27.02.2013 Views

(PVS) Signatures - Tenable Network Security

(PVS) Signatures - Tenable Network Security

(PVS) Signatures - Tenable Network Security

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

CVE Not available<br />

CuteNews show_archives.php XSS<br />

<strong>PVS</strong> ID: 1726 FAMILY: Web Servers RISK: HIGH NESSUS ID:Not Available<br />

Description: The remote host is running CuteNews, a news management system implemented in PHP. It<br />

is reported that this version of CuteNews is affected by a cross-site scripting (XSS)<br />

vulnerability. This issue is due to a failure of the application to properly sanitize<br />

user-supplied URI input. An attacker may execute malicious code in a victim's browser and<br />

steal credentials on this site.<br />

Solution: No solution is known at this time.<br />

CVE Not available<br />

QuiXplorer < 2.3.1 item Parameter Directory Traversal File Access<br />

<strong>PVS</strong> ID: 1727 FAMILY: Web Servers RISK: HIGH NESSUS ID:Not Available<br />

Description: The remote host may be running a vulnerable version of QuiXplorer, a Web based<br />

application implemented in PHP that allows users to browse files and directories on a Web<br />

server. QuiXplorer versions up to 2.3 are prone to a directory traversal vulnerability. An<br />

attacker may access arbitrary files on a vulnerable computer in the context of the affected<br />

server.<br />

Solution: Upgrade QuiXplorer to version 2.3.1 or higher.<br />

CVE Not available<br />

AWStats Rawlog Plugin Logfile Parameter Arbitrary Command Execution<br />

<strong>PVS</strong> ID: 1728 FAMILY: Web Servers RISK: HIGH NESSUS ID:Not Available<br />

Description: The remote host is running AWStats, a CGI log analyzer that generates statistic reports<br />

based on HTTP, SMTP or FTP logs. AWStats Rawlog Plugin is reported prone to an input<br />

validation vulnerability. A remote attacker may supply shell metacharacters and commands<br />

as a value for the 'logfile' URI parameter. These commands and metacharacters will be<br />

processed by the underlying shell, resulting in the execution of commands in the context of<br />

the hosting web server.<br />

Solution: Upgrade or patch according to vendor recommendations.<br />

CVE Not available<br />

phpBB < 2.0 Multiple Vulnerabilities<br />

Passive Vulnerability Scanner (<strong>PVS</strong>) <strong>Signatures</strong><br />

<strong>PVS</strong> ID: 1729 FAMILY: Web Servers RISK: HIGH NESSUS ID:Not Available<br />

Family Internet Services 439

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!