(PVS) Signatures - Tenable Network Security

Ipswitch IMail Server < 8.14.0 Delete Command Buffer Overflow
PVS ID: 2408 FAMILY: Web Servers
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to a buffer overflow.\n\nThe remote host is
running a version of Ipswitch IMail that is older than version 8.14.0. The remote version of
this software is vulnerable to a buffer overflow when it processes the argument of the
'delete' command. An attacker may exploit this flaw to execute arbitrary code on the remote
host.
Solution: Upgrade to IMail 8.14.0 or higher.
CVE-2004-1520
PowerPortal index.php index_page Parameter SQL Injection
PVS ID: 2409 FAMILY: CGI RISK: HIGH NESSUS ID:15760
Description: Synopsis :\n\nThe remote web server contains a script that is vulnerable to a SQL injection
attack.\n\nThe remote host is using PowerPortal, a content management system written in
PHP. A vulnerability exists in the remote version of this product that may allow a remote
attacker to perform a SQL injection attack against the remote host. An attacker may exploit
this flaw to execute arbitrary SQL statements against the remote database and possibly to
execute arbitrary commands on the remote host.
Solution: Upgrade or patch according to vendor recommendations.
CVE Not available
phpScheduleIt < 1.0.1 Reservation.class.php Arbitrary Reservation Modification
PVS ID: 2410 FAMILY: CGI
RISK:
MEDIUM
NESSUS ID:15772
Description: Synopsis :\n\nThe remote host is vulnerable to a flaw that allows for the bypassing of
authentication.\n\nThe remote host is running phpScheduleIt, a web-based reservation
system written in PHP. According to its banner, this version is reported vulnerable to an
undisclosed issue that may allow an attacker to modify or delete phpScheduleIt
reservations.
Solution: Upgrade to version 1.0.1 or higher.
CVE-2004-2469
phpBB Login Form SQL Injection
Passive Vulnerability Scanner (PVS) Signatures
PVS ID: 2411 FAMILY: CGI RISK: HIGH NESSUS ID:15780
Family Internet Services 610