The target is running at least one instance of Open WebMail whose version is 2.32 or earlier.  Such versions are vulnerable to a cross- site scripting attack whereby an attacker can cause a victim to unknowingly run arbitrary JavaScript code by reading a MIME message with a specially crafted Content-Type or Content-Description header. For further information, see :

  http://www.openwebmail.org/openwebmail/download/cert/advisories/SA-04:05.txt   http://www.rs-labs.com/adv/RS-Labs-Advisory-2004-2.txt   http://www.rs-labs.com/adv/RS-Labs-Advisory-2004-1.txt

***** Nessus has determined the vulnerability exists on the target
***** simply by looking at the version number of Open WebMail
***** installed there.

The remote host is running a version of the Oracle9i 'isqlplus' CGI that is vulnerable to a cross-site scripting attack. 

An attacker may exploit this flaw to steal the cookies of legitimate users on the remote host.

There is a bug in the version of Invision Power Board on the remote host that makes it vulnerable to cross-site scripting attacks.  An attacker may exploit this issue to steal the credentials of legitimate users of this site.

The remote host is running a version of vHost that is older than 3.10r1. There is a cross-site scripting vulnerability in this version that may allow an attacker to steal the cookies of the legitimate users of this site.

There are cross-site scripting vulnerabilities in the files 'ViewTopic.php' and 'ViewForum.php' in the remote installation of phpBB.

The remote host is running SandSurfer, a web-based time keeping application. 

A vulnerability has been disclosed in all versions of this software, up to version 1.7.0 (included) which may allow an attacker to use it to perform cross-site scripting attacks against third-party users.

There is a cross-site scripting issue in vBulletin that may allow an attacker to steal a user's cookies.

The remote host is running the ASP Portal CGI suite.

There is a cross-site scripting issue in this suite that may allow an attacker to steal your users cookies.

An attacker may use the installed version of Mambo Site Server to perform a cross-site scripting attack on the remote host.

The remote host is using the miniBB forum management system.
According to its version number, this forum is vulnerable to a cross-site scripting bug.  A remote attacker could exploit this to impersonate a legitimate user by tricking them into requesting a maliciously crafted URL.

The remote host is running the CGI 'sgdynamo.exe'. 

There is a bug in some versions of this CGI which makes it vulnerable to a cross-site scripting attack.

The remote server is running at least one instance of IMP whose version number is between 3.0 and 3.2.1 inclusive.  Such versions are vulnerable to several cross-scripting attacks whereby an attacker can cause a victim to unknowingly run arbitrary JavaScript code simply by reading an HTML message from the attacker. 

Note : Nessus has determined the vulnerability exists on the target simply by looking at the version number of IMP installed there.  If the installation has already been patched, consider this a false positive.

The version of Gallery hosted on the remote web server is affected by a cross-site scripting attack due to a failure to properly sanitize user-supplied input to the 'searchstring' parameter of the 'search.php' script.  A remote attacker may use this to steal the cookies from the legitimate users of this system.

The remote host is running Tmax Soft JEUS, a web application written in Java.

Input to the query string is not properly sanitized, which could lead to a cross-site scripting attack.  A remote attacker could exploit this by tricking a user into requesting a maliciously crafted URL.  This would allow the attacker to impersonate the targeted user.

The remote host is hosting the Pod.Board CGI suite, a set of PHP scripts designed to manage online forums.

There is a cross-site scripting issue in this suite that could allow an attacker to steal the cookies of your legitimate users, by luring them into clicking on a rogue URL.

The remote host is running a version of PostNuke that is vulnerable to various cross-site scripting attacks.

An attacker may use these flaws to steal the cookies of the legitimate users of this website.

The remote web server is running LedNews, a set of scripts designed to help maintain a news-based website.

There is a flaw in some versions of LedNews that could allow an attacker to include rogue HTML code in the news, which may in turn be used to steal the cookies of people visiting this site, or to annoy them by showing pop-up error messages and such.

The remote host is running the Zeus WebServer.

There is a vulnerability in the CGI 'vs_diag.cgi' that may allow an attacker to gain administrative access on that server.  To exploit this flaw, the attacker would need to lure the administrator of this server to click on a rogue link.

The remote host is running the Bandmin CGI suite. 

There is a cross-site scripting issue in this suite that may allow an attacker to steal your users cookies. 

The flaw lies in the cgi bandwitdh/index.cgi

The remote host is using ezPublish, a content management system.

There is a flaw in the remote ezPublish which lets an attacker perform a cross-site scripting attack. An attacker may use this flaw to steal the cookies of your legitimate users.

The remote host is running the Neoteris IVE.

There is a cross-site scripting issue in this server (in the CGI swsrv.cgi) that could allow an attacker to perform a session hijacking.

According to its banner, the version of SHOUTcast Server installed on the remote host is earlier than 1.9.5.  Such versions do not properly validate user input before storing it in its log file.  An attacker may use this flaw to perform a cross-site scripting attack against the administrators of the remote service and steal the administrators' cookies.

