(PVS) Signatures - Tenable Network Security

Solution: Upgrade or patch according to vendor recommendations.
CVE-2005-0563
Opera Multiple Injection Vulnerabilities
PVS ID: 3015 FAMILY: Web Clients
RISK:
MEDIUM
NESSUS ID:18503
Description: Synopsis :\n\nThe remote host is vulnerable to an HTML Injection attack.\n\nThe remote
host is using a version of Opera that is prone to a security flaw where a malicious attacker
can inject malicious data into a URI. Such an attack would require that the attacker be able
to convince an Opera user to browse to a malicious URI. Successful exploitation would
result in the attacker gaining access to confidential data (such as authentication cookies) or
executing code within the browser.
Solution: Upgrade or patch according to vendor recommendations.
CVE-2003-1420
SquirrelMail < 1.4.5 Multiple Vulnerabilities
PVS ID: 3016 FAMILY: CGI
RISK:
MEDIUM
NESSUS ID:18504
Description: Synopsis :\n\nThe remote host is vulnerable to multiple attack vectors.\n\nThe remote host
is running SquirrelMail, a webmail system written in PHP.\nThe version of SquirrelMail
installed on the remote host is prone to multiple flaws :\n - Multiple Cross-Site Scripting
Vulnerabilities. Using a specially-crafted URL or email message, an attacker may be able
to exploit these flaws, stealing cookie-based session identifiers and thereby hijacking
SquirrelMail sessions.\n - Post Variable Handling Vulnerabilities - Using specially-crafted
POST requests, an attacker may be able to set random variables in the file
'options_identities.php', which could lead to accessing other users' preferences, cross-site
scripting attacks, and writing to arbitrary files.\n
Solution: Upgrade to version 1.4.5 or higher.
CVE-2005-1769
Ultimate PHP Board < 1.9.7 Multiple XSS
Passive Vulnerability Scanner (PVS) Signatures
PVS ID: 3017 FAMILY: CGI RISK: LOW NESSUS ID:Not Available
Description: The remote host is running Ultimate PHP Board, a message board written \nin PHP.
Versions of Ultimate less than 1.9.7 are vulnerable to\nmultiple Cross-Site Scripting (XSS)
flaws. An attacker \nexploiting these flaws would typically need to be able to convince a
user\nto browse to a malicious URI. Successful exploitation would result\nin arbitrary code
executing in the client browser and possible theft of\nconfidential data (such as
authentication cookies).
Family Internet Services 769