27.02.2013 Views

(PVS) Signatures - Tenable Network Security

(PVS) Signatures - Tenable Network Security

(PVS) Signatures - Tenable Network Security

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

Description: BEA WebLogic may be tricked into revealing the source code of the remote JSP scripts by<br />

using simple URL encoding of the characters in the filename extensions (ie: default.js%70<br />

instead of .jsp).<br />

Solution: Upgrade to WebLogic version 5.1.0 SP8 or higher.<br />

CVE Not available<br />

BEA WebLogic < 6.1 SP2 Encoded Null Byte Request JSP Source Disclosure<br />

<strong>PVS</strong> ID: 1526 FAMILY: Web Servers<br />

RISK:<br />

MEDIUM<br />

NESSUS ID:10949<br />

Description: The remote BEA WebLogic server may be tricked into revealing the source code of the<br />

remote JSP scripts by adding an encoded character (ie: %00x) at the end of the request.<br />

Solution: Upgrade to WebLogic 6.1 SP2 or higher.<br />

CVE Not available<br />

SHOUTcast Server Log Files XSS<br />

<strong>PVS</strong> ID: 1527 FAMILY: Web Servers<br />

RISK:<br />

MEDIUM<br />

NESSUS ID:11624<br />

Description: The remote host is running a SHOUTcast server. This software does not properly validate<br />

the data provided by web clients, and is therefore vulnerable to a cross-site scripting issue<br />

in its logs interface (which can only be used by the administrator). An attacker may use this<br />

flaw to steal the cookies of the administrator and gain access to this server.<br />

Solution: None solution known at this time.<br />

CVE Not available<br />

miniPortail admin.php Cookie Manipulation Admin Access<br />

<strong>PVS</strong> ID: 1528 FAMILY: CGI RISK: HIGH NESSUS ID:11623<br />

Description: The remote host is running MiniPortail, a set of PHP scripts designed to manage to web<br />

portal. There is a flaw in the remote version of miniPortail which may allow anyone to gain<br />

administrative privileges on this server.<br />

Solution: No solution known at this time.<br />

CVE-2003-0272<br />

mod_ssl < 2.8.10 Wildcard DNS Server Name XSS<br />

<strong>PVS</strong> ID: 1529 FAMILY: Web Servers<br />

Passive Vulnerability Scanner (<strong>PVS</strong>) <strong>Signatures</strong><br />

RISK:<br />

MEDIUM<br />

NESSUS ID:11622<br />

Family Internet Services 393

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!