27.02.2013 Views

(PVS) Signatures - Tenable Network Security

(PVS) Signatures - Tenable Network Security

(PVS) Signatures - Tenable Network Security

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

web application.<br />

Solution: Upgrade or patch according to vendor recommendations.<br />

CVE-2005-1031<br />

Active Auction House Multiple Vulnerabilities<br />

<strong>PVS</strong> ID: 2799 FAMILY: CGI RISK: HIGH NESSUS ID:17989<br />

Description: Synopsis :\n\nThe remote web server contains a script that is vulnerable to a SQL injection<br />

attack.\n\nThe remote host is running Active Auction House, an auction software written in<br />

ASP.\n\nThe remote version of this software is vulnerable to various SQL injection<br />

and\ncross-site scripting issues.<br />

Solution: Upgrade or patch according to vendor recommendations.<br />

CVE-2005-1029<br />

Lotus Domino Server < 6.5.3 Web Service Remote DoS<br />

<strong>PVS</strong> ID: 2800 FAMILY: Web Servers<br />

RISK:<br />

MEDIUM<br />

NESSUS ID:17991<br />

Description: Synopsis :\n\nThe remote host is vulnerable to a Denial of Service (DoS) attack.\n\nThe<br />

remote host is running a version of Lotus Domino Server's web service that is prone to a<br />

denial of service vulnerability. By sending a specially crafted HTTP request with a long<br />

string of unicode characters, a remote attacker can crash the nHTTP.exe process, denying<br />

service to legitimate users. IBM has released technote number 1202446 for this issue but<br />

has been unable to reproduce it.<br />

Solution: Upgrade to version 6.5.3 or higher.<br />

CVE-2005-0986<br />

Brooky CubeCart < 2.0.7 Multiple Script SQL Injection<br />

<strong>PVS</strong> ID: 2801 FAMILY: CGI RISK: HIGH NESSUS ID:17999<br />

Description: Synopsis :\n\nThe remote web server contains a script that is vulnerable to a SQL injection<br />

attack.\n\nThe remote host is using Brooky CubeCart, an online storefront application<br />

written in PHP. This version of CubeCart is vulnerable to multiple remote SQL injection<br />

flaws. An attacker exploiting these flaws would send a malformed HTTP request to the<br />

application. Successful exploitation would result in viewing of confidential data,<br />

modification of confidential data, and potentially arbitrary code execution. The flawed PHP<br />

scripts are 'index.php', 'tellafriend.php', 'view_cart.php', and 'view_product.php'<br />

Solution: Upgrade to version 2.0.7 or higher..<br />

CVE-2005-1033<br />

Passive Vulnerability Scanner (<strong>PVS</strong>) <strong>Signatures</strong><br />

Family Internet Services 721

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!