Photon OS 2.0: Linux PHSA-2021-2.0-0363

An update of the linux package has been released. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-2.0-0363. The text itself is copyright C VMware, Inc...

Photon OS 4.0: Linux PHSA-2021-4.0-0052

An update of the linux package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-4.0-0052. The text itself is copyright C VMware, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if descripti...

FreeBSD : gitea -- multiple vulnerabilities (0e561c06-d13a-11eb-92be-0800273f11ea)

The Gitea Team reports for release 1.14.3 : - Encrypt migration credentials at rest 15895 16187 - Only check access tokens if they are likely to be tokens 16164 16171 - Add missing SameSite settings for the ilikegitea cookie 16037 16039 - Fix setting of SameSite on cookies 15989 15991 %NASLMINLEV...

Amazon Linux 2 : systemd, --advisory ALAS2-2021-1647 (ALAS-2021-1647)

The version of systemd installed on the remote host is prior to 219-78. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1647 advisory. It was discovered that systemd is vulnerable to a state injection attack when deserializing the state of a service...

ArubaOS-Switch Multiple Vulnerabilities (ARUBA-PSA-2020-007)

The version of ArubaOS-Switch installed on the remote host is 16.08. prior to version 16.08.0009, 16.09. prior to 16.09.0007 or 16.10. prior to 16.10.0003. It is, therefore, affected by multiple vulnerabilities, as follows: - A vulnerability in the Web Management Interface allows an attacker to...

Amazon Linux 2 : glib2 (ALAS-2021-1655)

The version of glib2 installed on the remote host is prior to 2.56.1-9. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1655 advisory. An issue was discovered in GNOME GLib before 2.66.6 and 2.67.x before 2.67.3. The function gbytesnew has an integer overflow on 64-b...

Ubuntu 16.04 ESM : OpenEXR vulnerabilities (USN-4996-2)

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4996-2 advisory. USN-4996-1 fixed several vulnerabilities in OpenEXR. This update provides the corresponding update for Ubuntu 16.04 ESM. Tenable has extracted the...

Apache Tomcat 10.0.0.M1 < 10.0.0.M6

The version of Tomcat installed on the remote host is prior to 10.0.0.M6. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat10.0.0-m6security-10 advisory. - A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 t...

Photon OS 4.0: Go PHSA-2021-4.0-0046

An update of the go package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-4.0-0046. The text itself is copyright C VMware, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

Solaris SunSSH 11.0 x86 - libpam Remote Root (3)

Exploit Title: Solaris SunSSH 11.0 x86 - libpam Remote Root 3 Exploit Author: Nathaniel Singer, Joe Rozner Date: 09/11/2020 CVE: 2020-14871 Vulnerable Versions: Oracle Solaris: 9 some releases, 10 all releases, 11.0 Description: CVE-2020-14871 is a critical pre-authentication via SSH stack-based...

Photon OS 1.0: Zeromq PHSA-2021-1.0-0403

An update of the zeromq package has been released. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-1.0-0403. The text itself is copyright C VMware, Inc...

SUSE SLED15 / SLES15 Security Update : python-urllib3 (SUSE-SU-2021:2012-1)

The remote SUSE Linux SLED15 / SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2021:2012-1 advisory. - CVE-2021-33503: Fixed a denial of service when the URL contained many @ characters in the authority component bsc1187045 Tenable has extracte...

McAfee Agent 5.x prior to 5.7.3 Multiple Vulnerabilities (SB10362)

The version of McAfee Agent, formerly McAfee ePolicy Orchestrator ePO Agent, installed on the remote host is 5.x prior to 5.7.3. It is, therefore, affected by the following vulnerabilities: - An improper privilege management vulnerability exists due to a local user having the ability to edit the...

FCKeditor End of Life (EOL) Detection

The remote host is using the FCKeditor which is discontinued and will not receive any security updates. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

ArubaOS-Switch Memory Corruption Vulnerability (ARUBA-PSA-2021-003)

According to its self-reported version number the remote host is affected by a memory corruption vulnerability. An unauthenticated, remote host can exploit this to disclose sensitive information / memory contents or execute arbitrary code. Note that Nessus has not tested for these issues but has...

SUSE SLES11 Security Update : bind (SUSE-SU-2021:14714-1)

The remote SUSE Linux SLES11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:14714-1 advisory. - In BIND 9.8.5 - 9.8.8, 9.9.3 - 9.11.29, 9.12.0 - 9.16.13, and versions BIND 9.9.3-S1 - 9.11.29-S1 and 9.16.8-S1 - 9.16.13-S1 of BIND 9...

SUSE SLES11 Security Update : libvirt and libvirt-python (SUSE-SU-2019:14146-1)

The remote SUSE Linux SLES11 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2019:14146-1 advisory. - libvirt-domain.c in libvirt before 1.3.1 supports virDomainGetTime API calls by guest agents with an RO connection, even though an RW connection was...

Scientific Linux Security Update : libwebp on SL7.x i686/x86_64 (2021:2260)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2021:2260-1 advisory. - libwebp: heap-based buffer overflow in PutLE16 CVE-2018-25011 - libwebp: heap-based buffer overflow in WebPDecodeInto functions CVE-2020-36328 ...

SUSE SLED15: libxml2-2 / libxml2-2-32bit / libxml2-devel / libxml2-tools / etc (SUSE-SU-2021:1917-1)

The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:1917-1 advisory. - CVE-2021-3541: Fixed exponential entity expansion attack bypasses all existing protection mechanisms. bsc1186015 Tenable has extracted the...

SUSE SLED15: libmodplug-devel / libmodplug1 / libopenmpt-devel / libopenmpt0 / etc (SUSE-SU-2021:1914-1)

The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:1914-1 advisory. Various bugfix and stability issues were fixed, some of those might have security impact. libopenmpt was updated to 0.3.28: Fixed excessive...