially affected by multiple cross-site scripting vulnerabilities : \n - The data used in the
row content display after inline editing is not properly sanitized before it is passed back to
the browser.\n - The data passed in as table, column, and index names is not properly
sanitized before it is passed back to the browser.\nA remote attacker may use these issues
to cause arbitrary code to be executed in a user's browser, to steal authentication cookies
and the like.
Solution: Apply the vendor patches or upgrade to phpMyAdmin 3.4.5 or later.
CVE Not available
Mozilla Firefox 3.6 < 3.6.23 Multiple Vulnerabilities
PVS ID: 6027 FAMILY: Web Clients RISK: HIGH NESSUS ID:56334
Description: Synopsis : \n\nThe remote host has a web browser installed that is vulnerable to multiple
attack vectors.\n\nThe remote host has a web browser installed that is vulnerable to
multiple attack vectors.\n\nFor your information, the observed version of Firefox is : \n %L
\n\nVersions of Firefox 3.6 earlier than 3.6.23 are potentially affected by the following
security issues : \n - An integer underflow exists when handling a large JavaScript 'RegExp'
expression that can allow a potentially exploitable crash. (Issue 684815)\n - If an attacker
could trick a user into holding down the 'Enter' key, via a malicious game for example, a
malicious application or extension could be downloaded and executed. (CVE-2011-2372)\n
- Unspecified error exist that can be exploited to corrupt memory. No additional
information is available at this time. (CVE-2011-2995, CVE-2011-2996)\n - There is an
error in the implementation of the 'window.location' JavaScript object when creating named
frames. This can be exploited to bypass the same-origin policy and potentially conduct
cross-site scripting attacks. (CVE-2011-2999)\n - A weakness exists when handling the
'Location' header. This can lead to response splitting attacks when visiting a vulnerable web
server. The same fix has been applied to the headers 'Content-Length' and
'Content-Disposition'. (CVE-2011-3000)
Solution: Upgrade to Firefox 3.6.23 or later.
CVE-2011-3000
Mozilla Firefox 6.0 Multiple Vulnerabilities
Passive Vulnerability Scanner (PVS) Signatures
PVS ID: 6028 FAMILY: Web Clients RISK: HIGH NESSUS ID:56335
Family Internet Services 1645