This host is running ActivDesk and is prone to multiple cross site scripting and SQL injection vulnerabilities.
Successful exploitation allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Impact Level: Application
Upgrade to ActivDesk version 3.0.1 or later, For updates refer to http://www.webhelpdesk-software.com/download.html
Multiple flaws are due to - Improper validation of user-supplied input passed to the 'keywords0', 'keywords1', 'keywords2' and 'keywords3' parameters in search.cgi, which allows attackers to execute arbitrary HTML and script code on the web server. - Improper validation of user-supplied input passed to the 'cid' parameter in kbcat.cgi and the 'kid' parameter in kb.cgi, which allows attacker to manipulate SQL queries by injecting arbitrary SQL code.
ActivDesk version 3.0 and prior.
- Adobe ColdFusion Multiple Vulnerabilities-01 May-2014
- Atlassian JIRA FishEye and Crucible Plugins XML Parsing Unspecified Security Vulnerability
- Agora CGI Cross Site Scripting
- 3Com OfficeConnect VPN Firewall Default Password Security Bypass Vulnerability
- Apache Archiva Multiple Remote Command Execution Vulnerabilities