CentOS 8 : nodejs:14 (CESA-2022:0350)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2022:0350 advisory. - nodejs-glob-parent: Regular expression denial of service CVE-2020-28469 - nodejs-ini: Prototype pollution via malicious INI file CVE-2020-7788 -...

Drupal 7.x < 7.86 / 9.2.x < 9.2.11 / 9.3.x < 9.3.3 Multiple Vulnerabilities (drupal-2022-01-19)

According to its self-reported version, the instance of Drupal running on the remote web server is 7.x prior to 7.86, 9.2.x prior to 9.2.11, or 9.3.x prior to 9.3.3. It is, therefore, affected by multiple vulnerabilities. - Cross-site scripting XSS vulnerability in jquery.ui.dialog.js in the Dial...

Adobe ColdFusion 11 < 11 Update 15 / 2016 < 2016 Update 7 / 2018 < 2018 Update 1 Arbitrary File Upload

The version of Adobe ColdFusion running on the remote host is affected by an arbitrary file upload vulnerability. An unauthenticated attacker could leverage this vulnerability to gain access to the host in the context of the web application user. No source data...

Microsoft SharePoint Server 2019 < 16.0.10379.20000 Multiple Vulnerabilities

According to its self-reported version number, the Microsoft SharePoint application running on the remote host is affected by multiple vulnerabilities. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No source da...

Microsoft SharePoint Server 2019 < 16.0.10377.20001 Multiple Vulnerabilities

According to its self-reported version number, the Microsoft SharePoint application running on the remote host is affected by multiple vulnerabilities. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No source da...

Microsoft SharePoint Server 2013 < 15.0.5371.1000 Multiple Vulnerabilities

According to its self-reported version number, the Microsoft SharePoint application running on the remote host is affected by multiple vulnerabilities. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No source da...

Microsoft SharePoint Server 2016 < 16.0.5200.1000 Multiple Vulnerabilities

According to its self-reported version number, the Microsoft SharePoint application running on the remote host is affected by multiple vulnerabilities. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No source da...

Microsoft SharePoint Server 2016 < 16.0.5227.1000 Multiple Vulnerabilities

According to its self-reported version number, the Microsoft SharePoint application running on the remote host is affected by multiple vulnerabilities. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No source da...

Wireshark 3.4.x < 3.4.11 Multiple Vulnerabilities

The version of Wireshark installed on the remote Windows host is prior to 3.4.11. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-3.4.11 advisory. - Crash in the Gryphon dissector in Wireshark 3.4.0 to 3.4.10 allows denial of service via packet injection or...

Adobe ColdFusion Server Administration Console Detected

Adobe ColdFusion server administration console has been detected on the target web application. This may present an attacker with an exploit vector which could be leveraged using other techniques, such as a Brute-Force or Dictionary Attack, allowing an attacker to gain access to administrative...

WordPress 5.4.x < 5.4.8 Expired DST Root CA X3 Certificate

According to its self-reported version number, the detected WordPress application is affected by an expired certificate. The wordpress/wp-includes/certificates/ca-bundle.crt file still contains the DST Root CA X3 expired certificate. Note that the scanner has not tested for these issues but has...

WordPress 5.8.x < 5.8.2 Expired DST Root CA X3 Certificate

According to its self-reported version number, the detected WordPress application is affected by an expired certificate. The wordpress/wp-includes/certificates/ca-bundle.crt file still contains the DST Root CA X3 expired certificate. Note that the scanner has not tested for these issues but has...

WordPress 5.6.x < 5.6.6 Expired DST Root CA X3 Certificate

According to its self-reported version number, the detected WordPress application is affected by an expired certificate. The wordpress/wp-includes/certificates/ca-bundle.crt file still contains the DST Root CA X3 expired certificate. Note that the scanner has not tested for these issues but has...

RHEL 8 : jasper (RHSA-2021:4235)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:4235 advisory. JasPer is an implementation of Part 1 of the JPEG 2000 image compression standard. Security Fixes: jasper: Heap-based buffer overflow in...

Nextcloud: SQL injextion via vulnerable doctrine/dbal version

Summary: SQL injection via limit parameter on user facing APIs Steps To Reproduce: Run security scanner: 1. REPORT /remote.php/dav/comments/files/1985 1. XML input oc:filter-comments.oc:limittext was set to 1'" 1. You have an error in your SQL syntax Supporting Material/References: For more detai...

PHP 7.4.x < 7.4.24 Arbitrary File Write

The version of PHP installed on the remote host is 7.4.x prior to 7.4.25. It is, therefore, affected by a vulnerability as referenced in the version 7.4.24 advisory. In the Microsoft Windows environment, ZipArchive::extractTo may be tricked into writing a file outside target directory when...

NewStart CGSL CORE 5.04 / MAIN 5.04 : postgresql Multiple Vulnerabilities (NS-SA-2021-0109)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has postgresql packages installed that are affected by multiple vulnerabilities: - A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before 9.6.15, 10.x before 10.10 and 11.x before 11...

NewStart CGSL CORE 5.05 / MAIN 5.05 : libX11 Vulnerability (NS-SA-2021-0161)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has libX11 packages installed that are affected by a vulnerability: - An integer overflow vulnerability leading to a double-free was found in libX11. This flaw allows a local privileged attacker to cause an application compiled...

Jetty 11.0.x < 11.0.6 Information Disclosure

The version of Jetty installed on the remote host has a flaw which allows bypass of security constraints and access protected resources. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No source data...

Lodash < 4.17.21 Multiple Vulnerabilities

According to its self-reported version number, Lodash is prior to 4.17.21. It is, therefore, affected by multiple vulnerabilities: - A command injection via template. CVE-2021-23337 - A regular expression denial of dervice via the toNumber, trim and trimEnd functions. CVE-2020-28500 Note that the...