Ubuntu 18.04 ESM / 20.04 ESM / 22.04 ESM : Rack vulnerabilities (USN-5896-1)

The remote Ubuntu 18.04 ESM / 20.04 ESM / 22.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5896-1 advisory. It was discovered that Rack was not properly parsing data when processing multipart POST requests. If a user or automated system...

Fedora 36 : haproxy (2023-7e04833463)

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-7e04833463 advisory. Security fix for CVE-2023-0056, CVE-2023-25725 Tenable has extracted the preceding description block directly from the Fedora security advisory. Not...

Moodle 4.0.x < 4.0.2 Multiple Vulnerabilities

The version of Moodle installed on the remote host is 3.9.x prior to 3.9.15, 3.11.x prior to 3.11.8 or 4.0.x prior to 4.0.2. It is, therefore, affected by multiple vulnerabilities: - A code injection through an omitted execution parameter elading to Remote Code Execution RCE for sites running...

Moodle 3.11.x < 3.11.11 Multiple Vulnerabilities

The version of Moodle installed on the remote host is 3.9.x prior to 3.9.18, 3.11.x prior to 3.11.11 or 4.0.x prior to 4.0.5. It is, therefore, affected by multiple vulnerabilities: - An information disclosure due to a user CSRF token being unnecessarily included in the URL during the redirection...

Ubuntu 16.04 ESM : Vim vulnerabilities (USN-5836-1)

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5836-1 advisory. It was discovered that Vim was not properly performing memory management operations. An attacker could possibly use this issue to cause a denial of servi...

Siemens SCALANCE X-200 and X-200IRT Families Improper Neutralization of Input During Web Page Generation (CVE-2022-40631)

A vulnerability has been identified in SCALANCE X200-4P IRT All versions V5.5.0, SCALANCE X201-3P IRT All versions V5.5.0, SCALANCE X201-3P IRT PRO All versions V5.5.0, SCALANCE X202-2IRT All versions V5.5.0, SCALANCE X202-2P IRT All versions V5.5.0, SCALANCE X202-2P IRT PRO All versions V5.5.0,...

Siemens Desigo PXC and DXR Devices Failure to Sanitize Special Elements Into a Different Plane (CVE-2022-24039)

A vulnerability has been identified in Desigo PXC4 All versions V02.20.142.10-10884, Desigo PXC5 All versions V02.20.142.10-10884. The addCell JavaScript function fails to properly sanitize user-controllable input before including it into the generated XML body of the XLS report document, such th...

RHEL 8 : java-1.8.0-openjdk (RHSA-2023:0207)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0207 advisory. The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security...

RHEL 7 : rh-postgresql12-postgresql (RHSA-2020:5317)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5317 advisory. PostgreSQL is an advanced object-relational database management system DBMS. The following packages have been upgraded to a later upstream...

Mozilla Firefox < 109.0

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 109.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2023-01 advisory. - Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 108. Some of...

Kibana 8.0.0 Insufficient Authorization

According to its self-reported version number, the Kibana application running on the remote host is 7.7.0 prior to 7.17.1 or 8.0.0. It is, therefore, affected by : - A missing authorization issue in which users with read access to the Uptime feature could modify alerting rules CVE-2022-23709 Note...

Oracle Linux 7 / 8 : Unbreakable Enterprise kernel (ELSA-2023-12008)

The remote Oracle Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-12008 advisory. - proc: procskipspaces shouldn't think it is working on C strings Linus Torvalds Orabug: 34882779 CVE-2022-4378 - proc: avoid integer type confusi...

WordPress < 5.8.0 Plugin Confusion

According to its self-reported version number, the detected WordPress application is affected by a remote code execution via a supply-chain attack. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No source data...

WP EasyCart Plugin for WordPress < 3.0.9 Unrestricted File Upload

The WordPress WP EasyCart Plugin installed on the remote host is affected by an Unrestricted File Upload. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No source data...

WP Statistics Plugin for WordPress < 12.0.2 Cross-site Scripting

The WordPress WP Statistics Plugin installed on the remote host is affected by a Cross-site Scripting. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No source data...

WP Maintenance Plugin for WordPress < 6.0.6 Stored Cross-Site Scripting

The WordPress WP Maintenance Plugin installed on the remote host is affected by a Stored Cross-Site Scripting. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No source data...

Fedora 36 : device-mapper-multipath (2022-6ec78b2586)

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-6ec78b2586 advisory. Security fix for CVE-2022-41973 and CVE-2022-41974 Tenable has extracted the preceding description block directly from the Fedora security advisory...

NewStart CGSL CORE 5.04 / MAIN 5.04 : python Multiple Vulnerabilities (NS-SA-2022-0102)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has python packages installed that are affected by multiple vulnerabilities: - http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker...

CentOS 7 : thunderbird (RHSA-2022:8555)

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:8555 advisory. - Service Workers should not be able to infer information about opaque cross-origin responses; but timing information for cross-origin media combined...

CentOS 7 : firefox (RHSA-2022:8552)

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:8552 advisory. - Service Workers should not be able to infer information about opaque cross-origin responses; but timing information for cross-origin media combined...