MoinMoin rsslink() Function page_name Parameter XSS

The MoinMoin install hosted on the remote web server fails to properly sanitize user-supplied input in the 'pagename' parameter when creating an rss link. An attacker may be able to leverage this issue to inject arbitrary HTML and script code into a user's browser to be executed within the securi...

Cisco Prime LAN Management Solution Web Detection

Cisco Prime LAN Management solution, a network management application, was detected on the remote web server. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid64789; scriptversion"1.5"; scriptcvsdate"Date: 2019/11/25"; scriptnameenglish:"Cisco Prime LAN Management...

php-Charts url.php Remote PHP Code Execution

The php-Charts install hosted on the remote web server contains a flaw that could allow arbitrary PHP code execution. Input passed to the 'wizard/url.php' script is not properly sanitized before being used in a PHP eval call. An unauthenticated, remote attacker could leverage this vulnerability t...

WordPress 'xmlrpc.php' pingback.ping Server-Side Request Forgery

The WordPress install hosted on the remote web server is affected by a server-side request forgery vulnerability because the 'pingback.ping' method used in 'xmlrpc.php' fails to properly validate source URIs Uniform Resource Identifiers. A remote, unauthenticated attacker can exploit this issue t...

Dell OpenManage Server Administrator index_main.htm DOM-based XSS

The version of Dell OpenManage Server Administrator hosted on the remote web server has a cross-site scripting vulnerability. Making a specially crafted request for indexmain.htm can result in client-side script injection. An attacker could exploit this by tricking a user into requesting a...

Drupal 6.x < 6.27 / 7.x < 7.18 Multiple Vulnerabilities

The remote web server is running a version of Drupal that is 6.x prior to 6.27 or 7.x prior to 7.18. It is, therefore, potentially affected by multiple vulnerabilities : - An access bypass vulnerability exists that allows search results to improperly display information about blocked users...

NetIQ Privileged User Manager Default Admin Password

Nessus was able to login to the NetIQ Privileged User Manager install running on the remote host using default, known credentials for the 'admin' user. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid62990;...

WebYaST Web Client Detection

WebYaST web client, a web interface for YaST, was detected on the remote host. YaST is used for administration of hosts running SUSE Linux operating systems. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid62966; scriptversion"1.5"; scriptcvsdate"Date: 2019/11/22";...

Mutiny Detection

The remote web server hosts Mutiny, a network monitoring application that uses SNMP to gather infrastructure information and process and display the results in a web-based interface. This information is used to assess the health of network devices. C Tenable Network Security, Inc...

Drupal 7.x < 7.16 Multiple Vulnerabilities

The remote web server is running a version of Drupal that is 7.x prior to 7.16. It is, therefore, potentially affected by multiple vulnerabilities : - An arbitrary PHP code execution vulnerability exists due to an error in the 'installer.php' script. An attacker, under certain conditions, could u...

[SECURITY] Fedora 16 Update: phpldapadmin-1.2.2-3.gitbbedf1.fc16

PhpLDAPadmin is a web-based LDAP client. It provides easy, anywhere-accessible, multi-language administration for your LDAP server. Its hierarchical tree-viewer and advanced search functionality make it intuitive to browse and administer your LDAP director y. Since it is a web application, this...

phpMyAdmin server_sync.php Backdoor (PMASA-2012-5)

The phpMyAdmin install hosted on the remote web server contains a backdoor script, probably obtained from the cdnetworks-kr-1 SourceForge.net mirror site as part of the file phpMyAdmin-3.5.2.2-all-languages.zip. An unauthenticated, remote attacker can use this backdoor to execute arbitrary PHP co...

SAP Host Control SOAP Web Service Detection

SAP Host Control, a SOAP endpoint, is running on the remote host. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid62292; scriptversion"1.4"; scriptcvsdate"Date: 2019/11/22"; scriptnameenglish:"SAP Host Control SOAP Web Service Detection"; scriptsummaryenglish:"Looks f...

LogAnalyzer index.php 'filter' Parameter XSS

The LogAnalyzer install hosted on the remote web server is affected by a cross-site scripting vulnerability due to a failure to properly sanitize user input to the 'filter' parameter of the 'index.php' script. An attacker can exploit this issue to inject arbitrary HTML and script code into a user...

LogAnalyzer index.php 'highlight' Parameter XSS

The LogAnalyzer install hosted on the remote web server is affected by a cross-site scripting vulnerability due to a failure to properly sanitize user input to the 'highlight' parameter of the 'index.php' script. An attacker can exploit this issue to inject arbitrary HTML and script code into a...

Apache Struts 2 struts2-showcase edit-person.action Persistent XSS

The remote web server hosts struts2-showcase, a demonstration application for the Struts 2 framework. Input passed via the 'name' and 'lastName' parameters to 'edit-person.action' is not properly sanitized, which can allow for arbitrary HTML and script code to be loaded onto the system and execut...

Eaton Network Shutdown Module view_list.php paneStatusListSortBy Parameter eval() Call Remote PHP Code Execution

The version of the Eaton Network Shutdown Module hosted on the remote web server does not sanitize user input to the 'paneStatusListSortBy' parameter of the 'viewlist.php' script before using it as part of a command to be executed via PHP's 'eval' function. An unauthenticated, remote attacker can...

CVE-2012-1963

The Content Security Policy CSP functionality in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 does not properly restrict the strings placed into the blocked-uri parameter of a violatio...

Atlassian Crucible Detection

Atlassian Crucible, a web-based code review application written in Java, is hosted on the remote web server. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid59326; scriptversion"1.5"; scriptcvsdate"Date: 2019/11/25"; scriptnameenglish:"Atlassian Crucible Detection";...

Apache OFBiz Default Credentials

Nessus was able to login to the remote Apache OFBiz application by providing default credentials. A remote attacker can exploit this issue to perform administrative actions. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...