According to the web server banner, the version of mod_ssl running on the remote host has a cross-site scripting vulnerability. A remote attacker could exploit this by tricking a user into requesting a maliciously crafted URL, resulting in stolen credentials.

Note that several Linux distributions (such as RedHat) patched the old version of this module.  Therefore, this might be a false positive. Please check with your vendor to determine if you really are affected by this flaw.

The remote host has a CGI called 'testcgi.exe' installed under /cgi-bin that is vulnerable to a cross-site scripting issue.

The remote server is running Ocean12 GuestBook, a set of scripts to manage an interactive guestbook.

An attacker may use this module to inject malicious HTML code in your site, which may be used to steal users' cookies or to simply annoy them.

The remote host is running XMB Forum, a web forum written in PHP.

The version of XMB installed on the remote host is affected by several cross-site scripting issues.

There is a cross-site scripting issue in the version of XOOPS installed on the remote host that may allow an attacker to steal your user cookies.  The flaw lies in 'glossaire-aff.php'.

The remote host is running cc_guestbook.pl, a guestbook written in Perl. 

This CGI is vulnerable to a cross-site scripting attack.  An attacker may use this flaw to steal the cookies of your users.

The Sambar web server comes with a set of CGIs are that vulnerable to a cross-site scripting attack.

An attacker may use this flaw to steal the cookies of your web users.

The version of paFileDB installed on the remote host is vulnerable to cross-site scripting attacks due to its failure to sanitize input to the 'id' parameter of the 'pafiledb.php' script before using it to generate dynamic HTML.  An attacker may use these flaws to steal cookies of users of the affected application.

The remote host is vulnerable to a cross-site scripting attack through its web chat module :

- An attacker may create a new user with a bogus email address containing   JavaScript code
- Then the profile of the newly created user or the 'lost password' page   for this user will display the unprocessed JavaScript to the user

An attacker may use this flaw to steal the cookies of your regular users.

ezPublish 2.2.7 has a cross-site scripting bug. An attacker may use it to perform a cross-site scripting attack on this host.

In addition to this, another flaw may allow an attacker store hostile HTML code on the server side, which will be executed by the browser of the administrative user when he looks at the server logs.

Siteframe 2.2.4 has a cross-site scripting bug. An attacker may use it to perform a cross-site scripting attack on this host.

In addition to this, another flaw in this package may allow an attacker to obtain the physical path to the remote web root.

The version of DCP-Portal installed on the remote host fails to sanitize input to the script 'calendar.php' before using it to generate dynamic HTML, that could let an attacker execute arbitrary code in the browser of a legitimate user.

It may also be affected by HTML injection flaws, which could let an attacker to inject hostile HTML and script code that could permit cookie-based credentials to be stolen and other attacks, and HTTP response splitting flaw, that could let an attacker to influence or misrepresent how web content is served, cached or interpreted.

DCP-Portal has been reported to be vulnerable to an HTTP response splitting attack via the PHPSESSID parameter when passed to the calendar.php script. However, Nessus has not checked for this issue.

Basit cms 1.0 has a cross-site scripting bug. An attacker may use it to perform a cross-site scripting attack on this host.

In addition to this, it is vulnerable to a SQL insertion attack that could allow an attacker to get the control of your database.

An attacker may use the installed version of Mambo Site Server to perform a cross-site scripting attack on this host.

osCommerce is a widely installed open source shopping e-commerce solution.
An attacker may use it to perform a cross-site scripting attack on this host.

The remote host seems to be running MyAbraCadaWeb. An attacker may use it to perform a cross-site scripting attack on this host, or to reveal the full path to its physical location by sending a malformed request.

The remote host seems to be vulnerable to a security problem in SquirrelMail. The 'read_body.php' script doesn't filter out user input for multiple parameters, allowing for XSS attacks.

The remote ClearTrust server is vulnerable to a cross-site scripting attack that can be exploited using specially crafted calls to its 'ct_logon.asp' or 'ct_logon.jsp' scripts.

The version of the FrontPage extensions running on the remote web server is affected by a cross-site scripting (XSS) vulnerability in shtml.dll due to improper validation of filenames. An unauthenticated, remote attacker can exploit this, by convincing a user to follow a specially crafted URL, to execute arbitrary script code in the user's browser session.

The version of IBM Domino (formerly IBM Lotus Domino) running on the remote host is affected by a cross-site scripting vulnerability due to a failure to properly sanitize user-supplied input when requesting a '.nsf' file. A remote, unauthenticated attacker can exploit this issue, via a crafted URL, to execute arbitrary code in a user's browser.

The remote Auction Deluxe server is vulnerable to a cross-site scripting attack. 

As a result, a user could easily steal the cookies of your legitimate users and impersonate them.

The remote Simple File Manager CGI (fm.php) improperly validates the names of the directories entered and created by the user.

