RHEL 7 : pcs (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - rubygem-json: Unsafe object creation vulnerability in JSON CVE-2020-10663 - ClusterLabs pcs before versio...

RHEL 7 : libdwarf (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - libdwarf: heap-based buffer over-read in dwarfformsdata CVE-2017-9055 - Use-after-free vulnerability in...

RHEL 5 : vim (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - vim: Integer overflow at an unserializeuep memory allocation site CVE-2017-6350 - Untrusted search path...

RHEL 5 : log4j (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - log4j: deserialization of untrusted data in SocketServer CVE-2019-17571 - In Apache Log4j 2.x before 2.8....

RHEL 6 : spice-vdagent (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - spice-vdagent: Improper validation of xfers-savedir in vdagentfilexfersdata CVE-2017-15108 Note that Nessus has not...

RHEL 6 : openstack-glance (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - openstack-glance: API v1 copyfrom reveals network details CVE-2017-7200 - A vulnerability was found in...

RHEL 7 : freerdp (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - freerdp: Out-of-bounds write in rdprecvtpktpdu CVE-2017-2835 - FreeRDP before 1.1.0-beta1 allows remote...

RHEL 7 : mysql-connector-java (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - mysql-connector-java: Connector/J unspecified vulnerability CPU October 2018 CVE-2018-3258 - Unspecified...

RHEL 6 : fop (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - fop: XML external entity processing vulnerability CVE-2017-5661 Note that Nessus has not tested for this issue but...

RHEL 7 : ncurses (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - ncurses: Stack-based buffer overflow caused by format string vulnerability in fmtentry function...

RHEL 6 : openexr (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - OpenEXR: Out-of-bounds write in the = operator function CVE-2017-9115 - In OpenEXR 2.2.0, a crafted image...

RHEL 6 : gtk-vnc (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - gtk-vnc: Integer overflow when processing SetColorMapEntries CVE-2017-5885 - gtk-vnc 0.4.2 and older...

RHEL 5 : tomcat5 (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - tomcat: security manager bypass via IntrospectHelper utility function CVE-2016-5018 - tomcat: Remote Code...

RHEL 7 : poppler (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - poppler: heap buffer overflow in ExponentialFunction CVE-2015-8868 - poppler: recursive function call in...

RHEL 5 : kernel (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - kernel: netfilter: use-after-free in tcpmssmanglepacket function in net/netfilter/xtTCPMSS.c CVE-2017-180...

Decoding Water Sigbin's Latest Obfuscation Tricks

Water Sigbin aka the 8220 Gang exploited the Oracle WebLogic vulnerabilities CVE-2017-3506 and CVE-2023-21839 to deploy a cryptocurrency miner using a PowerShell script. The threat actor also adopted new techniques to conceal its activities, making attacks harder to defend against...

silverstripe/framework vulnerable to member disclosure in login form

There is a user ID enumeration vulnerability in our brute force error messages. - Users that don't exist in will never get a locked out message - Users that do exist, will get a locked out message This means an attacker can infer or confirm user details that exist in the member table. This issue...

Apache Tomcat 8.5.0 < 8.5.12

The version of Tomcat installed on the remote host is prior to 8.5.12. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat8.5.12security-8 advisory. - While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M...

Apache Tomcat 8.0.0.RC1 < 8.0.42

The version of Tomcat installed on the remote host is prior to 8.0.42. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat8.0.42security-8 advisory. - While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M...

Apache Tomcat 9.0.0.M1 < 9.0.0.M21

The version of Tomcat installed on the remote host is prior to 9.0.0.M21. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat9.0.0.m21security-9 advisory. - The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an err...