Qnap QES Use of Hard-coded Credentials (CVE-2020-2499)

A hard-coded password vulnerability has been reported to affect earlier versions of QES. If exploited, this vulnerability could allow attackers to log in with a hard-coded password. QNAP has already fixed the issue in QES 2.1.1 Build 20200515 and later. This plugin only works with Tenable.ot...

Ivanti Avalanche < 6.4.5 Multiple Vulnerabilities

The version of Ivanti Avalanche running on the remote host is prior to 6.4.5. It is, therefore, is affected by multiple vulnerabilities : - A NULL pointer dereference in WLAvalancheService allows a remote unauthenticated attacker to crash the service. CVE-2024-47007 - Server-side request forgery...

SUSE Linux Enterprise Server For SAP SEoL (12.2.x)

According to its version, SUSE Linux Enterprise Server For SAP is 12.2.x. It is, therefore, no longer maintained by its vendor or provider. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it may contain security vulnerabilities...

SUSE SLES15 / openSUSE 15 Security Update : keepalived (SUSE-SU-2024:3633-1)

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2024:3633-1 advisory. - CVE-2024-41184: Fixed integer overflow in vrrpipsetshandler bsc1228123 Tenable has extracted the preceding description block directly fr...

Qnap QTS Out-of-bounds Write (CVE-2023-32972)

A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions:...

SUSE Linux Enterprise Server For SAP SEoL (15.2.x)

According to its version, SUSE Linux Enterprise Server For SAP is 15.2.x. It is, therefore, no longer maintained by its vendor or provider. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it may contain security vulnerabilities...

Qnap Multiple Vulnerabilities in QTS, QuTS hero and QuTScloud (CVE-2023-50358)

Multiple vulnerabilities have been reported to affect several QNAP operating system versions. If exploited, the OS command injection vulnerabilities could allow users to execute commands via a network. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-o...

Qnap QTS Link Following (CVE-2019-7183)

This improper link resolution vulnerability allows remote attackers to access system files. To fix this vulnerability, QNAP recommend updating QTS to their latest versions. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information...

Qnap QTS Path Traversal (CVE-2023-45026)

A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to read the contents of unexpected files and expose sensitive data via a network. We have already fixed the vulnerability in...

Qnap QTS OS Command Injection (CVE-2021-28802)

A command injection vulnerabilities have been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. This issue affects: QNAP Systems Inc. QTS versions prior to 4.5.1.1540 build 20210107. QNAP Systems Inc...

Qnap QTS Injection (CVE-2024-21900)

An injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578 build 20231110 and...

Qnap QTS Cross-site Scripting (CVE-2023-50366)

A cross-site scripting XSS vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to inject malicious code via a network. We have already fixed the vulnerability in the following versions: QTS...

Qnap QTS OS Command Injection (CVE-2023-39300)

An OS command injection vulnerability has been reported to affect legacy QTS. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 4.3.6.2805 build 20240619 and later QTS...

Qnap QTS Incorrect Permission Assignment for Critical Resource (CVE-2024-21902)

An incorrect permission assignment for critical resource vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to read or modify the resource via a network. We have already fixed the vulnerability in the...

Amazon Corretto Java 17.x < 17.0.13.11.1 Multiple Vulnerabilities

The version of Amazon Corretto installed on the remote host is prior to 17 17.0.13.11.1. It is, therefore, affected by multiple vulnerabilities as referenced in the corretto-17-2024-Oct-15 advisory. - core-libs/java.net CVE-2024-21208 - hotspot/compiler CVE-2024-21210, CVE-2024-21235 -...

Qnap QTS OS Command Injection (CVE-2023-23362)

An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability allows remote authenticated users to execute commands via susceptible QNAP devices. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2376 build...

Snowflake Compliance Checks

Binary data snowflakecompliancecheck.nbin...

CBL Mariner 2.0 Security Update: kernel (CVE-2024-44966)

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-44966 advisory. - In the Linux kernel, the following vulnerability has been resolved: binfmtflat: Fix corruption when not...

CBL Mariner 2.0 Security Update: kernel (CVE-2024-46807)

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-46807 advisory. - In the Linux kernel, the following vulnerability has been resolved: drm/amd/amdgpu: Check tbo resource point...

AlmaLinux 9 : firefox (ALSA-2024:7958)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:7958 advisory. firefox: Use-after-free in Animation timeline 128.3.1 ESR Chemspill CVE-2024-9680 Tenable has extracted the preceding description block directly from the AlmaLinux...