60124 matches found
CBL Mariner 2.0 Security Update: kernel (CVE-2024-44988)
The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-44988 advisory. - In the Linux kernel, the following vulnerability has been resolved: net: dsa: mv88e6xxx: Fix out-of-bound...
openSUSE 15 Security Update : chromium (openSUSE-SU-2024:0335-1)
The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2024:0335-1 advisory. - Chromium 129.0.6668.100 boo1231420 CVE-2024-9602: Type Confusion in V8 CVE-2024-9603: Type Confusion in V8 Tenable has extracted the preceding...
Wago CODESYS V3 Products Use of Password Hash With Insufficient Computational Effort (CVE-2020-12069)
In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime system stores the online communication passwords using a weak hashing algorithm. This can be used by a local attacker with low privileges to gain full control of the device. This plugin...
AlmaLinux 8 : firefox (ALSA-2024:7977)
The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2024:7977 advisory. firefox: Use-after-free in Animation timeline 128.3.1 ESR Chemspill CVE-2024-9680 Tenable has extracted the preceding description block directly from the AlmaLinux...
Apache Tapestry Arbitrary File Read
Apache Tapestry versions 5.4.0 5.6.2 and 5.7.0 5.7.1 allows an unauthenticated attacker to access Class files via a specially crafted request. If the value of 'tapestry.hmac-passphrase' is recovered, this vulnerability can be exploited to obtain arbitrary code execution through the value of the...
Amazon Linux 2 : unbound (ALASUNBOUND-2024-003)
The version of unbound installed on the remote host is prior to 1.13.1-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2UNBOUND-2024-003 advisory. NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when handling replies with very large RRsets...
CBL Mariner 2.0 Security Update: kernel (CVE-2024-44965)
The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-44965 advisory. - In the Linux kernel, the following vulnerability has been resolved: x86/mm: Fix pticlonepgtable alignment...
Oracle Linux 9 : skopeo (ELSA-2024-8111)
The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-8111 advisory. - rebuild for CVE-2024-34156 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has not...
Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : nano vulnerability (USN-7064-1)
The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-7064-1 advisory. It was discovered that nano allowed a possible privilege escalation through an insecure temporary file. If nano wa...
WordPress Cookie Scanner plugin <= 1.1 - CSRF to Stored XSS vulnerability
CSRF to Stored XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin Cookie Scanner versions = 1.1...
Amazon Linux 2023 : python3-unbound, unbound, unbound-anchor (ALAS2023-2024-719)
It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-719 advisory. NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when handling replies with very large RRsets that it needs to perform name compression for. Malicious upstreams responses...
Splunk Enterprise 9.1.0 < 9.1.6, 9.2.0 < 9.2.3 (SVD-2024-1004)
The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2024-1004 advisory. - In Splunk Enterprise versions 9.3.0, 9.2.3, and 9.1.6, a low-privileged user that does not hold the admin or power Splunk rol...
Amazon Linux 2023 : python3.11-pip, python3.11-pip-wheel (ALAS2023-2024-729)
It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-729 advisory. urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with ProxyManager, the Proxy-Authorization header is only sent to the configured proxy, as expected. However...
Oracle Linux 9 : OpenIPMI (ELSA-2024-8037)
The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-8037 advisory. - Update the patch for CVE-2024-42934 to add a missing upstream commit from 2.0.36: 663e3cd3 Tenable has extracted the preceding description block directly from...
Splunk Enterprise 9.1.0 < 9.1.6, 9.2.0 < 9.2.3 (SVD-2024-1010)
The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2024-1010 advisory. - In Splunk Enterprise versions below 9.2.3 and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403, a low-privileged user...
Fedora 40 : webkit2gtk4.0 (2024-9694c3eec0)
The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-9694c3eec0 advisory. Update to 2.46.1 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested f...
Amazon Linux 2023 : amazon-ssm-agent (ALAS2023-2024-735)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-735 advisory. An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing...
Amazon Linux 2023 : python3-pip, python3-pip-wheel (ALAS2023-2024-730)
It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-730 advisory. urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with ProxyManager, the Proxy-Authorization header is only sent to the configured proxy, as expected. However...
WordPress Cookie Scanner Plugin <= 1.1 is vulnerable to Cross Site Request Forgery (CSRF)
Software Cookie Scanner Type Plugin Vulnerable versions = 1.1 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-49220 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 18da6e2fb5aa Credits SOPROBRO Required...