[Security Nation] Gordon “Fyodor” Lyon on Nmap, the Open-Source Security Scanner

!\Security Nation\ Gordon “Fyodor” Lyon on Nmap, the Open-Source Security Scannerhttps://blog.rapid7.com/content/images/2022/08/securitynationlogo-2.jpg In this episode of Security Nation, Jen and Tod chat with Gordon “Fyodor” Lyon, author of the widely used open-source Nmap Security Scanner. On...

The Truth About False Positives in Security

TL;DR: As weird as it might sound, seeing a few false positives reported by a security scanner is probably a good sign and certainly better than seeing none. Let's explain why. Introduction False positives have made a somewhat unexpected appearance in our lives in recent years. I am, of course,...

The Truth About False Positives in Security

TL;DR: As weird as it might sound, seeing a few false positives reported by a security scanner is probably a good sign and certainly better than seeing none. Let's explain why. Introduction False positives have made a somewhat unexpected appearance in our lives in recent years. I am, of course,...

QNAP Helpdesk Multiple Vulnerabilities (QSA-20-08)

The version of QNAP QTS Helpdesk is affected by multiple vulnerabilities as follows: - If exploited, this improper access control vulnerability could allow attackers to compromise the security of the software by gaining privileges, or reading sensitive information. CVE-2020-2506 - If exploited,...

Splunk Enterprise < 8.1.0 Information Disclosure

According to its self-reported version number, the version of Splunk running on the remote web server is Splunk Enterprise prior to 8.1. It is, therefore, be affected by an information disclosure vulnerability where, when handling a mismatched authentication cookie, the application leaks the...

Expression Language Injection

Expression Language EL has been defined as part of the Java Server Pages Standard Tag Library JSTL in order to offer developers a simple way to output data from an object model. Starting from the JSP 2.0 specification, Expression Language has been made available within JSP pages, but it is also...

ThinkPHP Framework 5.1.x < 5.1.31 Arbitrary File Read

A vulnerability exists within ThinkPHP Framework 5.1.x to 5.1.31. If the site is configured in debug mode, this vulnerability allows an attacker to read arbitrary files on the system due to improper sanitization of user-supplied input. No source data...

Amazon Linux 2 : java-1.8.0-amazon-corretto (ALASCORRETTO8-2022-003)

The version of java-1.8.0-amazon-corretto installed on the remote host is prior to 1.8.0342.b07-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2CORRETTO8-2022-003 advisory. Generated code produced by C1 may leak a package-private class to a class from a differe...

RHEL 8 : java-11-openjdk (RHSA-2022:5681)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5681 advisory. The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Security Fixe...

Oracle VM VirtualBox (July 2022 CPU)

The version of VirtualBox installed on the remote host is prior to 6.1.36. It is, therefore, affected by multiple vulnerabilities as referenced in the July 2022 CPU advisory: - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that i...

phpMyAdmin 4.x < 4.9.0 Cross-Site Request Forgery

The version of phpMyAdmin is affected by a Cross-Site Request Forgery CSRF vulnerability in the login form leading to potentially allowing an attacker to perform SQL injection. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported...

Stored Cross-Site Scripting (XSS)

Client-side scripts are used extensively by modern web applications. They perform from simple functions such as the formatting of text up to full manipulation of client-side data and Operating System interaction. Cross Site Scripting XSS allows clients to inject scripts into a request and have th...

GitLab 13.11 < 14.9.5 / 14.10 < 14.10.4 / 15.0 < 15.0.1 (CVE-2022-1940)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - A Stored Cross-Site Scripting vulnerability in Jira integration in GitLab EE affecting all versions from 13.11 prior to 14.9.5, 14.10 prior to 14.10.4, and 15.0 prior to 15.0.1 allows an attacker to...

PHP 8.0.x < 8.0.20 Multiple Vulnerabilities

According to its self-reported version number, the version of PHP installed on the remote host is 7.4.x prior to 7.4.30, 8.0.x prior to 8.0.20, or 8.1.x prior to 8.1.7. It is, therefore, affected by multiple vulnerabilities: - Uninitialized array in pgqueryparams. CVE-2022-31625 - mysqlnd/pdo...

PHP 7.4.x < 7.4.30 Multiple Vulnerabilities

According to its self-reported version number, the version of PHP installed on the remote host is 7.4.x prior to 7.4.30, 8.0.x prior to 8.0.20, or 8.1.x prior to 8.1.7. It is, therefore, affected by multiple vulnerabilities: - Uninitialized array in pgqueryparams. CVE-2022-31625 - mysqlnd/pdo...

Nginx Plus R1 < R15-P2 / R16 < R16-P1 Multiple Vulnerabilities

According to its self reported version, the installed version of Nginx Plus is R1 built on Open Source version 1.5.3-1 prior to R15-P2 or R16 built on Open Source version 1.15.2 prior to R16-P1. It is, therefore, affected by the following issues : - An unspecified error exists related to the modu...

SAP NetWeaver AS ABAP and Code Injection (3123196)

A code injection vulnerability exists in SAP NetWeaver Application Server ABAP. This could allow an attacker with high privileges and has direct access to SAP System, to inject code when executing with a certain transaction class builder. This could allow execution of arbitrary commands on the...

BinAbsInspector - Vulnerability Scanner For Binaries

BinAbsInspector Binary Abstract Inspector is a static analyzer for automated reverse engineering and scanning vulnerabilities in binaries, which is a long-term research project incubated at Keenlab. It is based on abstract interpretation with the support from Ghidra. It works on Ghidra's Pcode...

GHSA-XP44-8VWR-XWMV Jenkins Aqua Security Scanner Plugin showed plain text password in configuration form

Jenkins Aqua Security Scanner Plugin 3.0.17 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure...

Jenkins Aqua Security Scanner Plugin showed plain text password in configuration form

Jenkins Aqua Security Scanner Plugin 3.0.17 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure...