AlmaLinux 9 : glibc (ALSA-2024:3339)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:3339 advisory. glibc: Out of bounds write in iconv conversion to ISO-2022-CN-EXT CVE-2024-2961 glibc: stack-based buffer overflow in netgroup cache CVE-2024-33599 glibc:...

Amazon Linux 2023 : oci-add-hooks (ALAS2023-2024-632)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-632 advisory. A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP clie...

CentOS 8 : openssh (CESA-2024:3166)

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:3166 advisory. - scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE...

Wiz achieves Red Hat Vulnerability Scanner Certification

Wiz’s vulnerability scanning is now certified by Red Hat, providing customers with refined assessment of vulnerabilities for Red Hat Products...

RHEL 6 : libsoup (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - libsoup: Crash in soupcookiejar.c:getcookies on empty hostnames CVE-2018-12910 Note that Nessus has not tested for...

RHEL 8 : dcraw (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - dcraw: Stack-based buffer overflow in the findgreen function CVE-2018-19655 - A buffer over-read in...

RHEL 6 : batik (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - batik: XML external entity processing vulnerability CVE-2017-5662 - batik: information disclosure when...

RHEL 7 : opensc (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - opensc: Double free in coolkeyfreeprivatedata in libopensc/card-coolkey.c CVE-2019-20792 - opensc: buffer...

RHEL 5 : aspell (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - aspell: stack-based buffer over-read in acommon::unescape in common/getdata.cpp CVE-2019-17544 Note that Nessus has...

RHEL 6 : python-paramiko (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - python-paramiko: Race condition in the writeprivatekeyfile function CVE-2022-24302 Note that Nessus has not tested...

RHEL 6 : gtk-vnc (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - gtk-vnc: Integer overflow when processing SetColorMapEntries CVE-2017-5885 - gtk-vnc 0.4.2 and older...

RHEL 6 : gthumb (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - gthumb: DoS via malformed JPEG image CVE-2020-36427 Note that Nessus has not tested for this issue but has instead...

Zebra ZTC Industrial ZT400 and ZTC Desktop GK420d Authentication Bypass Using an Alternate Path or Channel (CVE-2023-4957)

A vulnerability of authentication bypass has been found on a Zebra Technologies ZTC ZT410-203dpi ZPL printer. This vulnerability allows an attacker that is in the same network as the printer, to change the username and password for the Web Page by sending a specially crafted POST request to the...

When is One Vulnerability Scanner Not Enough?

Like antivirus software, vulnerability scans rely on a database of known weaknesses. That's why websites like VirusTotal exist, to give cyber practitioners a chance to see whether a malware sample is detected by multiple virus scanning engines, but this concept hasn't existed in the vulnerability...

RHEL 6 / 7 : httpd24 (RHSA-2018:3558)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3558 advisory. The Apache HTTP Server is a powerful, efficient, and extensible web server. The httpd24 packages provide a recent stable release of...

Fedora 38 : xen (2024-a676697123)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-a676697123 advisory. x86: Native Branch History Injection XSA-456, CVE-2024-2201 update to xen 4.17.4, remove patches now included upstream rebase xen.gcc12.fixes.patch...

Django Debug Mode Enabled

Django is a free and open-source Python web application framework which offers a debug mode which allows developers to get additional information to help troubleshooting their applications including stack traces on error pages, exposing variables defined in your Django settings. A remote...

WSO2 Management Console Cross-Site Scripting

The management console of multiple WSO2 products suffer from a Cross-Site Scripting vulnerability : - WSO2 API Manager versions 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0, 3.2.0, 4.0.0 - WSO2 API Manager Analytics versions 2.2.0, 2.5.0, 2.6.0 - WSO2 API Microgateway version 2.2.0 - WSO2 Data Analytics...

WordPress 6.2.x < 6.2.5 Cross-Site Scripting

According to its self-reported version number, the detected WordPress application is affected by a Cross-Site Scripting XSS vulnerability affecting the avatar block type. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version...

Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2024-12270)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-12270 advisory. - netfilter: nftables: reject QUEUE/DROP verdict parameters Florian Westphal Orabug: 36467681 CVE-2024-1086 - netfilter: nftables: Reject tables of...