RockyLinux 8 : openssl (RLSA-2024:7848)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2024:7848 advisory. openssl: SSLselectnextproto buffer overread CVE-2024-5535 Tenable has extracted the preceding description block directly from the RockyLinux security advisory. No...

RockyLinux 8 / 9 : java-11-openjdk (RLSA-2024:8121)

The remote RockyLinux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:8121 advisory. giflib: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function CVE-2023-48161 JDK: Array indexing integer overflow 8328544 CVE-2024-2121...

Oracle Linux 7 : firefox (ELSA-2024-6838)

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2024-6838 advisory. 128.2.0-1.0.1 - Remove nomerge annotation from abort calls Orabug: 37079143 - Update to 128.2.0 Orabug: 37079143 Tenable has extracted the preceding...

RockyLinux 8 : grafana (RLSA-2024:8327)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:8327 advisory. golang-fips: Golang FIPS zeroed buffer CVE-2024-9355 dompurify: nesting-based mutation XSS vulnerability CVE-2024-47875 Tenable has extracted the precedi...

FreeBSD : electron32 -- multiple vulnerabilities (cc068959-ce2b-42eb-81ed-055551fe0e51)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the cc068959-ce2b-42eb-81ed-055551fe0e51 advisory. Electron developers report: This update fixes the following vulnerabilities: Tenable has...

Fedora 39 : rust-pyo3 / rust-pyo3-build-config / rust-pyo3-ffi / etc (2024-44f01d9c69)

The remote Fedora 39 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2024-44f01d9c69 advisory. Update pyo3 to version 0.22.4. This version addresses a potential use-after-free RUSTSEC-2024-0378. Tenable has extracted the preceding description block...

Fedora 39 : dotnet6.0 (2024-00855b1d76)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-00855b1d76 advisory. This is the October 2024 monthly update for .NET 6. Release Notes: - SDK: https://github.com/dotnet/core/blob/main/release-notes/6.0/6.0.35/6.0.135.md -...

RHEL 8 / 9 : OpenShift Container Platform 4.16.18 (RHSA-2024:8263)

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:8263 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or...

RHEL 9 : python3.9 (RHSA-2024:8446)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:8446 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic dat...

Fedora 40 : rust-pyo3 / rust-pyo3-build-config / rust-pyo3-ffi / etc (2024-23292e9f6d)

The remote Fedora 40 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2024-23292e9f6d advisory. Update pyo3 to version 0.22.4. This version addresses a potential use-after-free RUSTSEC-2024-0378. Tenable has extracted the preceding description block...

Oracle Linux 7 / 8 / 9 : linux-firmware (ELSA-2024-12797)

The remote Oracle Linux 7 / 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-12797 advisory. 20241003-999.35.git95bfe086.el8 - Rebase to latest upstream Orabug: 37132142 - Fix build error in ol7 due to linking in copy-firmware.sh Orabu...

Rockwell Automation Logix Controllers Uncontrolled Resource Consumption (CVE-2024-8626)

Due to a memory leak, a denial-of-service vulnerability exists in the affected products. A malicious actor could exploit this vulnerability by performing multiple actions on certain webpages of the product causing the affected products to become fully unavailable and require a power cycle to...

SUSE SLED15: libprotobuf-lite25_1_0 / libprotobuf-lite25_1_0-32bit / etc (SUSE-SU-2024:3745-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:3745-1 advisory. - CVE-2024-7254: Fixed stack overflow vulnerability in Protocol Buffer bsc1230778 Tenable has extracted t...

Oracle Linux 8 : NetworkManager-libreswan (ELSA-2024-8353)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-8353 advisory. 1.2.10-7 - Unbreak validation of unknown keys 1.2.10-6 - Fix improper escaping of Libreswan configuration CVE-2024-9050 Tenable has extracted the preceding...

SUSE SLED15: libprotobuf-lite25_1_0 / libprotobuf-lite25_1_0-32bit / etc (SUSE-SU-2024:3747-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:3747-1 advisory. - CVE-2024-7254: Fixed stack overflow vulnerability in Protocol Buffer bsc1230778 Tenable has extracted t...

Oracle Linux 8 : edk2 (ELSA-2024-12795)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-12795 advisory. - EDK2: EDK2 contains a vulnerability when S3 sleep is activated where an Attacker may cause a Division- By-Zero due to a UNIT32 overflow via local...

Security Flaw in Styra's OPA Exposes NTLM Hashes to Remote Attackers

Details have emerged about a now-patched security flaw in Styra's Open Policy Agent OPA that, if successfully exploited, could have led to leakage of New Technology LAN Manager NTLM hashes. "The vulnerability could have allowed an attacker to leak the NTLM credentials of the OPA server's local us...

Ubuntu 22.04 LTS : Linux kernel (GKE) vulnerabilities (USN-7072-2)

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7072-2 advisory. Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in...

Siemens SIMATIC S7-1500 CPUs Authentication Bypass Using an Alternate Path or Channel (CVE-2024-46887)

The web server of affected devices do not properly authenticate user request to the '/ClientArea/RuntimeInfoData.mwsl' endpoint. This could allow an unauthenticated remote attacker to gain knowledge about current actual and configured maximum cycle times as well as about configured maximum...

Siemens SIMATIC S7-1500 and S7-1200 CPUs URL Redirection to Untrusted Site (CVE-2024-46886)

The web server of affected devices does not properly validate input that is used for a user redirection. This could allow an attacker to make the server redirect the legitimate user to an attacker-chosen URL. For a successful exploit, the legitimate user must actively click on an attacker-crafted...