Amazon Linux AMI : ImageMagick (ALAS-2021-1479)

The version of ImageMagick installed on the remote host is prior to 6.9.10.68-3.23. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1479 advisory. A flaw was found in ImageMagick. The -authenticate option is mishandled allowing user-controlled password set for a PDF...

CVE-2020-5812

Nessus AMI versions 8.12.0 and earlier were found to either not validate, or incorrectly validate, a certificate which could allow an attacker to spoof a trusted entity by using a man-in-the-middle MITM attack...

Code injection

Nessus AMI versions 8.12.0 and earlier were found to either not validate, or incorrectly validate, a certificate which could allow an attacker to spoof a trusted entity by using a man-in-the-middle MITM attack...

CVE-2020-5812

Nessus AMI versions 8.12.0 and earlier were found to either not validate, or incorrectly validate, a certificate which could allow an attacker to spoof a trusted entity by using a man-in-the-middle MITM attack...

CVE-2020-5812

CVE-2020-5812 affects Nessus AMI versions 8.12.0 and earlier. The issue is with certificate validation (noted as not validating or incorrectly validating a certificate), which could allow an attacker to perform a man-in-the-middle (MITM) attack by spoofing a trusted entity. The connected document...

[R1] Nessus AMI 8.13.1 Fixes One Vulnerability

Nessus AMI versions 8.12.0 and earlier were found to either not validate, or incorrectly validate, a certificate which could allow an attacker to spoof a trusted entity by using a man-in-the-middle MITM attack...

The SolarWinds Attack

SolarWinds attack explained by Wiz CTO Ami Luttwak...

Amazon Linux AMI : sudo (ALAS-2021-1478)

The version of sudo installed on the remote host is prior to 1.8.23-9.56. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1478 advisory. When sudo runs a command in shell mode, either via the -s or -i command line option, it escapes special characters in the command's...

Amazon Linux AMI : kernel (ALAS-2021-1477)

The version of kernel installed on the remote host is prior to 4.14.214-118.339. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1477 advisory. In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image, performing some operations, and then making ...

Amazon Linux AMI : ruby20 (ALAS-2021-1468)

The version of ruby20 installed on the remote host is prior to 2.0.0.648-2.39. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1468 advisory. An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server...

Amazon Linux AMI : golang (ALAS-2021-1471)

The version of golang installed on the remote host is prior to 1.15.5-1.65. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1471 advisory. Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service. CVE-2020-28362 Go before 1.14.12 and 1.15.x before...

Amazon Linux AMI : php7-pear (ALAS-2021-1466)

The version of php7-pear installed on the remote host is prior to 1.10.12-4.30. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1466 advisory. ArchiveTar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked...

Amazon Linux AMI : tigervnc (ALAS-2021-1470)

The version of tigervnc installed on the remote host is prior to 1.8.0-21.34. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1470 advisory. TigerVNC version prior to 1.10.1 is vulnerable to stack use-after-return, which occurs due to incorrect usage of stack...

Amazon Linux AMI : mysql56 (ALAS-2021-1464)

The version of mysql56 installed on the remote host is prior to 5.6.50-1.38. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1464 advisory. Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Stored Procedure. Supported versions that...

Amazon Linux AMI : kernel (ALAS-2021-1461)

The version of kernel installed on the remote host is prior to 4.14.209-117.337. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1461 advisory. A use-after-free flaw was found in the debugfsremove function in the Linux kernel. The flaw could allow a local...

Amazon Linux AMI : bind (ALAS-2021-1457)

The version of bind installed on the remote host is prior to 9.8.2-0.68.rc1.85. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1457 advisory. A flaw was found in bind. An assertion failure can occur when trying to verify a truncated response to a TSIG-signed request...

Amazon Linux AMI : libX11 (ALAS-2021-1462)

The version of libX11 installed on the remote host is prior to 1.6.0-2.2.13. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1462 advisory. An integer overflow vulnerability leading to a double-free was found in libX11. This flaw allows a local privileged attacker to...

Amazon Linux AMI : tomcat8 (ALAS-2021-1473)

The version of tomcat8 installed on the remote host is prior to 8.5.60-1.86. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1473 advisory. While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.5...

Amazon Linux AMI : java-1.8.0-openjdk (ALAS-2021-1460)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.272.b10-1.56. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1460 advisory. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Serialization...

Amazon Linux AMI : e2fsprogs (ALAS-2021-1458)

The version of e2fsprogs installed on the remote host is prior to 1.43.5-2.44. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1458 advisory. An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially...