490 matches found
Security Bulletin: IBM i2 Analyze missing security header (CVE-2021-29769)
Summary Some secure header options were missing in communication with the i2 Analyze server. Vulnerability Details CVEID: CVE-2021-29769 DESCRIPTION: IBM i2 Analyst's Notebook Premium does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the...
OracleVM 3.4 : kernel-uek (OVMSA-2021-0022)
The remote OracleVM system is missing necessary patches to address security updates: - Improper access control in BlueZ may allow an unauthenticated user to potentially enable information disclosure via adjacent access. CVE-2020-12352 - An issue was discovered in the Linux kernel before 5.8.1...
SUSE SLES12 Security Update : ovmf (SUSE-SU-2021:2119-1)
The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:2119-1 advisory. - Fixed a possible buffer overflow in IScsiDxe bsc1186151 Tenable has extracted the preceding description block directly from the SUSE...
Photon OS 1.0: Zeromq PHSA-2021-1.0-0403
An update of the zeromq package has been released. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-1.0-0403. The text itself is copyright C VMware, Inc...
CVE-2021-27615
SAP Manufacturing Execution versions - 15.1, 1.5.2, 15.3, 15.4, does not contain some HTTP security headers in their HTTP response. The lack of these headers in response can be exploited by the attacker to execute Cross-Site Scripting XSS attacks...
CVE-2020-26516
A CSRF issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4. Requests sent to the server that trigger actions do not contain a CSRF token and can therefore be entirely predicted allowing attackers to cause the victim's browser to execute undesired actions in the web application...
CVE-2020-4732
IBM Jazz Foundation and IBM Engineering products could allow an authenticated user to obtain sensitive information due to lack of security restrictions. IBM X-Force ID: 188126...
Photon OS 3.0: Python PHSA-2021-3.0-0239
An update of the python package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-3.0-0239. The text itself is copyright C VMware, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...
RHEL 7 : bind (RHSA-2021:1475)
"The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:1475 advisory. The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named %NASLMINLEVEL...
RHEL 7 : bind (RHSA-2021:0693)
"The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:0693 advisory. The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named C Tenable, Inc...
RHEL 8 : subversion:1.10 (RHSA-2021:0507)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:0507 advisory. Subversion SVN is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of fil...
CVE-2018-19418
Foxit PDF ActiveX before 5.5.1 allows remote code execution via command injection because of the lack of a security permission control...
Missing Security UI
firefox is missing security UI. It was possible to cause the browser to enter fullscreen mode without displaying the security UI; thus making it possible to attempt a phishing attack or otherwise confuse the user...
Amazon Linux AMI : curl (ALAS-2020-1444)
The version of curl installed on the remote host is prior to 7.61.1-12.95. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1444 advisory. A flaw was found in libcurl from versions 7.29.0 through 7.71.1. An application that performs multiple requests with libcurl's mul...
EulerOS Virtualization 3.0.6.6 : cups (EulerOS-SA-2020-2464)
According to the version of the cups packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - heap based buffer overflow in libcups's ppdFindOption in ppd-mark.cCVE-2020-3898 Note that Tenable Network Security has extracted the...
Fedora 33 : 2:samba (2020-c1e9ae02d2)
Update to Samba 4.13.1 - Security fixes for CVE-2020-14318, CVE-2020-14323 and CVE-2020-14383 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as...
Photon OS 2.0: Gnutls PHSA-2020-2.0-0288
An update of the gnutls package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-2.0-0288. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid14144...
CVE-2019-4326
"HCL AppScan Enterprise security rules update administration section of the web application console is missing HTTP Strict-Transport-Security Header."...
Information disclosure
IBM Security Guardium 10.5, 10.6, and 11.0 could allow an unauthorized user to obtain sensitive information due to missing security controls. IBM X-Force ID: 141226...
