Many thanks for all that 
If SUPEE 7405 is already installed, is there anyway of finding out if V1.1 was also installed?
I presume because of the venerabilities, chances are it was not?
on the report there is several of this:
Vulnerability: osCommerce 2.2ms1 Multiple Script XSS
Compliance Status:Fail
Port TCP port 443
Synopsis: The remote web server is vulnerable to a cross-site scripting flaw. Impact: osCommerce is a widely installed open source shopping e-commerce solution. An attacker may use it to perform a cross-site scripting attack on this host.
Resolution: Upgrade to a newer version
The above is what most of the report states
Or this one. which is slightly different:
Vulnerability: CGI Generic Cookie Injection Scripting
Compliance Status:Fail
Synopsis: The remote web server is prone to cookie injection attacks.
Impact: The remote web server hosts at least one CGI script that fails to adequately
sanitize request strings with malicious JavaScript. By leveraging this issue, an attacker
may be able to inject arbitrary cookies. Depending on the structure of the web
application, it may be possible to launch a 'session fixation' attack using this
mechanism. Please note that : - SecurityMetrics did not check if the session fixation
attack is feasible. - This is not the only vector of session fixation.
See also : http://en.wikipedia.org/wiki/Session_fixation
http://www.owasp.org/index.php/Session_Fixation
http://www.acros.si/papers/session_fixation.pdf http://projects.webappsec.org/Session-
Fixation
Data Received: Using the GET HTTP method, SecurityMetrics found that : + The
following resources may be vulnerable to cookie manipulation : + The 'cat' parameter
of the /catalogsearch/result/index/ CGI : /catalogsearch/result/index/?cat=
<script>document.cookie="testllmd=764;" </script> -------- output -------- category: 3,
ajax: 1, reqUri: '/catalogsearch/result/index/?cat=<script>document.cookie="testl
lmd=764;"</script>' }); //]]> ------------------------ + The 'order' parameter of the
/xxxxxxx-for-motorsports-and-motorcycling.html CGI : /-for-motorsports-andmotorcycling.
html?order=<script>document.c ookie="testllmd=764;"</script> --------
output -------- category: 53, ajax: 1, reqUri: '/xxxxxx-for-motorsports-andmotorcycling.
html?order=<script>d ocument.cookie="testllmd=764;"</script>' }); //]]>
------------------------ + The 'dir' parameter of the /xxxxxxx-for-motorsports-andmotorcycling.
html CGI : /-for-motorsports-and-motorcycling.html?dir=
<script>document.coo kie="testllmd=764;"</script> -------- output -------- category: 53,
ajax: 1, reqUri: '/xxxxxx-for-motorsports-and-motorcycling.html?dir=<script>doc
ument.cookie="testllmd=764;"</script>' }); //]]> ------------------------ + The 'order' parameter of the /xxxxxx-for-motorsports-and-motorcycling.html CGI : /xxxxxx-formotorsports-
and-motorcycling.html?order=<script>document.c ookie="testllmd=764;"
</script>&dir=desc -------- output -------- category: 53, ajax: 1, reqUri: '/xxxxx-formotorsports-
and-motorcycling.html?order=<script>d ocument.cookie="testllmd=764;"
</script>&dir=desc' }); //]]> ------------------------ + The 'dir' parameter of the /for-
motorsports-and-motorcycling.html CGI : /xxxxx-for-motorsports-andmotorcycling.
html?order=name&dir=<script>d ocument.cookie="testllmd=764;"
</script> -------- output -------- category: 53, ajax: 1, reqUri: '/xxxxxx-for-motorsportsand-
motorcycling.html?order=name&dir= <script>document.cookie="testllmd=764;"
</script>' }); //]]> ------------------------
Port: 80
So, also from what others have said I am 'over thinking' the report, see I am looking for information and all the report has down is highlight more questions.
Where as the solution irrespective of the issue, is:
Resolution: Restrict access to the vulnerable application. Contact the vendor for a patch or upgrade.
So updating to latest patches or update to 1.9.2.4 ?
Many thanks
Hi,
Many thanks for that, I will double check, but as far as I can see there are no 'non magento folders'
Maybe I have missed something?!?!