(PVS) Signatures - Tenable Network Security

Description: Synopsis :\n\nThe remote host is vulnerable to a Script Injection attack.\n\nThe remote host
is running ExBB, a bulletin board system written in PHP.\nThe remote version of this
software is vulnerable to a script injection vulnerability.\nAn attacker may post a forum
comment in the remote application containing rogue JavaScript tags that will be executed in
the browsers of legitimate visitors of the remote web site.
Solution: No solution is known at this time.
CVE Not available
Konversation IRC Client < 0.15.1 Multiple Remote Vulnerabilities
PVS ID: 2547 FAMILY: IRC Clients
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to a Denial of Service (DoS) attack.\n\nThe
remote host is running a Konversation, an IRC client. The remote version of this software
may be vulnerable to a remote Denial of Service attack and shell code execution attack.
Solution: Upgrade to Konversation 0.15.1 or higher.
CVE-2005-0131
Cisco IOS Telephony SCCP Control DoS (CSCee08584)
PVS ID: 2548 FAMILY: Generic
RISK:
MEDIUM
NESSUS ID:16217
Description: Synopsis :\n\nThe remote host is vulnerable to a Denial of Service (DoS) attack.\n\nThe
remote router contains a version of IOS that has flaw in its telephony\nservice.\n\nIf the
remote router is configured for ITS, CME or SRST, then an attacker\n\nmay send
malformed TCP queries to the remote host resulting in a reboot\n\nof the router.\nCISCO
identifies this vulnerability as Bug ID CSCee08584
Solution: Upgrade or patch according to vendor recommendations.
CVE-2005-0186
JSBoard < 2.0.10 session.php Arbitrary File Access
PVS ID: 2549 FAMILY: CGI
Passive Vulnerability Scanner (PVS) Signatures
RISK:
MEDIUM
NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to a flaw that allows attackers to retrieve
sensitive files or data.\n\nThe remote host appears to be running Ikonboard, a bulletin board
service implemented in Perl. This version is reported to be vulnerable to a file disclosure
flaw within the session.php file. Specifically, when the server is configured with PHP
'magic_quotes_gpc' disabled, a remote attacker can use session.php to read any file on the
web server that is readable by the web process owner.
Family Internet Services 649