RHEL 7 : ruby (RHSA-2019:1948)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:1948 advisory. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks...

Magento 2.1.x < 2.1.18, 2.2.x < 2.2.9, 2.3.x < 2.3.2 Multiple Vulnerabilities (Jun 2019)

Magento is prone to multiple vulnerabilities, including remote code execution RCE, cross-site scripting XSS and others. See the referenced advisories for further details on each specific vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a...

Mongoose Web Server < 6.15 Buffer Overflow Vulnerability

Mongoose Web Server is prone to a heap-based buffer overflow in parsemqtt. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is...

NetData Detection

Detection of NetData. The script sends a connection request to the server and attempts to detect NetData and to extract its version. Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the...

vulners NSE Script

For each available CPE the script prints out known vulns links to the correspondent info and correspondent CVSS scores. Its work is pretty simple: work only when some software version is identified for an open port take all the known CPEs for that software from the standard nmap -sV output make a...

ikiwiki < 3.20170111.1, 3.2018x < 3.20190228 SSRF Vulnerability

ikiwiki is prone to a server-side request forgery SSRF vulnerability via the aggregate plugin. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

OrangeHRM <= 4.3.1 RCE Vulnerability

OrangeHRM is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

ZTE WF820+ LTE Outdoor CPE Command Injection Vulnerability

The ZTE WF820+ LTE Outdoor CPE is an outdoor CPE Customer Premise Equipment device from ZTE China. A command injection vulnerability exists in the ZTE WF820+ LTE Outdoor CPE UKBBWF820+1.0.0B06 prior version, which originates from a network system or product not properly filtering specific element...

ZTE WF820+ LTE Outdoor CPE Cross-Site Request Forgery Vulnerability

The ZTE WF820+ LTE Outdoor CPE is an outdoor CPE Customer Premise Equipment device from ZTE China. A cross-site request forgery vulnerability exists in the ZTE WF820+ LTE Outdoor CPE UKBBWF820+1.0.0B06 prior version, which originates from a WEB application that does not adequately verify that the...

Scientific Linux Security Update : bind on SL6.x i386/x86_64 (20190617)

Security Fixes : - bind: Limiting simultaneous TCP clients is ineffective CVE-2018-5743 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid125979; scriptversion"1.5"; scriptsetattributeattribute:"pluginmodificationdate",...

CVE-2019-3409

All versions up to UKBBWF820+1.0.0B06 of ZTE WF820+ LTE Outdoor CPE product are impacted by command injection vulnerability. Due to inadequate parameter verification, unauthorized users can take advantage of this vulnerability to control the user terminal system...

Cross site request forgery (csrf)

All versions up to UKBBWF820+1.0.0B06 of ZTE WF820+ LTE Outdoor CPE product are impacted by Cross-Site Request Forgery vulnerability,which stems from the fact that WEB applications do not adequately verify whether requests come from trusted users. An attacker can exploit this vulnerability to sen...

CVE-2019-3409

All versions up to UKBBWF820+1.0.0B06 of ZTE WF820+ LTE Outdoor CPE product are impacted by command injection vulnerability. Due to inadequate parameter verification, unauthorized users can take advantage of this vulnerability to control the user terminal system...

CVE-2019-3410

All versions up to UKBBWF820+1.0.0B06 of ZTE WF820+ LTE Outdoor CPE product are impacted by Cross-Site Request Forgery vulnerability,which stems from the fact that WEB applications do not adequately verify whether requests come from trusted users. An attacker can exploit this vulnerability to sen...

CVE-2019-3410

Summary: CVE-2019-3410 affects the ZTE WF820+ LTE Outdoor CPE family, up to version UKBB_WF820+_1.0.0B06. The issue is Cross-Site Request Forgery, arising from web applications not adequately verifying the source of requests from trusted users, enabling an attacker to cause unintended server acti...

CVE-2019-3409

The CVE describes a command injection in ZTE WF820+ LTE Outdoor CPE, affecting UKBB_WF820+_1.0.0B06 and earlier. The root cause is inadequate input/data filtering when constructing executable commands, allowing an attacker to control the user terminal system. Several connected sources (NVD, CNVD,...

CVE-2019-3409

All versions up to UKBBWF820+1.0.0B06 of ZTE WF820+ LTE Outdoor CPE product are impacted by command injection vulnerability. Due to inadequate parameter verification, unauthorized users can take advantage of this vulnerability to control the user terminal system...

Docker Desktop Detection (Windows SMB Login)

SMB login-based detection of Docker Desktop. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Adobe Media Encoder Detection (Windows SMB Login)

Detects the installed version of Adobe Media Encoder. The script logs in via smb, searches for Adobe Media Encoder in the registry and gets the version from SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

Denial Of Service (DoS)

dnsmasq is vulnerable to denial of serviceDoS attacks. A remote user could send specially crafted DNS packets to cause the addpseudoheader function to allocate memory that is never freed, consuming excessive memory on the target system which leads application to crash.This issue only affects...