27.02.2013 Views

(PVS) Signatures - Tenable Network Security

(PVS) Signatures - Tenable Network Security

(PVS) Signatures - Tenable Network Security

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

<strong>PVS</strong> ID: 2522 FAMILY: CGI RISK: HIGH NESSUS ID:Not Available<br />

Description: Synopsis :\n\nThe remote web server contains a script that is vulnerable to a SQL injection<br />

attack.\n\nThe remote host is VideoDB, a web based video database manager written in<br />

PHP.\nThe remote version of this software is vulnerable to a SQL injection vulnerability<br />

due to a lack of filtering on user-supplied input. An attacker may exploit this flaw to<br />

modify the remote database.\nThis software may be vulnerable to an unauthorized access<br />

vulnerability in the file 'edit.php' that may allow an attacker to edit database entries.<br />

Solution: Upgrade to VideoDB 2.0.2 or higher.<br />

CVE Not available<br />

GNU Mailman Multiple Unspecified Remote Vulnerabilities<br />

<strong>PVS</strong> ID: 2523 FAMILY: CGI RISK: LOW NESSUS ID:Not Available<br />

Description: Synopsis :\n\nThe remote host is vulnerable to a cross-site scripting (XSS) attack.\n\nThe<br />

remote host is running GNU Mailman, a web based software to manage mailing lists. There<br />

are multiple flaws such as information disclosure and cross-site scripting in the remote<br />

version of this software that may allow an attacker to steal user cookies to gain<br />

unauthorized access.<br />

Solution: Upgrade or patch according to vendor recommendations.<br />

CVE Not available<br />

BiTBOARD IMG BBCode Tag JavaScript XSS<br />

<strong>PVS</strong> ID: 2524 FAMILY: CGI RISK: LOW NESSUS ID:Not Available<br />

Description: Synopsis :\n\nThe remote host is vulnerable to a Script Injection attack\n\nThe remote host<br />

is running BiTBOARD, a web based bulletin board written in PHP. There is a JavaScript<br />

injection vulnerability in the remote version of this software that may allow an attacker to<br />

steal user's cookie to gain unauthorized access.<br />

Solution: No solution is known at this time.<br />

CVE-2005-0374<br />

launch.yahoo.com Streaming Client Detection<br />

Passive Vulnerability Scanner (<strong>PVS</strong>) <strong>Signatures</strong><br />

<strong>PVS</strong> ID: 2525 FAMILY: Generic RISK: LOW NESSUS ID:Not Available<br />

Description: The remote client is streaming video or audio from the Yahoo Launch servers. Yahoo<br />

Launch is a service that allows Yahoo users to download and view videos and songs from a<br />

variety of artists. This can potentially impact performance of bandwidth and user<br />

productivity.<br />

Solution: Ensure that this activity is sanctioned by policy and guidelines regarding acceptable<br />

Family Internet Services 642

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!