AlmaLinux 9 : glibc (ALSA-2024:3339)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:3339 advisory. glibc: Out of bounds write in iconv conversion to ISO-2022-CN-EXT CVE-2024-2961 glibc: stack-based buffer overflow in netgroup cache CVE-2024-33599 glibc:...

Amazon Linux 2023 : bcc, bcc-devel, bcc-tools (ALAS2023-2024-626)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-626 advisory. If kernel headers need to be extracted, bcc will attempt to load them from a temporary directory. An unprivileged attacker could use this to force bcc to load compromised linux headers. Linux...

Amazon Linux 2023 : less (ALAS2023-2024-622)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-622 advisory. less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. Exploitation typically requires use with attacker-controlled file...

Mitel MiVoice Connect Server Installed (Windows)

Binary data mitelmivoiceconnectwininstalled.nbin...

Oracle Linux 8 : motif (ELSA-2024-3022)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-3022 advisory. - Fix CVE-2023-43788: out of bounds read in XpmCreateXpmImageFromBuffer Tenable has extracted the preceding description block directly from the Oracle...

Oracle Linux 8 : python3.11 (ELSA-2024-3062)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-3062 advisory. 3.11.7-1.0.1 - Update rpm-macros description Orabug: 36024572 3.11.7-1 - Rebase to 3.11.7 Resolves: RHEL-21915 3.11.5-2 - Security fix for CVE-2023-27043...

Oracle Linux 8 : squashfs-tools (ELSA-2024-3139)

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2024-3139 advisory. 4.3-21 - CVE-2021-41072 squashfs-tools: additional write outside destination directory exploit fix CVE-2021-40153 squashfs-tools: unvalidated filepaths...

AlmaLinux 9 : tomcat (ALSA-2024:3307)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:3307 advisory. Apache Tomcat: HTTP/2 header handling DoS CVE-2024-24549 Apache Tomcat: WebSocket DoS with incomplete closing handshake CVE-2024-23672 Bug Fixes and...

Oracle Linux 8 : libtiff (ELSA-2024-3059)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-3059 advisory. - Fix CVE-2022-3599 CVE-2022-4645 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has n...

Amazon Linux 2023 : cni-plugins (ALAS2023-2024-630)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-630 advisory. An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADE...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Flask-Security vulnerability (USN-6792-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-6792-1 advisory. Naom Moshe discovered that Flask-Security incorrectly validated URLs. An attacker could use this issue to redirect users to arbitrary URLs...

Amazon Linux 2023 : oci-add-hooks (ALAS2023-2024-632)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-632 advisory. A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP clie...

RHEL 9 : mod_http2 (RHSA-2024:3402)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:3402 advisory. The modh2 Apache httpd module implements the HTTP2 protocol h2+h2c on top of libnghttp2 for httpd 2.4 servers. Security Fixes: httpd: CONTINUATION...

Oracle Linux 8 : exempi (ELSA-2024-3066)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-3066 advisory. - Fix CVE-2020-18652 - Fix CVE-2020-18651 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note...

Amazon Linux 2023 : amazon-ecr-credential-helper (ALAS2023-2024-631)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-631 advisory. A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP clie...

Nexus Repository 3.x < 3.68.1 Path Traversal

Nexus Repository version 3.x prior to 3.68.1 is affected by a Path Traversal allowing an attacker to create a URL returning any file for download, including system files outside the scope of the Nexus Repository application, without any authentication. No source data...

Atlassian Confluence 5.5 < 7.19.22 / 7.20.x < 8.5.9 / 8.6.x < 8.9.0 MPC (CONFSERVER-95839)

The version of Atlassian Confluence Server running on the remote host is affected by a missing permission check vulnerability as referenced in the CONFSERVER-95839 advisory. - In Hazelcast through 4.1.10, 4.2 through 4.2.8, 5.0 through 5.0.5, 5.1 through 5.1.7, 5.2 through 5.2.4, and 5.3 through...

MantisBT < 2.26.2 Multiple Vulnerabilities

According to its version number, the MantisBT application hosted on the remote web server is prior to 2.26.2. It is, therefore, affected by the following vulnerabilities : - Insufficient access control in the registration and password reset process allows an attacker to reset another user's...

Atlassian Jira Service Management Data Center and Server < 5.4.20 / 5.5.x < 5.12.7 / 5.13.x < 5.15.2 Broken Access Control (JSDSERVER-15307)

The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-15307 advisory. - In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to...

Atlassian Confluence 2.6.0 < 7.19.22 / 7.20.x < 8.5.9 / 8.6.x < 8.9.1 DoS (CONFSERVER-95834)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-95834 advisory. - Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the...