(PVS) Signatures - Tenable Network Security

Description: The remote host is running the SAP Internet Transaction Server (ITS). According to
embedded HTML comments, the version and build information is: \n %L
Solution: N/A
CVE Not available
SAP Internet Transaction Server < 6.20 Patch 18 wgate urlmime Parameter XSS
PVS ID: 3753 FAMILY: CGI
RISK:
MEDIUM
NESSUS ID:22465
Description: The remote web server contains a CGI script that is vulnerable to a cross-site scripting
attack. The remote web server fails to sanitize the contents of the 'urlmime' parameter to the
'/scripts/wgate' script before using it to generate dynamic web content. An unauthenticated
remote attacker may be able to leverage this issue to inject arbitrary HTML and script code
into a user's browser to be evaluated within the security context of the affected web site.
Solution: Upgrade to version 6.20 Patch 18 or higher.
CVE-2006-5114
OpenBSD Portable OpenSSH < 4.4.p1 GSSAPI Authentication Overflow
PVS ID: 3754 FAMILY: SSH RISK: HIGH NESSUS ID:22466
Description: Synopsis : \n\nThe remote host is vulnerable to a buffer overflow.\n\nThe remote host is
running a version of OpenSSH that is vulnerable to a flaw in the way that it handles
GSSAPI authentication. If the SSH server is configured to utilize GSSAPI authentication
then the host may be compromised by a remote attacker with access to the SSH port
(typically 22). Successful exploitation would result in remote code execution. The reported
version number is: \n %L
Solution: Upgrade to version 4.4.p1 or higher.
CVE-2006-5052
OpenSSL < 0.9.7l / 0.9.8d Multiple Vulnerabilities
PVS ID: 3755 FAMILY: Web Servers RISK: HIGH NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to multiple attack vectors.\n\nThe remote host
is using a version of OpenSSL that is older than 0.9.6m or 0.9.7d There are several bugs in
this version of OpenSSL that may allow an attacker to either execute remote code or cause
a Denial of Service (DoS).
Solution: Upgrade to version 0.9.7l, 0.9.8d or higher.
CVE-2006-3738
Passive Vulnerability Scanner (PVS) Signatures
Family Internet Services 970