What can be done to mitigate theses security issues found by Nikto on all our Ubuntu servers version 12.10?
OSVDB-2799: /cgi-915/dose.pl?daily&somefile.txt&|ls|: DailyDose 1.1 is vulnerable to a directory traversal attack in the 'list' parameter.
OSVDB-3233: /icons/README: Apache default file found.
/modules.php?op=modload&name=FAQ&file=index&myfaq=yes&id_cat=1&categories=%3Cimg%20src=javascript:alert(9456);%3E&parent_id=0: Post Nuke 0.7.2.3-Phoenix is vulnerable to Cross Site Scripting (XSS). cert.org/advisories/CA-2000-02.html.
This one is looking weird to me, since we do not use Web Wiz Forum script (can i assume this is just a false positive???!!!!???) :
- OSVDB-4598: /members.asp?SF=%22;}alert('Vulnerable');function%20x(){v%20=%22: Web Wiz Forums ver. 7.01 and below is vulnerable to Cross Site Scripting (XSS). cert.org/advisories/CA-2000-02.html.
OSVDB-27071: /phpimageview.php?pic=javascript:alert(8754): PHP Image View 1.0 is vulnerable to Cross Site Scripting (XSS). cert.org/advisories/CA-2000-02.html.
Thank you!