(PVS) Signatures - Tenable Network Security

Description: The remote host is running OpenWebmail, an open-source perl script that gives remote
users a web-based interface to email. This version of OpenWebmail is vulnerable to a
cross-site scripting (XSS) attack. An attacker exploiting this flaw would be need to be able
to convince a user to click on a malicious URL. Upon successful exploitation, the attacker
would be able to steal credentials or execute code within the browser.
Solution: Upgrade or patch according to vendor recommendations.
CVE-2005-0445
Brooky CubeCart Multiple Vulnerabilities
PVS ID: 2617 FAMILY: CGI RISK: LOW NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to a Cross-Site Scripting (XSS) attack.\n\nThe
remote host is using Brooky CubeCart, an online storefront application written in PHP.
This version of CubeCart is vulnerable to a path disclosure and cross-site scripting
vulnerability.
Solution: Upgrade to Brooky CubeCart 2.0.5 or higher.
CVE-2005-0442
ELOG < 2.5.7 Unspecified Remote Buffer Overflows
PVS ID: 2618 FAMILY: CGI RISK: HIGH NESSUS ID:16469
Description: Synopsis :\n\nThe remote host is vulnerable to multiple remote buffer overflows.\n\nThe
remote server is running ELOG, an open source logbook web application. This version of
ELOG is reported to be prone to multiple remote overflows. An attacker exploiting these
alleged flaws would be able to execute code on the remote webserver.
Solution: Upgrade to ELOG 2.5.7 or higher.
CVE-2005-0439
Siteman users.php Remote Buffer Overflow
PVS ID: 2619 FAMILY: CGI
RISK:
MEDIUM
NESSUS ID:16216
Description: Synopsis :\n\nThe remote host is vulnerable to a buffer overflow.\n\nThe remote host is
running Siteman, a web-based content management system. This version of Siteman is
vulnerable to a remote buffer overflow in the users.php script. An attacker exploiting this
flaw would be able to gain 'site owner' access.
Solution: Upgrade or patch according to vendor recommendations.
CVE-2008-0452
Passive Vulnerability Scanner (PVS) Signatures
Family Internet Services 668