Fedora 36 : tigervnc (2023-c41e8f24bb)

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-c41e8f24bb advisory. Tigervnc 1.13.1 update. CVE-2023-0494 tigervnc: xorg-x11-server: DeepCopyPointerClasses use-after-free leads to privilege elevation Tenable has...

Fedora 38 : stb (2023-815aa77986)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-815aa77986 advisory. Fix null pointer dereference in stbimage Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus h...

Scientific Linux Security Update : pesign on SL7.x x86_64 (2023:1093)

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2023:1093-1 advisory. - pesign: Local privilege escalation on pesign systemd service CVE-2022-3560 Note that Nessus has not tested for this issue but has instead relied only on...

Fedora 36 : kernel (2023-457955ce13)

The remote Fedora 36 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-457955ce13 advisory. The 6.1.12 stable kernel update contains a number of important fixes across the tree. Tenable has extracted the preceding description block directly from the...

SUSE CVE-2005-1158

Multiple "missing security checks" in Firefox before 1.0.3 allow remote attackers to inject arbitrary Javascript into privileged pages using the search target of the Firefox sidebar...

SUSE CVE-2008-1515

The SOAP interface in OTRS 2.1.x before 2.1.8 and 2.2.x before 2.2.6 allows remote attackers to "read and modify objects" via SOAP requests, related to "Missing security checks."...

Vulnerable to clickjacking

Description Vulnerable to clickjacking Proof of Concept 1 Create an iframe.html with below contents The iframe element 2 Open with firefox and note that the frame is loaded which is potential to clickjacking due to missing x-frame-options security headers...

AIX (IJ42677)

The version of AIX installed on the remote host is prior to APAR IJ42677. It is, therefore, affected by a vulnerability as referenced in the IJ42677 advisory. - IBM AIX 7.1, 7.2, 7.3 and VIOS , 3.1 could allow a non-privileged local user to exploit a vulnerability in X11 to cause a buffer overflo...

Oracle Linux 8 : expat (ELSA-2023-0103)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-0103 advisory. - lib: Prevent integer overflow in doProlog CVE-2022-23990Orabug: 33910314 - CVE-2022-43680 expat: use-after free caused by overeager destruction of a shared DT...

Mozilla Firefox Security Advisory (MFSA2021-33) - Mac OS X

This host is missing a security update for Mozilla Firefox. Copyright C 2023 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...

Amazon Linux 2022 : jdom, jdom-demo, jdom-javadoc (ALAS2022-2022-168)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-168 advisory. An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request. CVE-2021-33813 Tenable has extracted the preceding description block directly...

EspoCRM 安全漏洞

EspoCRM is an open source web-based customer relationship management CRM system. The system provides features such as sales automation, community and customer support. A security vulnerability exists in EspoCRM version 7.1.8 that stems from the presence of a missing security flag that allows...

RHEL 9 : thunderbird (RHSA-2022:4772)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:4772 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 91.9.1. Security Fixes: Mozilla:...

CVE-2022-2381

The E Unlocked - Student Result WordPress plugin through 1.0.4 is lacking CSRF and validation when uploading the School logo, which could allow attackers to make a logged in admin upload arbitrary files, such as PHP via a CSRF attack...

SUSE SLES12 Security Update : crash (SUSE-SU-2022:2319-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:2319-1 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. C Tenable, Inc...

RHEL 8 : squid:4 (RHSA-2022:5528)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:5528 advisory. Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. Security Fixes: squid: DoS when...

RHEL 9 : libxml2 (RHSA-2022:5250)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:5250 advisory. The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fixes: libxml2: integer overflows in...

CVE-2022-27220

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.0 SP2. Affected application is missing general HTTP security headers in the web server configured on port 6220. This could aid attackers by making the servers more prone to clickjacking, channel downgrade attacks...

Siemens SINEMA Remote Connect Server 安全特征问题漏洞

SINEMA Remote Connect is a remote network management platform that makes it easy to manage tunneled connections VPNs between headquarters, service technicians, and installed machines or plants.A standard security check implementation error vulnerability exists in Siemens SINEMA Remote Connect...

Security Updates for Microsoft Word Products C2R (July 2021)

The Microsoft Word Products are missing security updates. They are, therefore, affected by a remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. Note that Nessus has not tested for this issue but has instead relie...