PHP 7.0.x < 7.0.10 Multiple Vulnerabilities

According to its banner, the version of PHP running on the remote web server is 7.0.x prior to 7.0.10. It is, therefore, affected by multiple vulnerabilities : - An overflow condition exists in the curlescape function in interface.c due to improper handling of overly long strings. An...

CVE-2018-14939

The getapppath function in desktop/unx/source/start.c in LibreOffice through 6.0.5 mishandles the realpath function in certain environments such as FreeBSD libc, which might allow attackers to cause a denial of service buffer overflow and application crash or possibly have unspecified other impac...

CVE-2018-14939

The getapppath function in desktop/unx/source/start.c in LibreOffice through 6.0.5 mishandles the realpath function in certain environments such as FreeBSD libc, which might allow attackers to cause a denial of service buffer overflow and application crash or possibly have unspecified other impac...

CVE-2018-14939

The getapppath function in desktop/unx/source/start.c in LibreOffice through 6.0.5 mishandles the realpath function in certain environments such as FreeBSD libc, which might allow attackers to cause a denial of service buffer overflow and application crash or possibly have unspecified other impac...

Buffer overflow

The getapppath function in desktop/unx/source/start.c in LibreOffice through 6.0.5 mishandles the realpath function in certain environments such as FreeBSD libc, which might allow attackers to cause a denial of service buffer overflow and application crash or possibly have unspecified other impac...

CVE-2018-14939

The getapppath function in desktop/unx/source/start.c in LibreOffice through 6.0.5 mishandles the realpath function in certain environments such as FreeBSD libc, which might allow attackers to cause a denial of service buffer overflow and application crash or possibly have unspecified other impac...

CVE-2018-14939

The getapppath function in desktop/unx/source/start.c in LibreOffice through 6.0.5 mishandles the realpath function in certain environments such as FreeBSD libc, which might allow attackers to cause a denial of service buffer overflow and application crash or possibly have unspecified other impac...

Atlassian Universal Plugin Manager Cross-Site Scripting Vulnerability

Atlassian Universal Plugin Manager is a set of tools from Atlassian Australia for managing add-ons in Atlassian applications. A cross-site scripting vulnerability exists in the NotificationRepresentationFactoryImpl class in Atlassian Universal Plugin Manager versions prior to 2.22.9. A remote...

Webmin < 0.5 Brute Force Vulnerability

According to its self-reported version, the Webmin install hosted on the remote host is prior to version 0.5. It is, therefore, affected by an issue which would allow attackers to more easily brute force a password C Tenable Network Security, Inc. include'compat.inc'; if description scriptid10853...

Authentication flaw

SafeNet Authentication Service Remote Web Workplace Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module...

CVE-2015-7961

SafeNet Authentication Service Remote Web Workplace Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module...

CVE-2015-7961

Technical details about CVE-2015-7961 are not provided in the connected documents; the Initial Description mentions privilege escalation from weak ACLs but provides no product/version specifics. Monitor for updates.

Jenkins < 2.89.4 / 2.107 Multiple Vulnerabilities

The version of Jenkins running on the remote web server is prior to 2.107 or is a version of Jenkins LTS prior to 2.89.4. It is, therefore, affected by multiple vulnerabilities. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version...

Joomla! 1.5.0 < 3.8.4 Multiple Vulnerabilities

According to its self-reported version number, the Joomla! installation running on the remote web server is 1.5.0 or later but prior to 3.8.4. It is, therefore, affected by multiple XSS and SQLi vulnerabilities : - The XSS vulnerability in module chromes as noted in the 20180101 announcement...

Oracle Fusion Middleware Oracle HTTP Server Multiple Vulnerabilities (January 2018 CPU)

The version of Oracle HTTP Server installed on the remote host is affected by multiple vulnerabilities as noted in the January 2018 CPU advisory. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid106299;...

PHP 5.6.x < 5.6.33 Multiple Vulnerabilities

According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.33. It is, therefore, affected by multiple vulnerabilities : - A potential infinite loop in gdImageCreateFromGifCtx. CVE-2018-5711 - A reflected XSS in .phar 404 page exists due to improper validati...

Apache Solr 5.x < 5.5.5 / 6.x < 6.6.2 / 7.x < 7.1.0 Multiple Vulnerabilities

The version of Apache Solr running on the remote web server is affected by multiple vulnerabilities as referenced in the advisory. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid104353; scriptversion"1.8"; scriptsetattributeattribute:"pluginmodificationdate",...

SSL/TLS: HTTP Public Key Pinning (HPKP) Missing

The remote web server is not enforcing HTTP Public Key Pinning HPKP. Note: Most major browsers have dropped / deprecated support for this header in 2020. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

Grandstream Phone Web Interface Default Credentials

The remote device appears to be a Grandstream phone which contains a web interface with default credentials enabled. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid103514; scriptversion"$Revision: 1.1 $"; scriptcvsdate"$Date: 2017/09/27 21:37:02 $";...

xmlsec1: xmlsec vulnerable to external entity expansion

It was discovered xmlsec1's use of libxml2 inadvertently enabled external entity expansion XXE along with validation. An attacker could craft an XML file that would cause xmlsec1 to try and read local files or HTTP/FTP URLs, leading to information disclosure or denial of service...