Flowise < 2.0.6 Authentication Bypass

Flowise versions prior to 2.0.6 are vulnerable to an authentication bypass allowing a remote and unauthenticated attacker to perform administrative actions through the REST API. No source data...

Nginx 1.27.0 Buffer Over-read

According to its Server response header, the installed version of nginx is 1.5.13 to 1.26.2 or 1.27.0. It is, therefore, affected by a security issue was identified in the ngxhttpmp4module, which might allow an attacker to cause a worker process crash by using a specially crafted mp4 file...

Cisco Identity Services Engine Command Injection (cisco-sa-ise-injection-6kn9tSxm)

According to its self-reported version, Cisco Identity Services Engine Command Injection is affected by a vulnerability. - A vulnerability in specific CLI commands in Cisco Identity Services Engine ISE could allow an authenticated, local attacker to perform command injection attacks on the...

Jupyter Notebook Python Library 7.0.0 < 7.2.2 (CVE-2024-43805)

Jupyter Notebook is an extensible environment for interactive and reproducible computing. This vulnerability depends on user interaction by opening a malicious notebook with Markdown cells, or Markdown file using JupyterLab preview feature. A malicious user can access any data that the attacked...

ABB Freelance AC 900F and AC 700F Numeric Range Comparison Without Minimum Check (CVE-2023-0425)

ABB is aware of vulnerabilities in the product versions listed below. An update is available that resolves the reported vulnerabilities in the product versions under maintenance. An attacker who successfully exploited one or more of these vulnerabilities could cause the product to stop or make th...

IBM MQ 9.1 < 9.1.0.23 LTS / 9.2 < 9.2.0.27 LTS / 9.3 < 9.3.0.21 LTS / 9.3 < 9.4 CD / 9.4 < 9.4.0.5 LTS (7167208)

The version of IBM MQ Server running on the remote host is affected by a vulnerability as referenced in the 7167208 advisory. - IBM MQ could allow an authenticated user in a specifically defined role, to bypass security restrictions and execute actions against the queue manager. CVE-2024-40681 No...

F5 Networks BIG-IP : libarchive vulnerability (K000140963)

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K000140963 advisory. An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access contro...

Wordfence Intelligence Weekly WordPress Vulnerability Report (August 26, 2024 to September 1, 2024)

Did you know Wordfence runs a Bug Bounty Program for all WordPress plugin and themes at no cost to vendors? Through October 7th, 2024, XSS vulnerabilities in all plugins and themes with =1,000 Active Installs are in scope for all researchers. In addition, through October 14th, 2024, researchers c...

OpenTelemetry Collector < 0.108.0 Authentication Bypass

The OpenTelemetry Collector running on the remote host is prior to 0.108.0. It is, therefore, affected by a timing discrepancy vulnerability, outlined below: OpenTelemetry Collector module awsfirehosereceiver allows unauthenticated remote requests, even when configured to require a key...

Kingsoft WPS Office Installed (Windows)

Binary data kingsoftwpsofficewininstalled.nbin...

FileZilla < 3.67.0 Insecure Key Recovery Vulnerability (CVE-2024-31497)

The FileZilla application installed on the remote host is prior to 3.67.0. It is, therefore, affected by a key recovery vulnerability where biased ECDSA nonce generation allows an attacker to recover a user's NIST P-521 secret key via a quick attack in approximately 60 signatures. Note that Nessu...

Oracle Linux 9 : bubblewrap / and / flatpak (ELSA-2024-6356)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-6356 advisory. - Add support for --bind-fd and --ro-bind-fd CVE-2024-42472 flatpak - Backport upstream patches for CVE-2024-42472 Tenable has extracted the preceding descripti...

Photon OS 4.0: Expat PHSA-2024-4.0-0682

An update of the expat package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-4.0-0682. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Rejetto HTTP File Server 2.x <= 2.3m RCE (CVE-2024-23692)

The version of Rejetto HTTP File Server installed on the remote host is 2.x up to 2.3m. It is, therefore, affected by a vulnerability: - Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote,...

Photon OS 4.0: Curl PHSA-2024-4.0-0682

An update of the curl package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-4.0-0682. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Expat PHSA-2024-5.0-0364

An update of the expat package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-5.0-0364. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Progress WS_FTP Server < 8.8.8 Multiple Vulnerabilities

The remote host is running a version of WSFTP earlier than 8.8.8. It is, therefore, affected by multiple vulnerabilities: - In WSFTP Server versions before 8.8.8 2022.0.8, a Missing Critical Step in Multi-Factor Authentication of the Web Transfer Module allows users to skip the second-factor...

AlmaLinux 8 : resource-agents (ALSA-2024:6311)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:6311 advisory. urllib3: proxy-authorization request header is not stripped during cross-origin redirects CVE-2024-37891 pypa/setuptools: Remote code execution via downlo...

Ubuntu 20.04 LTS : Firefox vulnerabilities (USN-6992-1)

The remote Ubuntu 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6992-1 advisory. Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially explo...

Vim < 9.1.0707 Buffer Overflow Vulnerability

According to its version, the version of Vim installed on the remote host is prior to 9.1.0707. It is, therefore affected by a buffer overflow vulnerability. Patch v9.1.0038 optimized how the cursor position is calculated and in doing so introduced the possibility for heap-buffer-overflow when...