SUSE SLED15: gnome-extensions / gnome-shell / gnome-shell-calendar / etc (SUSE-SU-2024:2576-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2576-1 advisory. - CVE-2024-36472: Fixed portal helper automatically launched without user confirmation bsc122556...

RHEL 8 : nghttp2 (RHSA-2024:4732)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:4732 advisory. libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 HTTP/2 protocol in C. Security Fixes: nghttp2: CONTINUATION frames DoS...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2024-075)

The version of kernel installed on the remote host is prior to 5.4.278-191.377. It is, therefore, affected by a vulnerability as referenced in the ALAS2KERNEL-5.4-2024-075 advisory. In the Linux kernel, the following vulnerability has been resolved: net: fix dstnegativeadvice race CVE-2024-36971...

SUSE SLED15: java-21-openjdk / java-21-openjdk-demo / java-21-openjdk-devel / etc (SUSE-SU-2024:2578-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2578-1 advisory. Updated to version 21.0.4+7 July 2024 CPU: - CVE-2024-21131: Fixed a potential UTF8 size overflo...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS : Rack vulnerabilities (USN-6905-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6905-1 advisory. It was discovered that Rack incorrectly handled certain regular expressions. A remote attacker could...

Oracle Linux 8 : httpd:2.4 (ELSA-2024-4720)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-4720 advisory. - Resolves: RHEL-45812 - httpd:2.4/httpd: Substitution encoding issue in modrewrite CVE-2024-38474 - Resolves: RHEL-45785 - httpd:2.4/httpd: Encoding...

Amazon Linux 2 : ecs-init, --advisory ALAS2ECS-2024-039 (ALASECS-2024-039)

The version of ecs-init installed on the remote host is prior to 1.84.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2024-039 advisory. An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of...

Amazon Linux 2 : libreswan (ALAS-2024-2596)

The version of libreswan installed on the remote host is prior to 3.25-4.8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2596 advisory. The Libreswan Project was notified of an issue causing libreswan to restart when using IKEv1 without specifying an esp= line. Wh...

Slackware Linux 15.0 mozilla-thunderbird Multiple Vulnerabilities (SSA:2024-205-03)

The version of mozilla-thunderbird installed on the remote host is prior to 115.13.0. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2024-205-03 advisory. New mozilla-thunderbird packages are available for Slackware 15.0 to fix security issues. Tenable has extract...

RHEL 8 : thunderbird (RHSA-2024:4717)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:4717 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: Mozilla: Race condition in permission assignment CVE-2024-660...

SUSE SLED15: libpython3_12-1_0 / libpython3_12-1_0-32bit / python312 / etc (SUSE-SU-2024:2572-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2572-1 advisory. - CVE-2024-4032: Corrected information about public and private IPv4 and IPv6 address ranges...

EulerOS 2.0 SP8 : libyaml (EulerOS-SA-2024-2041)

According to the versions of the libyaml packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability was found in yaml libyaml up to 0.2.5 and classified as critical. Affected by this issue is the function...

Hikvision IP Cameras Buffer Overflow (CVE-2018-6414)

A buffer overflow vulnerability in the web server of some Hikvision IP Cameras allows an attacker to send a specially crafted message to affected devices. Due to the insufficient input validation, successful exploit can corrupt memory and lead to arbitrary code execution or crash the process. Thi...

EulerOS 2.0 SP8 : jose (EulerOS-SA-2024-2037)

According to the versions of the jose packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : latchset jose through version 11 allows attackers to cause a denial of service CPU consumption via a large p2c aka PBES2 Count value.CVE-2023-50967...

EulerOS 2.0 SP8 : libgit2 (EulerOS-SA-2024-2039)

According to the versions of the libgit2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionalit...

Amazon Linux 2023 : openssh, openssh-clients, openssh-keycat (ALAS2023-2024-651)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-651 advisory. A signal handler race condition vulnerability was found in OpenSSH's server sshd, where a client does not authenticate within LoginGraceTime seconds 120 by default, 600 in old OpenSSH versions, then...

EulerOS 2.0 SP8 : sudo (EulerOS-SA-2024-2055)

According to the versions of the sudo package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Sudo before 1.9.13 does not escape control characters in sudoreplay output.CVE-2023-28487 Sudo before 1.9.13 does not escape control characters in lo...

Amazon Linux 2023 : cups, cups-client, cups-devel (ALAS2023-2024-660)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-660 advisory. OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.8 and earlier, when starting the cupsd server with a Listen configuration item pointi...

Hikvision IP Cameras Missing Encryption of Sensitive Data (CVE-2017-14953)

HikVision Wi-Fi IP cameras, when used in a wired configuration, allow physically proximate attackers to trigger association with an arbitrary access point by leveraging a default SSID with no WiFi encryption or authentication. NOTE: Vendor states that this is not a vulnerability, but more an...

Hikvision NVRs Devices HTTP Buffer Overflow (CVE-2015-4407)

Buffer overflow on Hikvision NVR DS-76xxNI-E1/2 and DS-77xxxNI-E4 devices before 3.4.0 allows remote authenticated users to cause a denial of service service interruption via a crafted HTTP request, aka the PSIA issue. This plugin only works with Tenable.ot. Please visit...