Tenable Nessus < 10.8.4 Privilege Escalation (TNS-2025-05)

According to its self-reported version, the Tenable Nessus application running on the remote host is prior to 10.8.4. It is, therefore, affected by a vulnerability as referenced in the TNS-2025-05 advisory. - When installing Nessus to a non-default location on a Windows host, Nessus versions prio...

Fedora 41 : prometheus-podman-exporter (2025-b0915f0a19)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-b0915f0a19 advisory. release v1.16.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested fo...

CVE-2025-24914

Nessus on Windows installed to a non-default location is affected by CVE-2025-24914. Prior to version 10.8.4, Nessus did not enforce secure permissions on sub-directories within non-default installation paths, enabling local privilege escalation if those directories were not secured. The issue ha...

Next.js 11.1.4 < 12.3.5 Authorization Bypass

The version of Next.js installed on the remote host is 11.1.4 prior to 12.3.5, 13.0.x prior to 13.5.9, 14.x prior to 14.2.25 or 15.x prior to 15.2.3. It is, therefore, affected by Authorization Bypass if the authorization check occurs in middleware. Note that the scanner has not attempted to...

Moodle 3.11.x < 3.11.15 Multiple Vulnerabilities

According to its self-reported version, the Moodle install hosted on the remote host is prior to 3.9.22, 3.11.x prior to 3.11.15, 4.0.x prior to 4.0.9 or 4.1.x prior to 4.1.4. It is, therefore, affected by multiple vulnerabilities. - An issue in the logic used to check 0.0.0.0 against the cURL...

Ubuntu 24.04 LTS / 24.10 : Linux kernel vulnerabilities (USN-7379-1)

"The remote Ubuntu 24.04 LTS / 24.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7379-1 advisory. Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects...

Google Chrome < 134.0.6998.177 Vulnerability

The version of Google Chrome installed on the remote Windows host is prior to 134.0.6998.177. It is, therefore, affected by a vulnerability as referenced in the 202503stable-channel-update-for-desktop25 advisory. - Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on...

Huawei EulerOS: Security Advisory for haproxy (EulerOS-SA-2025-1297)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Linux Distros Unpatched Vulnerability : CVE-2024-6221

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability in corydolphin/flask-cors version 4.0.1 allows the Access-Control-Allow-Private-Network CORS header to be set to true by default. This behavior...

Linux Distros Unpatched Vulnerability : CVE-2025-21613

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5.1...

Linux Distros Unpatched Vulnerability : CVE-2024-50136

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Unregister notifier on eswitch init failure It otherwise remains registered and a...

Linux Distros Unpatched Vulnerability : CVE-2024-56725

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: handle otx2mboxgetrsp errors in otx2dcbnl.c Add error pointer check after...

Linux Distros Unpatched Vulnerability : CVE-2024-50211

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - udf: refactor inodebmap to handle error Refactor inodebmap to handle error since udfnextaext can return error now. On situations like ftruncate, udfextendfile c...

Linux Distros Unpatched Vulnerability : CVE-2024-24792

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Parsing a corrupt or malicious image with invalid color indices can cause a panic. CVE-2024-24792 Note that Nessus relies on the presence of the package as...

Linux Distros Unpatched Vulnerability : CVE-2024-26637

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: rely on mac80211 debugfs handling for vif mac80211 started to delete debugfs...

Linux Distros Unpatched Vulnerability : CVE-2022-49347

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ext4: fix bugon in ext4writepages we got issue as follows: EXT4-fs error device loop0: ext4mbgeneratebuddy:1141: group 0, block bitmap and bg descriptor...

Linux Distros Unpatched Vulnerability : CVE-2023-38324

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in OpenNDS before 10.1.2. It allows users to skip the splash page sequence and directly authenticate when it is using the default FAS ke...

Linux Distros Unpatched Vulnerability : CVE-2023-31124

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build system, CARESRANDOMFILE will not be set, as seen when cros...

Linux Distros Unpatched Vulnerability : CVE-2024-42272

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: sched: actct: take care of padding in struct zoneshtkey Blamed commit increased lookup key...

Linux Distros Unpatched Vulnerability : CVE-2024-44987

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv6: prevent UAF in ip6sendskb syzbot reported an UAF in ip6sendskb 1 After ip6localout has returned, we no longer can safely dereference rt, unless we hold...