VMware vCenter Update Manager Multiple Java Vulnerabilities (VMSA-2014-0012)

The version of VMware vCenter Update Manager installed on the remote Windows host is 5.1 prior to Update 3. It is, therefore, affected by multiple vulnerabilities related to the bundled version of Oracle JRE prior to 1.6.081. C Tenable Network Security, Inc. include"compat.inc"; if description...

Zarafa WebAccess Detection

The script sends a connection request to the server and attempts to extract the version number from the reply. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifie...

LogAnalyzer < 3.6.6 index.php / detail.php 'hostname' Parameter XSS

The LogAnalyzer install hosted on the remote web server is affected by a cross-site scripting vulnerability due to a failure to properly sanitize the 'hostname' value retrieved from log files. An attacker can exploit this issue to inject arbitrary HTML and script code into a user's browser to be...

Ruby 'REXML' Parser XEE Vulnerability (Nov 2014) - Windows

Ruby is prone to an XML entity expansion XEE vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:ruby-lang:ruby";...

ALLPlayer Detection (Windows SMB Login)

This script detects the installed version of ALLPlayer. The script logs in via smb, searches for ALLPlayer in the registry and gets the version from registry or file. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C...

Juniper Networks Junos OS Flowd DoS Vulnerability (JSA10650)

Juniper Networks Junos OS is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Cisco ASA Next-Generation Firewall GNU Bash Environment Variable Handling Command Injection (cisco-sa-20140926-bash) (Shellshock)

The remote ASA Next-Generation Firewall NGFW host is missing a security patch. It is, therefore, affected by a command injection vulnerability in GNU Bash known as Shellshock. The vulnerability is due to the processing of trailing strings after function definitions in the values of environment...

F5 Networks BIG-IP : Linux kernel vulnerability (SOL15732)

The translatedesc function in drivers/vhost/vhost.c in the Linux kernel before 3.7 does not properly handle cross-region descriptors, which allows guest OS users to obtain host OS privileges by leveraging Kernel-base Virtual Machine KVM guest OS privileges. C Tenable Network Security, Inc. The...

PHP 5.6.0 Multiple Vulnerabilities

According to its banner, the version of PHP installed on the remote host is a development version of 5.6.0. It is, therefore, affected by multiple vulnerabilities. Note that Nessus has not attempted to exploit this issue but has instead relied only on application's self-reported version number...

F5 Networks BIG-IP : TMM vulnerability (SOL13233)

The remote BIG-IP device is missing a patch required by a security advisory. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from F5 Networks BIG-IP Solution SOL13233. The text description of this plugin is C F5 Networks...

ManageEngine EventLog Analyzer Multiple Security Vulnerabilities

ManageEngine EventLog Analyzer is prone to an arbitrary file-upload vulnerability and an unauthorized-access vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Juniper Junos SRX Series Web Authentication XSS (JSA10640)

According to its self-reported version number, the remote Junos device is affected by a reflected cross site scripting vulnerability. An attacker can exploit this to steal sensitive information or session credentials from firewall users. Note that this issue only affects devices where Web...

Friendly-Tech FriendlyTR69 CPE Remote Management 2.8.9 - SQL Injection Vulnerability

No description provided by source...

WordPress Theme Method Arbitrary File Download Vulnerability

WordPress theme SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mysitemyway:method"; ifdescription...

openSUSE Security Update : libcap-ng (openSUSE-SU-2014:0736-1)

Besides other enhancements, this version update contains : - fix for CVE-2014-3215 bnc876832 - use PRSETNONEWPRIVS to prevent gain of new privileges - added libcap-ng-CVE-2014-3215.patch %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin we...

openSUSE Security Update : libvirt (openSUSE-SU-2011:0643-1)

A regression re-introduced automatic disk probing again which potentially allowed to uses to access arbitrary files CVE-2011-2178. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update libvirt-4712...

Microsoft SharePoint Designer Detection

Detects the installed version of Microsoft SharePoint Designer. The script logs in via smb, searches through the registry and gets the version and sets the KB. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

VLC Media Player Denial of Service Vulnerability (Mar 2014) - Mac OS X

VLC Media Player is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

JFrog Artifactory Detection (HTTP)

HTTP based detection of JFrog Artifactory. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

Fedora 20 : lighttpd-1.4.34-3.fc20 (2014-2495)

Enable building with PIE Latest upstream, multiple security fixes. http://www.lighttpd.net/2014/1/20/1-4-34/ Latest upstream, multiple security fixes. http://www.lighttpd.net/2014/1/20/1-4-34/ Note that Tenable Network Security has extracted the preceding description block directly from the Fedor...