As a result, a user could generate a cross-site scripting attack on this host.

This IIS Server appears to be vulnerable to a cross-site scripting attack due to an error in the handling of overly-long requests on an idc file.  It is possible to inject JavaScript in the URL, that will appear in the resulting page.

Apache Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. 

By making requests for DOS Device names it is possible to cause Tomcat to throw an exception, allowing cross-site scripting attacks.  The exception also reveals the physical path of the Tomcat installation.

Apache Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. 

By using the /servlet/ mapping to invoke various servlets / classes it is possible to cause Tomcat to throw an exception, allowing XSS attacks.

The remote web server seems to be vulnerable to cross-site scripting attacks because it fails to sanitize input supplied as a filename when displaying an error page. 

The vulnerability would allow an attacker to make the server present the user with the attacker's JavaScript/HTML code.  Since the content is presented by the server, the user will give it the trust level of the server (for example, the trust level of banks, shopping centers, etc would usually be high).

Older versions of JServ (including the version shipped with Oracle9i App Server v1.0.2) are vulnerable to a cross-site scripting attack using a request for a nonexistent .JSP file.

The script /iissamples/sdk/asp/interaction/Form_JScript.asp (of Form_VBScript.asp) allows you to insert information into a form field and once submitted re-displays the page, printing the text you entered. This .asp doesn't perform any input validation. An attacker can exploit this flaw to execute arbitrary script code in the browser of an unsuspecting victim.

ID	Name	Severity
12262	Open WebMail Multiple Content Header XSS	medium
12112	Oracle 9iAS iSQLplus XSS	medium
12101	Invision Power Board index.php pop Parameter XSS	medium
12094	vHost < 3.10r1 Unspecified XSS	medium
12093	phpBB < 2.0.7 Multiple XSS	medium
12087	SandSurfer < 1.7.1 XSS	medium
12058	vBulletin search.php query Parameter XSS	medium
12057	ASP Portal User Profile XSS	medium
12045	Mambo Site Server itemid Parameter XSS	medium
11972	miniBB bb_func_usernfo.php Website Name Field XSS	medium
11955	SGDynamo sgdynamo.exe HTNAME XSS	medium
11815	Horde IMP IMP_MIME_Viewer_html Class XSS	medium
11810	Gallery search.php searchstring Parameter XSS	medium
11764	TMaxSoft JEUS url.jsp URI XSS	medium
11760	pod.board 1.1 Multiple Script XSS	medium
11743	PostNuke < 0.7.2.3 Multiple Script XSS	medium
11741	LedNews News Post XSS	medium
11681	Zeus Admin vs_diag.cgi XSS	medium
11672	Bandmin 1.4 index.cgi Multiple Parameter XSS	medium
11644	eZ Publish articleview.php XSS	medium
11608	Neoteris IVE swsrv.cgi XSS	medium
11624	SHOUTcast Server Admin Log File XSS	medium
11622	Apache mod_ssl Host: Header XSS	medium
11610	Ceilidh testcgi.exe query Parameter XSS	medium
11537	Ocean12 Guestbook XSS	medium
11527	XMB < 1.9.1 Multiple XSS	medium
11508	XOOPS Glossary Module glossaire-aff.php lettre Parameter XSS	medium
11503	CC GuestBook cc_guestbook.pl Multiple Parameter XSS	medium
11492	Sambar Server Multiple Script XSS	medium
11479	paFileDB pafiledb.php id Parameter XSS	medium
11470	WebChat XSS	medium
11449	ez Publish Multiple XSS	medium
11448	Siteframe search.php searchfor Parameter XSS	medium
11446	DCP-Portal Multiple Script XSS	medium
11445	Basit CMS Multiple Script XSS	medium
11441	Mambo Site Server 4.0.10 XSS	medium
11437	osCommerce 2.2ms1 Multiple Script XSS	medium
11417	MyAbraCadaWeb header.php ma_kw Parameter XSS	medium
11415	SquirrelMail 1.2.9 / 1.2.10 read_body.php Multiple Parameter XSS	medium
11399	RSA ClearTrust ct_logon.asp Multiple Parameter XSS	medium
11395	Microsoft IIS shtml.dll XSS	medium
11394	IBM Domino nsf File Argument XSS	medium
11365	Auction Deluxe auction.pl Multiple Parameter XSS	medium
11362	Simple File Manager Directory / Filename XSS	medium
11142	Microsoft IIS IDC Extension XSS	medium
11042	Apache Tomcat DOS Device Name XSS	medium
11041	Apache Tomcat /servlet Mapping XSS	medium
11010	IBM WebSphere Traversal Error Page XSS	medium
10957	Apache JServ Nonexistent JSP Request XSS	medium
10572	Microsoft IIS 5.0 Form_JScript.asp XSS	medium

Detections

Analytics

CGI abuses : XSS Family for Nessus

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium