27.02.2013 Views

(PVS) Signatures - Tenable Network Security

(PVS) Signatures - Tenable Network Security

(PVS) Signatures - Tenable Network Security

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

Description: Synopsis :\n\nThe remote host is vulnerable to a script injection attack.\n\nThe remote host<br />

is running the Simple PHP Blog, a web log (or blog) package. This version of Simple PHP<br />

Blog is vulnerable to a flaw where remote users can upload arbitrary files to the server.<br />

Successful exploitation results in the attacker executing code on the server or executing<br />

code in unsuspecting user's browser.<br />

Solution: No solution is known at this time.<br />

CVE-2005-2733<br />

Gallery < 1.5.3-RC3 EXIF Data XSS<br />

<strong>PVS</strong> ID: 3185 FAMILY: CGI<br />

RISK:<br />

MEDIUM<br />

NESSUS ID:19512<br />

Description: Synopsis :\n\nThe remote host is vulnerable to a script injection attack.\n\nThe remote host<br />

is running Gallery, a web-based photo album. According to its banner, the version of<br />

Gallery installed on the remote host is prone to script insertion attacks because it does not<br />

sanitize malicious EXIF data stored in image files. Using a specially-crafted image file, an<br />

attacker can exploit this flaw to cause arbitrary HTML and script code to be executed in a<br />

user's browser within the context of the affected application.<br />

Solution: Upgrade to version 1.5.3-RC3 or higher.<br />

CVE-2005-2734<br />

YaPiG EXIF Data Script Injection<br />

<strong>PVS</strong> ID: 3186 FAMILY: CGI<br />

RISK:<br />

MEDIUM<br />

NESSUS ID:19515<br />

Description: Synopsis :\n\nThe remote host is vulnerable to a script injection attack.\n\nThe remote host<br />

is running YaPiG, a web-based image gallery written in PHP. According to its banner, the<br />

version of YaPiG installed on the remote host is prone to script insertion attacks because it<br />

does not sanitize malicious EXIF data stored in image files. Using a specially-crafted image<br />

file, an attacker can exploit this flaw to cause arbitrary HTML and script code to be<br />

executed in a user's browser within the context of the affected application.<br />

Solution: Upgrade or patch according to vendor recommendations.<br />

CVE-2006-4421<br />

PhotoPost < 5.11 PHP Pro EXIF Data XSS<br />

<strong>PVS</strong> ID: 3187 FAMILY: CGI<br />

Passive Vulnerability Scanner (<strong>PVS</strong>) <strong>Signatures</strong><br />

RISK:<br />

MEDIUM<br />

NESSUS ID:19513<br />

Description: Synopsis :\n\nThe remote host is vulnerable to a Cross-Site Scripting (XSS)<br />

attack.\n\nAccording to its banner, the version of PhotoPost PHP Pro installed on the<br />

remote host is prone to script insertion attacks because it does not sanitize malicious EXIF<br />

data stored in image files. Using a specially-crafted image file, an attacker can exploit this<br />

Family Internet Services 818

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!