(PVS) Signatures - Tenable Network Security

Sunshop < 3.4RC2 index.php search Parameter XSS
PVS ID: 2590 FAMILY: Web Servers RISK: LOW NESSUS ID:Not Available
Description: The remote host is running the Sunshop e-commerce shopping cart. This version of
Sunshop is vulnerable to a remote cross-site scripting (XSS) attack. An attacker
exploiting this flaw would need to be able to convince a user to click on a malicious
URL which, when executed, would run potentially malicious code within the client
browser.
Solution: Upgrade to version 3.4RC2 or higher.
CVE Not available
ngIRCd < 0.8.3 Log_Resolver() Remote Format String Overflow
PVS ID: 2591 FAMILY: Generic RISK: HIGH NESSUS ID:16310
Description: Synopsis :\n\nThe remote host is vulnerable to a buffer overflow.\n\nThe remote host is
running a version of the ngIRCd service that may\nbe vulnerable to a buffer overflow in the
way the server handles user-supplied data which is passed to syslog().
Solution: Upgrade to version 0.8.3 or higher.
CVE-2005-0226
ht://Dig config Parameter XSS
PVS ID: 2592 FAMILY: CGI RISK: LOW NESSUS ID:Not Available
Description: The remote version of htsearch appears to be vulnerable to a remote Cross-Site
Scripting (XSS) attack. An attacker exploiting this flaw would need to be able to
entice a user into clicking on a malicious URL that would contain embedded script
code designed to exploit trust and execute within the client browser.\nThe remote
host is running %L
Solution: Upgrade or patch according to vendor recommendations.
CVE-2005-0085
WWWBoard Password File Disclosure
Passive Vulnerability Scanner (PVS) Signatures
PVS ID: 2593 FAMILY: CGI RISK: LOW NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to a flaw that allows attackers to retrieve
sensitive files or data.\n\nThe remote host appears to be running WWWBoard.
WWWBoard is a web-based forum written in Perl. There is a flaw in the default
configuration of WWWBoard that would allow a remote attacker to retrieve the password
file. To exploit the flaw, the attacker would only need to be able to request the
/wwwboard/passwd.txt file. The attacker could then crack the password file and log into the
machine with enhanced access rights.
Family Internet Services 661