GHSA-8GWJ-68W6-7V6C OroCommerce Customer Portal Incorrect Customer and Customer Group Frontend Menus pages visibility

Back-office users can access information about Customer and Customer User menus, bypassing ACL security restrictions due to insufficient security checks...

OroCRMCallBundle has incorrect call view page visibility

Back-office users can access information from any call event, bypassing ACL security restrictions due to insufficient security checks...

OroCalendarBundle has incorrect system calendar events visibility

OroPlatform is a package that assist system and user calendar management. Back-office users can access information from any system calendar event, bypassing ACL security restrictions due to insufficient security checks...

CVE-2023-32062 OroCalendarBundle has incorrect system calendar events visibility

OroPlatform is a package that assists system and user calendar management. Back-office users can access information from any system calendar event, bypassing ACL security restrictions due to insufficient security checks. This vulnerability has been patched in version 5.1.1...

Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 : GnuTLS vulnerability (USN-6499-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 host has packages installed that are affected by a vulnerability as referenced in the USN-6499-1 advisory. It was discovered that GnuTLS had a timing side-channel when handling certain RSA-PSK key exchanges. A remote attacker could possibly...

Fedora 38 : tor (2023-29cafcbf4a)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-29cafcbf4a advisory. update to latest upstream release https://forum.torproject.org/t/security-release-0-4-8-9/10155 Tenable has extracted the preceding description block directl...

Remote Code Execution (RCE)

vantage6node is vulnerable to Remote Code Execution RCE. The system fails to validate the execution of a child task if it has a specified parent task ID which could be exploited by an attacker who gains unauthorized access to the system. By setting a fake parent task ID for a malicious task, the...

Fedora 39 : python3.11 (2023-4953fc03b9)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-4953fc03b9 advisory. Update to 3.11.5 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

Rocky Linux 8 : openssl (RLSA-2021:1024)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:1024 advisory. - An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello...

F5 Networks BIG-IP : SNMPv2 vulnerability (K04463175)

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K04463175 advisory. - An SNMP community name is the default e.g. public, null, or missing. CVE-1999-0517 Note that Nessus has not tested fo...

The vulnerability of Google Chrome’s Payments component allows a hacker to bypass security restrictions and gain unauthorized access to protected information.

The vulnerability of Google Chrome’s Payments component is related to improperly implemented security checks for standard elements. Exploiting this vulnerability can allow an attacker to bypass security restrictions and gain unauthorized access to protected information...

The vulnerability of the WebApp Provider component of Google Chrome allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Google Chrome browser’s WebApp Provider component is related to improperly implemented security checks for standard elements. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information through a specially...

The vulnerability of the Downloads component of the Google Chrome browser allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Downloads component of the Google Chrome browser is related to improperly implemented security checks for standard elements. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information through a specially...

The vulnerability of the Downloads component of the Google Chrome browser allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Downloads component of the Google Chrome browser is related to improperly implemented security checks for standard elements. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information through a specially...

Fedora: Security Advisory for folly (FEDORA-2023-17efd3f2cd)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2023:4127-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of Google Chrome’s Intents function allows attackers to circumvent existing access restrictions.

The vulnerability of Google Chrome’s Intents function is related to improper security checks for standard elements. Exploiting this vulnerability could allow a malicious actor to circumvent existing access restrictions remotely...

The vulnerability of the Extensions API of Microsoft Edge and Google Chrome browsers allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Extensions API for Microsoft Edge and Google Chrome relates to improper security checks for standard elements. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information through a specially created HTML pa...

The vulnerability of the Downloads component of the Google Chrome browser, which allows a hacker to perform a spoofing attack

The vulnerability of the Downloads component of the Google Chrome browser is related to improperly implemented security checks for standard elements. Exploiting this vulnerability allows a remote attacker to perform spear-phishing attacks...

The vulnerability of the full-screen mode implementation in Google Chrome allows a perpetrator to influence the integrity of the protected information.

The vulnerability of the full-screen browser mode implementation in Google Chrome is related to improperly implemented security checks for standard elements. Exploiting this vulnerability allows a malicious actor to influence the integrity of protected information by installing a malicious...