PT-2023-12444 · WordPress · Ulisting

Name of the Vulnerable Software and Affected Versions: uListing plugin for WordPress versions up to, and including, 1.6.6 Description: The issue allows for authorization bypass via Ajax due to missing capability checks, missing input validation, and a missing security nonce in the stm update emai...

WordPress Plugin Brilliance 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2023-23480 · Skyscreamer · Nevado Jms

Name of the Vulnerable Software and Affected Versions: Skyscreamer Open Source Nevado JMS version 1.3.2 Description: The issue allows attackers to execute arbitrary commands by supplying crafted data due to the lack of security checks when receiving messages. Recommendations: For Skyscreamer Open...

AlmaLinux 8 : autotrace (ALSA-2023:3067)

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2023:3067 advisory. - AutoTrace v0.40.0 was discovered to contain a heap overflow via the ReadImage function at input-bmp.c:660. CVE-2022-32323 Note that Nessus has not tested for thi...

AlmaLinux 8 : mingw-expat (ALSA-2023:3068)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2023:3068 advisory. - libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c. CVE-2022-40674 Note that Nessus has not tested for this issue but has instead...

OpenShift: Missing HTTP Strict Transport Security

Openshift 4.9 does not use HTTP Strict Transport Security HSTS which may allow man-in-the-middle MITM attacks...

PT-2023-15476 · Nanoleaf · Nanoleaf

Name of the Vulnerable Software and Affected Versions: Nanoleaf firmware versions prior to 7.1.1 Description: The issue is related to missing TLS verification, allowing attackers to execute arbitrary code via a DNS hijacking attack. This affects IoT smart lights, enabling unauthenticated remote...

Fedora 37 : kernel (2023-4f2cf7e5d2)

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-4f2cf7e5d2 advisory. The 6.2.12 stable kernel update contains a number of important fixes across the tree. Tenable has extracted the preceding description block directly from the...

Oracle Identity Manager (Apr 2023 CPU)

The version of Oracle Identity Manager installed on the remote host is missing a security patch and is, therefore affected by multiple vulnerabilities as referenced in the April 2023 Critical Patch UpdateCPU advisory. - Vulnerability in the jackson-databind component of Oracle Identity Manager...

Fedora 36 : firefox (2023-50f9eb7aca)

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-50f9eb7aca advisory. - New upstream update 112.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has n...

SUSE SLES12: apache2-mod_php74 / php74 / php74-bcmath / php74-bz2 / etc (SUSE-SU-2023:1847-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:1847-1 advisory. - CVE-2022-4900: Fixed potential buffer overflow via PHPCLISERVERWORKERS environment variable. bsc1209537 Tenable has extracted the precedin...

Adobe Substance 3D Stager 缓冲区错误漏洞

Adobe Substance 3D Stager is a virtual 3D studio from the American company Audobee Adobe. A heap buffer overflow vulnerability exists in Adobe Substance 3D Stager in versions 2.0.1 and earlier. The vulnerability stems from a failure to perform security checksums on parameters in a user's context,...

CBL Mariner 2.0 Security Update: bind (CVE-2022-3080)

The version of bind installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-3080 advisory. - By sending specific queries to the resolver, an attacker can cause named to crash. CVE-2022-3080 Note that Ness...

SUSE SLES12: dpdk / dpdk-kmp-default / dpdk-thunderx / dpdk-thunderx-kmp-default / etc (SUSE-SU-2023:1572-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:1572-1 advisory. - rebuild the package with the new secure boot key bsc1209188. Tenable has extracted the preceding description block directly from the SUSE...

RHEL 8 : nss (RHSA-2023:1369)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1369 advisory. Network Security Services NSS is a set of libraries designed to support the cross-platform development of security-enabled client and server...

Amazon Linux 2 : nss (ALAS-2023-1992)

The version of nss installed on the remote host is prior to 3.79.0-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1992 advisory. firefox-esr , thunderbird and nss only are affected by this package. CVE-2023-0767 Tenable has extracted the preceding description blo...

CBL Mariner 2.0 Security Update: mariadb (CVE-2022-27449)

The version of mariadb installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-27449 advisory. - MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component...

Fedora 36 : tigervnc (2023-c41e8f24bb)

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-c41e8f24bb advisory. Tigervnc 1.13.1 update. CVE-2023-0494 tigervnc: xorg-x11-server: DeepCopyPointerClasses use-after-free leads to privilege elevation Tenable has...

Fedora 38 : stb (2023-815aa77986)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-815aa77986 advisory. Fix null pointer dereference in stbimage Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus h...

Scientific Linux Security Update : pesign on SL7.x x86_64 (2023:1093)

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2023:1093-1 advisory. - pesign: Local privilege escalation on pesign systemd service CVE-2022-3560 Note that Nessus has not tested for this issue but has instead relied only on...