Synology DiskStation Manager Exposure of Sensitive Information to an Unauthorized Actor (CVE-2018-8919)

Information exposure vulnerability in SYNO.Core.Desktop.SessionData in Synology DiskStation Manager DSM before 6.1.6-15266 allows remote attackers to steal credentials via unspecified vectors. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for mor...

Synology DiskStation Manager SQL Injection (CVE-2021-43927)

Improper neutralization of special elements used in an SQL command 'SQL Injection' vulnerability in Security Management functionality in Synology DiskStation Manager DSM before 7.0.1-42218-2 allows remote attackers to inject SQL commands via unspecified vectors. This plugin only works with...

F5 Networks BIG-IP : Perl vulnerability (K000141301)

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K000141301 advisory. Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers to execute...

FreeBSD : chromium -- multiple security fixes (2f82696c-adad-447b-9938-c99441805fa3)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 2f82696c-adad-447b-9938-c99441805fa3 advisory. Chrome Releases reports: This update includes 5 security fixes: Tenable has extracted the...

Ubuntu 20.04 LTS : Knot Resolver vulnerabilities (USN-7047-1)

The remote Ubuntu 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7047-1 advisory. Vladimr unt discovered that Knot Resolver incorrectly handled input during DNSSEC validation. A remote attacker could possibly use this issue to bypass...

Synology DiskStation Manager Server-Side Request Forgery (SSRF) (CVE-2022-27622)

Server-Side Request Forgery SSRF vulnerability in Package Center functionality in Synology DiskStation Manager DSM before 7.1-42661 allows remote authenticated users to access intranet resources via unspecified vectors. This plugin only works with Tenable.ot. Please visit...

Synology DiskStation Manager Improper Neutralization of Special Elements used in a Command (CVE-2017-12075)

Command injection vulnerability in EZ-Internet in Synology DiskStation Manager DSM before 6.2-23739 allows remote authenticated users to execute arbitrary command via the username parameter. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more...

Slackware Linux 15.0 / current mozilla-firefox Multiple Vulnerabilities (SSA:2024-275-02)

The version of mozilla-firefox installed on the remote host is prior to 115.16.0esr / 128.3.0esr. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2024-275-02 advisory. New mozilla-firefox packages are available for Slackware 15.0 and -current to fix security issues...

RHEL 7 : 389-ds-base (RHSA-2024:7434)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:7434 advisory. 389 Directory Server is an LDAP version 3 LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol LDAP server an...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS : Python vulnerability (USN-7015-3)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-7015-3 advisory. USN-7015-1 fixed several vulnerabilities in Python. This update provides the corresponding updates for CVE-2023-27043 for...

RHEL 8 : cups-filters (RHSA-2024:7461)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:7461 advisory. The cups-filters package contains back ends, filters, and other software that was once part of the core Common UNIX Printing System CUPS...

FreeBSD : Slixmpp -- Lack of SSL Certificate hostname validation in XMLStream (f9cfdb00-7f43-11ef-9b27-592d55dd336d)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the f9cfdb00-7f43-11ef-9b27-592d55dd336d advisory. NIST reports: Slixmpp before 1.8.3 lacks SSL Certificate hostname validation in XMLStream, allowing an...

Synology DiskStation Manager Open Redirect (CVE-2024-0854)

URL redirection to untrusted site 'Open Redirect' vulnerability in file access component in Synology DiskStation Manager DSM before 7.2.1-69057-2 allows remote authenticated users to conduct phishing attacks via unspecified vectors. This plugin only works with Tenable.ot. Please visit...

Oracle Linux 7 : krb5 (ELSA-2024-5076)

"The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-5076 advisory. - Fix integer overflows in PAC parsing CVE-2022-42898 - Fix KDC null deref on TGS inner body null server CVE-2021-37750 - Fix flaws in LDAP DN checkin...

RHEL 9 : kpatch-patch-5_14_0-427_13_1 and kpatch-patch-5_14_0-427_31_1 (RHSA-2024:7432)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:7432 advisory. This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patch module i...

RHEL 8 : kpatch-patch-4_18_0-305_120_1 and kpatch-patch-4_18_0-305_138_1 (RHSA-2024:7427)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:7427 advisory. This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patch...

RHEL 9 : grafana-pcp (RHSA-2024:7350)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:7350 advisory. The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace...

Rocky Linux 9 : grafana (RLSA-2024:6947)

The remote Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2024:6947 advisory. encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion CVE-2024-34156 Tenabl...

Rocky Linux 9 : pcp (RLSA-2024:6848)

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:6848 advisory. pcp: pmpost symlink attack allows escalating pcp to root user CVE-2024-45770 pcp: pmcd heap corruption through metric pmstore operations CVE-2024-45769...

SUSE SLES15 Security Update : kernel (Live Patch 1 for SLE 15 SP6) (SUSE-SU-2024:3468-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3468-1 advisory. This update for the Linux Kernel 6.4.0-150600235 fixes several issues. The following security issues were fixed: - CVE-2024-40909: Fix a...