RHEL 9 : skopeo (RHSA-2023:6363)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6363 advisory. The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and...

Fedora 39 : mosquitto (2023-9adc4be8b0)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-9adc4be8b0 advisory. 2.0.17 Broker: Fix maxqueuedmessages 0 stopping clients from receiving messages Fix maxinflightmessages not being set correctly. Apps: Fix...

RHEL 9 : containernetworking-plugins (RHSA-2023:6402)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:6402 advisory. The Container Network Interface CNI project consists of a specification and libraries for writing plug- ins for configuring network interfac...

Fedora 39 : htmltest (2023-946dfaf17f)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-946dfaf17f advisory. Security fix for CVE-2022-41717 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus h...

Fedora 39 : golang-honnef-tools (2023-65f2712f28)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-65f2712f28 advisory. Automatic update for golang-honnef-tools-2023.1.3-1.20230802git0e3cc29.fc39. Changelog Wed Aug 2 2023 Mikel Olasagasti Uranga - 2023.1.3-1 - Update to 2023.1...

Fedora 39 : golang-github-cloudflare-cfssl (2023-b1cebc5424)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-b1cebc5424 advisory. Automatic update for golang-github-cloudflare-cfssl-1.6.4-1.fc39. Changelog Wed Jun 28 2023 Mikel Olasagasti Uranga - 1.6.4-1 - Update to 1.6.4 - Closes...

Fedora 39 : exercism (2023-e16469fdec)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-e16469fdec advisory. Update to latest version 2228145 Security fix for CVE-2022-3064, CVE-2022-41717 Tenable has extracted the preceding description block directly from...

CVE-2023-4625

Improper Restriction of Excessive Authentication Attempts vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F/iQ-R Series CPU modules Web server function allows a remote unauthenticated attacker to prevent legitimate users from logging into the Web server function for a certain period...

Rocky Linux 8 : libcroco (RLSA-2020:3654)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2020:3654 advisory. - libcroco through 0.6.13 has excessive recursion in crparserparseanycore in cr-parser.c, leading to stack consumption. CVE-2020-12825 Note that Nessus has not...

The vulnerability of the Request Tracker system for enterprise-level request tracking and monitoring lies in its excessive data output when searching transactions by authenticated users in the transaction builder. This allows attackers to gain unauthorized access to confidential information.

The vulnerability of the Request Tracker system for enterprise-level order tracking and monitoring exists due to excessive data output by the application when searching transactions for authenticated users in the transaction request builder. Exploiting this vulnerability could allow a malicious...

CVE-2023-41350 Chunghwa Telecom NOKIA G-040W-Q - Excessive Authentication Attempts

Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of insufficient measures to prevent multiple failed authentication attempts. An unauthenticated remote attacker can execute a crafted Javascript to expose captcha in page, making it very easy for bots to bypass the captcha check and more...

CVE-2023-41350 Chunghwa Telecom NOKIA G-040W-Q - Excessive Authentication Attempts

Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of insufficient measures to prevent multiple failed authentication attempts. An unauthenticated remote attacker can execute a crafted Javascript to expose captcha in page, making it very easy for bots to bypass the captcha check and more...

Amazon Linux 2 : cni-plugins (ALAS-2023-2325)

The version of cni-plugins installed on the remote host is prior to 1.2.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2325 advisory. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams...

CVE-2023-5754 Improper Restriction of Excessive Authentication Attempts in Sielco PolyEco1000

Sielco PolyEco1000 uses a weak set of default administrative credentials that can be easily guessed in remote password attacks and gain full control of the system...

Denial Of Service (DoS)

Mattermost is vulnerable to Denial of Service DoS. The vulnerability is due to the /api/v4/users/ids endpoint which lacks a duplicate id check. This allows an attacker to send a request with multiple identical IDs which can consume excessive resources...

HTTP/2 rapid reset can cause excessive work in net/http

...

Ubuntu 16.04 ESM : libjpeg9 vulnerabilities (USN-5336-1)

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5336-1 advisory. Aladdin Mubaied discovered that the cjpeg utility in libjpeg9 did not properly validate the input image's size. An attacker could possibly use this issue...

Ubuntu 16.04 ESM : Libjpeg6b vulnerabilities (USN-5497-2)

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5497-2 advisory. USN-5497-1 fixed vulnerabilities in Libjpeg6b. This update provides the corresponding updates for Ubuntu 16.04 ESM. Tenable has extracted the preceding...

Important: Red Hat Security Advisory: Red Hat OpenStack Platform 16.2.5 (collectd-libpod-stats) security update

An update for collectd-libpod-stats is now available for Red Hat OpenStack Platform 16.2.5 Train. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...

Amazon Linux 2 : containerd (ALASNITRO-ENCLAVES-2023-031)

The version of containerd installed on the remote host is prior to 1.6.19-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2NITRO-ENCLAVES-2023-031 advisory. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset...