SUSE SLED12 / SLES12 Security Update : compat-openssl098 (SUSE-SU-2017:0605-1)

This update for compat-openssl098 fixes the following issues contained in the OpenSSL Security Advisory 26 Jan 2017 bsc1021641 Security issues fixed : - CVE-2016-7056: A local ECSDA P-256 timing attack that might have allowed key recovery was fixed bsc1019334 - CVE-2016-8610: A remote denial of...

Fedora 24 : libXdmcp (2017-bcb1999e65)

Security fix for CVE-2017-2625 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300...

Ubuntu 14.04 LTS : w3m vulnerabilities (USN-3214-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3214-1 advisory. A large number of security issues were discovered in the w3m browser. If a user were tricked into viewing a malicious website, a remote attacker could...

Ubuntu 16.04 LTS : PHP regression (USN-3211-2)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3211-2 advisory. USN-3211-1 fixed vulnerabilities in PHP by updating to the new 7.0.15 upstream release. PHP 7.0.15 introduced a regression when using MySQL with large blobs. This...

Oracle Linux 7 : qemu-kvm (ELSA-2017-0396)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-0396 advisory. - Resolves: bz1420490 EMBARGOED CVE-2017-2620 qemu-kvm: Qemu: display: cirrus: potential arbitrary code execution via cirrusbitbltcputovideo rhel-7.3.z...

Ubuntu 14.04 LTS : Munin vulnerability (USN-3215-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3215-1 advisory. It was discovered that Munin incorrectly handled CGI graphs. A remote attacker could use this issue to overwrite arbitrary files as the www-data user. Tenable has...

Oracle Linux 7 : kernel (ELSA-2017-0386)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-0386 advisory. - x86 kvm: x86: Check memopp before dereference Mateusz Guzik 1395805 1395806 CVE-2016-8630 - vfio pci: Fix integer overflows, bitmask check Mateusz...

Tenable Nessus Cross-Site Scripting Vulnerability (CNVD-2017-02596)

Tenable Network Security Tenable Nessus is an open source vulnerability scanner from Tenable Network Security, USA. A cross-site scripting vulnerability exists in versions of Tenable Network Security Tenable Nessus prior to 6.9.1. A remote attacker can exploit this vulnerability to inject arbitra...

Tenable Log Correlation Engine Cross-Site Scripting Vulnerability

Tenable Log Correlation Engine a.k.a. LCE is a log correlation engine that provides log analysis and event monitoring from Tenable Network Security. A cross-site scripting vulnerability exists in versions of Tenable LCE prior to 4.8.1. A remote attacker can exploit this vulnerability to execute...

CVE-2016-9261

Cross-site scripting XSS vulnerability in Tenable Log Correlation Engine aka LCE before 4.8.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in Tenable Log Correlation Engine aka LCE before 4.8.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-9259

Cross-site scripting XSS vulnerability in Tenable Nessus before 6.9.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-9259

Cross-site scripting XSS vulnerability in Tenable Nessus before 6.9.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-9261

Cross-site scripting XSS vulnerability in Tenable Log Correlation Engine aka LCE before 4.8.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-9261

Tenable Log Correlation Engine (LCE) is affected in versions prior to 4.8.1 by cross-site scripting (XSS) vulnerabilities. The Nessus plugin aggregates multiple CVEs affecting LCE, including CVE-2016-9261, describing a vulnerability where an authenticated, remote attacker can inject arbitrary web...

CVE-2016-9259

CVE-2016-9259 refers to a cross-site scripting (XSS) vulnerability in Tenable Nessus prior to version 6.9.1. Connected sources describe it as a stored XSS flaw caused by improper validation of user-supplied input, exploitable by an authenticated remote attacker via specially crafted requests to e...

Fedora 24 : 2:vim (2017-9b2cf468d5)

The newest upstream commit, fixing CVE-2017-5953 vim: Tree length values not validated properly when handling a spell file Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2017-3521)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-3521 advisory. kernel-uek 3.8.13-118.16.4 - dccp: fix freeing skb too early for IPV6RECVPKTINFO Andrey Konovalov CVE-2017-6074 Tenable has extracted the preceding...

Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2017-3522)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-3522 advisory. 2.6.39-400.294.3 - dccp: fix freeing skb too early for IPV6RECVPKTINFO Andrey Konovalov Orabug: 25598277 CVE-2017-6074 Tenable has extracted the preceding...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2017-3520)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-3520 advisory. kernel-uek 4.1.12-61.1.28 - dccp: fix freeing skb too early for IPV6RECVPKTINFO Andrey Konovalov Orabug: 25598257 CVE-2017-6074 Tenable has extracted the...