(PVS) Signatures - Tenable Network Security

PVS ID: 2686 FAMILY: CGI RISK: HIGH NESSUS ID:19505
Description: Synopsis :\n\nThe remote web server contains a script that is vulnerable to a SQL injection
attack.\n\nPHP Arena paFileDB is a web application that is used to manage files. This
version of paFileDB is vulnerable to a remote cross-site-scripting (XSS) flaw. Exploiting
the flaw may enable an attacker to inject arbitrary script code into the browser of
unsuspecting users. A successful attack would potentially allow the attacker the ability to
view confidential data (cookies, authentication data, and more) or compromise the integrity
of the local system via the web browser. The version of paFileDB is also vulnerable to a
remote SQL injection attack. An attacker exploiting this flaw would only need to be able to
send a query to the 'viewall.php' or 'category.php' script. A successful exploit would give
the attacker the ability to read or write confidential data as well as potentially execute
arbitrary commands on the remote web server.
Solution: Upgrade to version 3.2 or higher.
CVE-2005-0782
NewsScript Content Management Admin Authentication Bypass
PVS ID: 2687 FAMILY: CGI
RISK:
MEDIUM
NESSUS ID:17309
Description: Synopsis :\n\nThe remote host is running an inherently insecure protocol or
application.\n\nThe remote host is running the NewsScript.co.uk news content management
system. NewsScript is a perl script that manages news items and present them in an HTML
format. There have been flaws in previous versions of NewsScript. You should manually
check whether or not the application is vulnerable.
Solution: No solution is known at this time.
CVE-2005-0735
CA License Service Multiple Vulnerabilities
PVS ID: 2688 FAMILY: Generic RISK: HIGH NESSUS ID:17307
Description: Synopsis :\n\nThe remote host is vulnerable to a buffer overflow.\n\nThe remote host is
running the Computer Associate License Application.\n\nThe remote version of this
software is vulnerable to several flaws that\nmay allow a remote attacker to execute
arbitrary code on the remote host\nwith the SYSTEM privileges.
Solution: Upgrade or patch according to vendor recommendations.
CVE-2005-0583
CA License Service Client Detection
Passive Vulnerability Scanner (PVS) Signatures
PVS ID: 2689 FAMILY: Generic RISK: INFO NESSUS ID:Not Available
Family Internet Services 689