1875 matches found
Jetty 9.4.21 < 9.4.24 Cross-Site Scripting
The version of Jetty installed on the remote host when generating default unhandled Error response content in text/html and text/json Content-Type does not escape Exception messages in stacktraces included in error output. Note that the scanner has not tested for this issue but has instead relied...
Underscore.js 1.3.2 < 1.12.1 Arbitrary Code Injection
According to its self-reported version number, Underscore.js is 1.3.2 prior to 1.12.1 or 1.13.x prior to 1.13.0-2. Therefore, it may be affected by an arbitrary code injection via the template function when the variable option is taken from .templateSettings. Note that the scanner has not tested...
Underscore.js 1.13.x < 1.13.0-2 Arbitrary Code Injection
According to its self-reported version number, Underscore.js is 1.3.2 prior to 1.12.1 or 1.13.x prior to 1.13.0-2. Therefore, it may be affected by an arbitrary code injection via the template function when the variable option is taken from .templateSettings. Note that the scanner has not tested...
Apache < 2.4.49 Multiple Vulnerabilities
The version of Apache httpd installed on the remote host is prior to 2.4.49. It is, therefore, affected by multiple vulnerabilities as referenced in the 2.4.49 changelog. - apescapequotes may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to...
WordPress 5.5.x < 5.5.6 Multiple Vulnerabilities
According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A data exposure vulnerability within the REST API. - A Lodash library prior to 4.17.21 vulnerbaility. Note that the scanner has not tested for these issues but has instead...
Atlassian Jira 8.14.x < 8.18.0 Broken Access Control
According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.13.9 or 8.14.x prior to 8.18.0. It is, therefore, affected by a broken access control vulnerability in the allowlist feature allowing anonymous remote attackers to continue ...
Microsoft SharePoint Server 2016 < 16.0.5134.1001 Multiple Vulnerabilities
According to its self-reported version number, the Microsoft SharePoint application running on the remote host is affected by multiple vulnerabilities. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No source da...
Unix Software Discovery Commands Not Available
Nessus found problems running commands on the target host which are used to find software that is not managed by the operating system. Details of the issues encountered are reported by this plugin. Failure to properly execute commands used to find and characterize unmanaged software on the target...
Johnsoncontrols Metasys Use of Hard-coded Credentials
Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a shared RSA key pair for certain encryption operations involving the Site Management Portal SMP. File data ot500401.nasl...
Rockwellautomation Factorytalk Improper Handling of Exceptional Conditions
An attacker can craft and send an OpenNamespace message to port 4241 with valid session-id that triggers an unhandled exception in CFTLDManager::HandleRequest function in RnaDaSvr.dll, resulting in process termination. Observed in FactoryTalk Linx 6.11. All versions of FactoryTalk Linx are...
AD Starter Scan - Null sessions
Binary data adsinullsession.nbin...
Adminer < 4.2.2 Cross-Site Scripting
The version of Adminer installed on the remote host does not sanitize user input on the alter table function potentially leading to a XSS vulnerability. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No source d...
X-Cart 5.0.10 < 5.3.3.0 Multiple Vulnerabilities
According to the self-reported version in its response header, the version of X-Cart hosted on the remote web server is 5.0.10 5.3.3.0. It is, therefore, affected by multiples vulnerabilities : - A Remote Code execution vulnerability due to insufficient checking of uploaded content. This...
Salus - Security Scanner Coordinator
Salus Security Automation as a Lightweight Universal Scanner, named after the Roman goddess of protection, is a tool for coordinating the execution of security scanners. You can run Salus on a repository via the Docker daemon and it will determine which scanners are relevant, run them and provide...
Atlassian Confluence < 6.13.11 Improper Authorization
According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 6.13.11 or 6.14.x 7.3.3. It is, therefore, affected by an improper authorization check vulnerability allowing remote attackers with administrator privileges to edit existing...
Atlassian Confluence < 7.4.5 Template Injection
According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 7.4.5 or 7.5.x 7.5.1. It is, therefore, affected by an injection vulnerability in custom user macros allowing remote attackers with system administration permissions to bypas...
Atlassian Jira < 8.5.11 Multiple Vulnerabilities
According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.5.11, 8.6.x 8.13.3 or 8.14.x 8.15.0. It is, therefore, affected by multiple vulnerabilities: - An information disclosure vulnerability in the...
Debian DLA-2686-1 : python-urllib3 - LTS security update
The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2686 advisory. Several vulnerabilities were discovered in python-urllib3, a HTTP client for Python. CVE-2018-20060 Urllib3 does not remove the Authorization HTTP header when...
FreeBSD : polkit -- local privilege escalation using polkit_system_bus_name_get_creds_sync (36a35d83-c560-11eb-84ab-e0d55e2a8bf9)
Cedric Buissart reports : The function polkitsystembusnamegetcredssync is used to get the uid and pid of the process requesting the action. It does this by sending the unique bus name of the requesting process, which is typically something like ':1.96', to dbus-daemon. These unique names are...