(PVS) Signatures - Tenable Network Security

CVE-2004-1061
Gallery Multiple Vulnerabilities
PVS ID: 2533 FAMILY: CGI
RISK:
MEDIUM
NESSUS ID:16185
Description: Synopsis :\n\nThe remote host is vulnerable to a Cross-Site Scripting (XSS) attack.\n\nThe
remote host is running the Gallery web-based photo album.\nThere are various flaws in the
remote version of this software that may allow an attacker to perform a cross-site scripting
attack using the remote host, or to exploit an information disclosure flaw to gain more
knowledge about the remote system.
Solution: No solution is known at this time.
CVE Not available
AWStats < 6.3 awstats.pl configdir Parameter Remote Command Execution
PVS ID: 2534 FAMILY: CGI RISK: HIGH NESSUS ID:16189
Description: The remote host is running AWStats, a CGI log analyzer.\nThere are various flaws in the
remote version of this software that may allow an attacker to execute code on the remote
host.
Solution: Upgrade to AWStats 6.3 or higher.
CVE-2005-0116
VBulletin Init.PHP Unspecified Remote Vulnerability
PVS ID: 2535 FAMILY: CGI RISK: HIGH NESSUS ID:16203
Description: Synopsis :\n\nThe remote host is vulnerable to a flaw that allows for the bypassing of
authentication.\n\nThe remote host is running a version of vBulletin, a forum application
implemented in PHP, that is vulnerable to an unspecified remote vulnerability. It is reported
that versions prior to 3.0.5 are prone to this issue. Additionally, versions of vBulletin prior
to 3.0.5 are vulnerable to a content-parsing flaw within the forumdisplay.php script. An
attacker exploiting this flaw would be able to run arbitrary commands on the remote web
server.
Solution: Upgrade to vBulletin 3.0.5 or higher.
CVE-2005-0429
SparkleBlog journal.php SQL Injection
Passive Vulnerability Scanner (PVS) Signatures
PVS ID: 2536 FAMILY: Web Servers RISK: HIGH NESSUS ID:Not Available
Family Internet Services 645