Tenable Nessus 10.x < 10.2.0 Third-Party Vulnerabilities (TNS-2022-11)

According to its self-reported version, the Tenable Nessus application running on the remote host is 10.x prior to 10.2.0. It is, therefore, affected by multiple vulnerabilities in third-party libraries, including: - An integer overflow in storeRawNames in Expat aka libexpat before 2.4.5...

Tenable Nessus 8.x < 8.15.5 Third-Party Vulnerabilities (TNS-2022-12)

According to its self-reported version, the Tenable Nessus application running on the remote host is 8.x prior to 8.15.5. It is, therefore, affected by multiple vulnerabilities in third-party libraries, including: - An integer overflow in storeRawNames in Expat aka libexpat before 2.4.5...

[R3] Nessus Version 10.2.0 Fixes Multiple Vulnerabilities

R3 Nessus Version 10.2.0 Fixes Multiple Vulnerabilities Arnie Cabral Thu, 05/26/2022 - 09:30 Nessus leverages third-party software to help provide underlying functionality. Several of the third-party components zlib, expat, jQuery UI were found to contain vulnerabilities, and updated versions hav...

EulerOS 2.0 SP3 : php (EulerOS-SA-2022-1755)

According to the versions of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexmlloadfile, URL-decode th...

EulerOS 2.0 SP3 : gdk-pixbuf2 (EulerOS-SA-2022-1721)

According to the versions of the gdk-pixbuf2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - gdk-pixbuf-thumbnailer.c in gdk-pixbuf allows context-dependent attackers to cause a denial of service NULL pointer dereference and...

Survey Sparrow Enterprise Survey Software 2022 - Stored Cross-Site Scripting (XSS)

Exploit Title: Survey Sparrow Enterprise Survey Software 2022 - Stored Cross-Site Scripting XSS Date: May 11 2022 Exploit Author: Pankaj Kumar Thakur Vendor Homepage: https://surveysparrow.com/ Software Link: https://surveysparrow.com/enterprise-survey-software/ Version: 2022 Tested on: Windows C...

RHEL 7 : .NET 5.0 on RHEL 7 (RHSA-2022:2196)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:2196 advisory. .NET Core is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR...

Microsoft Patch Tuesday, May 2022 Edition

Microsoft today released updates to fix at least 74 separate security problems in its Windows operating systems and related software. This months patch batch includes fixes for seven "critical" flaws, as well as a zero-day vulnerability that affects all supported versions of Windows. By all...

Tenable SecurityCenter 5.12.x - 5.18.x / 5.19.x / 5.20.x Multiple Vulnerabilities (TNS-2022-08)

According to its self-reported version, the Tenable SecurityCenter application installed on the remote host is running 5.19.x or 5.20.x and is therefore affected by multiple vulnerabilities: - Read/write beyond bounds - Out-of-bounds Write vulnerability in modsed of Apache HTTP Server allows an...

CentOS 8 : exiv2 (CESA-2022:1842)

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2022:1842 advisory. - exiv2: stack exhaustion issue in the printIFDStructure function may lead to DoS CVE-2020-18898 Note that Nessus has not tested for this issue but has instead...

Security Updates for Microsoft Word Products (May 2022)

The Microsoft Word Products are missing a security update. It is, therefore, affected by the following vulnerability: - A security feature bypass vulnerability exists. An attacker can exploit this and bypass the security feature and perform unauthorized actions compromising the integrity of the...

CentOS 8 : cpio (CESA-2022:1991)

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2022:1991 advisory. - cpio: integer overflow in dsfgetstr in dstring.c can lead to an out-of-bounds write via a crafted pattern file CVE-2021-38185 Note that Nessus has not tested...

NewStart CGSL MAIN 6.02 : libsndfile Vulnerability (NS-SA-2022-0068)

The remote NewStart CGSL host, running version MAIN 6.02, has libsndfile packages installed that are affected by a vulnerability: - A heap buffer overflow vulnerability in msadpcmdecodeblock of libsndfile 1.0.30 allows attackers to execute arbitrary code via a crafted WAV file. CVE-2021-3246 Note...

[R1] Nessus Network Monitor 6.0.1 Fixes Multiple Third-party Vulnerabilities

R1 Nessus Network Monitor 6.0.1 Fixes Multiple Third-party Vulnerabilities Arnie Cabral Mon, 05/09/2022 - 17:04 Nessus Network Monitor leverages third-party software to help provide underlying functionality. Several third-party components OpenSSL and jQuery UI were found to contain vulnerabilitie...

EulerOS Virtualization 3.0.2.0 : nfs-utils (EulerOS-SA-2022-1695)

According to the versions of the nfs-utils package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The nfs-utils package in SUSE Linux Enterprise Server 12 before and including version 1.3.0-34.18.1 and in SUSE Linux Enterpris...

EulerOS Virtualization 3.0.2.0 : binutils (EulerOS-SA-2022-1697)

According to the versions of the binutils package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It permits the visual reorderi...

EulerOS Virtualization 3.0.2.0 : glibc (EulerOS-SA-2022-1678)

According to the versions of the glibc packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The deprecated compatibility function clntcreate in the sunrpc module of the GNU C Library aka glibc through 2.34 copies its...

Windows Services Registry ACL

Checks Windows Registry for Service ACLs. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include"compat.inc"; if description scriptid160576; scriptversion"1.5"; scriptnameenglish:"Windows Services Registry ACL"; scriptsummaryenglish:"Checks Registry for...

EulerOS Virtualization 2.9.0 : qemu (EulerOS-SA-2022-1621)

According to the versions of the qemu package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - An integer overflow was found in the QEMU implementation of VMWare's paravirtual RDMA device in versions prior to 6.1.0. The issue...

RHEL 7 / 8 : Red Hat JBoss Web Server 5.6.2 Security Update (Important) (RHSA-2022:1519)

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:1519 advisory. Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache...