27.02.2013 Views

(PVS) Signatures - Tenable Network Security

(PVS) Signatures - Tenable Network Security

(PVS) Signatures - Tenable Network Security

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

Solution: Upgrade or patch according to vendor recommendations.<br />

CVE Not available<br />

GroupWise WebAccess < 6.5 SP5 EMail IMG SRC XSS<br />

<strong>PVS</strong> ID: 3087 FAMILY: CGI<br />

RISK:<br />

MEDIUM<br />

NESSUS ID:19228<br />

Description: Synopsis :\n\nThe remote host is vulnerable to a Cross-Site Scripting (XSS) attack.\n\nThe<br />

remote host is running a version of GroupWise WebAccess from Novell that fails to<br />

sanitize email messages of HTML and script code embedded in IMG tags. An attacker can<br />

exploit this flaw to launch cross-site scripting attacks against users of WebAccess by<br />

sending them specially crafted email messages. The version of the remote Novell<br />

Groupwise server is\n%L<br />

Solution: Upgrade to version 6.5 SP5 or higher.<br />

CVE-2005-2276<br />

Firefox < 1.0.6 Multiple Vulnerabilities<br />

<strong>PVS</strong> ID: 3099 FAMILY: Web Clients RISK: HIGH NESSUS ID:18689<br />

Description: Synopsis : \n\nThe remote host is vulnerable to a buffer overflow.\n\nThe remote host is<br />

using Firefox. The remote version of this software contains various security issues that may<br />

allow an attacker to execute arbitrary code on the remote host. The reported browser<br />

version (as seen on the network) is: \n %L<br />

Solution: Upgrade to version 1.0.6 or higher.<br />

CVE-2004-0718<br />

PHP-Fusion < 6.00.107 Multiple Vulnerabilities<br />

<strong>PVS</strong> ID: 3100 FAMILY: CGI<br />

Passive Vulnerability Scanner (<strong>PVS</strong>) <strong>Signatures</strong><br />

RISK:<br />

MEDIUM<br />

NESSUS ID:19311<br />

Description: Synopsis :\n\nThe remote web server contains a script that is vulnerable to a SQL injection<br />

attack.\n\nAccording to its version number, the remote host is running a version of<br />

PHP-Fusion that suffers from multiple vulnerabilities. Namely:\n\nHTML Injection<br />

Vulnerability - An attacker can inject malicious CSS (Cascading Style Sheets) codes<br />

through [color] tags, thereby affecting how the site is rendered whenever users view<br />

specially-crafted posts.\n\nSQL Injection Vulnerability - The application fails to sanitize<br />

user-supplied input to the 'msg_view' parameter of the 'messages.php' script before using it<br />

in database queries. Exploitation requires that an attacker first authenticate.<br />

Solution: Upgrade to version 6.00.107 or higher.<br />

Family Internet Services 790

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!