Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.5.5)

The version of AOS installed on the remote host is prior to 6.5.5. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-6.5.5 advisory. - Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through...

Siemens SCALANCE OpenSSL NULL Pointer Dereference (CVE-2023-0401)

A NULL pointer can be dereferenced when signatures are being verified on PKCS7 signed or signedAndEnveloped data. In case the hash algorithm used for the signature is known to the OpenSSL library but the implementation of the hash algorithm is not available the digest initialization will fail...

CentOS 7 : kernel-rt (RHSA-2023:7424)

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7424 advisory. - Information exposure through microarchitectural state after transient execution in certain vector execution units for some IntelR Processors may allo...

Amazon Linux 2 : libsndfile (ALAS-2024-2404)

The version of libsndfile installed on the remote host is prior to 1.0.25-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2404 advisory. Multiple signed integers overflow in function aureadheader in src/au.c and in functions mat4open and mat4readheader in...

The DES/3DES cipher was used as part of the TLS protocol by installation tools

Impact What kind of vulnerability is it? Who is impacted? The Karmada components deployed with karmadactl, karma-operator, and helm chart take Golang default cipher suites as part of the TLS protocol, which includes the insecure algorithm. Referring to...

Wireshark 3.6.x < 3.6.20 Multiple Vulnerabilities (macOS)

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 3.6.20. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-3.6.20 advisory. - GVCP dissector crash in Wireshark 4.2.0, 4.0.0 to 4.0.11, and 3.6.0 to 3.6.19 allows denial of servic...

RHEL 8 : tigervnc (RHSA-2024:0017)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0017 advisory. Virtual Network Computing VNC is a remote display system which allows users to view a computing desktop environment not only on the machine...

Fedora 39 : vim (2023-3fbd936b15)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-3fbd936b15 advisory. The newest upstream commit Security fixes for CVE-2023-48706, CVE-2023-46246 Tenable has extracted the preceding description block directly from the...

Amazon Linux 2023 : memcached, memcached-devel, memcached-selinux (ALAS2023-2023-449)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-449 advisory. In Memcached before 1.6.22, a buffer overflow exists when processing multiget requests in proxy mode, if there are many spaces after the get substring. CVE-2023-46852 In Memcached before 1.6.22...

Arcserve UDP Console Detection

Binary data arcserveudpconsoledetect.nbin...

Jenkins plugins Multiple Vulnerabilities (2023-11-29)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - Medium Jira Plugin 3.11 and earlier does not set the appropriate context for credentials lookup, allowing the use of system-scoped...

Fedora 37 : microcode_ctl (2023-40e71fe5b9)

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-40e71fe5b9 advisory. - Update to upstream 2.1-42. 20231114 - Update of 06-6a-06/0x87 ICX-SP D0 microcode from revision 0xd0003a5 up to 0xd0003b9; - Update of 06-6c-01/0x10 ICL-D ...

ArubaOS 10.3.x < 10.4.0.3 / 10.5.x.x < 10.5.0.1 Multiple Vulnerabilities (ARUBA-PSA-2023-017)

The version of ArubaOS installed on the remote host is affected by multiple vulnerabilities: - Multiple Denial of Service DoS vulnerabilities exists in a service accessed via the PAPI protocol provided by Aruba InstantOS and ArubaOS 10. Successful exploitation of this vulnerability results in the...

Rockwell Automation Stratix NTP Authentication bypass (CVE-2015-1798)

A vulnerability in the message authentication code MAC validation routine of ntpd could allow an unauthenticated, remote attacker to bypass the NTP authentication feature. The vulnerability is due to incorrect validation of the MAC field. An attacker could exploit this vulnerability by sending...

RHEL 8 : qt5-qtbase (RHSA-2023:6967)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6967 advisory. Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt...

NewStart CGSL MAIN 6.06 : curl Multiple Vulnerabilities (NS-SA-2023-0137)

The remote NewStart CGSL host, running version MAIN 6.06, has curl packages installed that are affected by multiple vulnerabilities: - When curl is used to retrieve and parse cookies from a HTTPS server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might mak...

Rocky Linux 8 : httpd:2.4 (RLSA-2022:7647)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:7647 advisory. - A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP Serve...

Rocky Linux 8 : nodejs:12 (RLSA-2020:2852)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2020:2852 advisory. - In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a...

OpenSSL 3.1.0 < 3.1.5 Multiple Vulnerabilities

The version of OpenSSL installed on the remote host is prior to 3.1.5. It is, therefore, affected by multiple vulnerabilities as referenced in the 3.1.5 advisory. - Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service...

Atlassian Confluence 8.5.x < 8.5.3 Improper Authorization

According to its self-reported version number, the Atlassian Confluence application running on the remote host is 7.x prior 7.19.6, 8.x prior to 8.3.4, 8.4.x prior to 8.4.4, 8.5.x prior to 8.5.3 or 8.6.x prior to 8.6.1. It is, therefore, affected by an improper authorization vulnerability. Note...