This script is Copyright (C) 2008-2016 Tenable Network Security, Inc.
The remote FreeBSD host is missing a security-related update.
The Flyspray Project reports :
Flyspray is affected by a Cross Site scripting Vulnerability due to an
error escaping PHP's $_SERVER['QUERY_STRING'] superglobal, that can be
maliciously used to inject arbitrary code into the savesearch()
There is an XSS problem in the history tab, the application fails to
sanitize the 'details' parameter correctly, leading to the possibility
Flyspray is affected by a Cross Site scripting Vulnerability due
missing escaping of SQL error messages. By including HTML code in a
query and at the same time causing it to fail by submitting invalid
data, an XSS hole can be exploited.
There is an XSS problem in the task history attached to comments,
since the application fails to sanitize the old_value and new_value
database fields for changed task summaries.
Input passed via the 'item_summary' parameter to
'index.php?do=details' is not properly sanitised before being returned
to the user. This can be exploited to execute arbitrary HTML and
script code in a user's browser session in context of an affected
See also :
Update the affected package.
Risk factor :
Medium / CVSS Base Score : 5.0
Family: FreeBSD Local Security Checks
Nessus Plugin ID: 34498 (freebsd_pkg_9d3020e4a2c411dda9f90030843d3802.nasl)
Get Nessus Professional to scan unlimited IPs, run compliance checks & moreBuy Nessus Professional Now