Keycloak < 24.0.5 Unauthorized Access (CVE-2024-3656)

In Keycloak prior to 24.0.5, users with low privileges just plain users in the realm are able to utilize administrative functionalities within Keycloak admin interface. This issue presents a significant security risk as it allows unauthorized users to perform actions reserved for administrators,...

Fedora 39 : cyrus-imapd (2024-123f2b3666)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-123f2b3666 advisory. - Security fix for CVE-2024-34055 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus...

Oracle Linux 8 / 9 : Unbreakable Enterprise kernel (ELSA-2024-12433)

The remote Oracle Linux 8 / 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-12433 advisory. - x86/staticcall: Add support for Jcc tail-calls Peter Zijlstra CVE-2022-29901 CVE-2022-23816 Tenable has extracted the preceding description block directl...

Fedora 39 : python-jinja2 (2024-ce7649d28e)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-ce7649d28e advisory. Update to 3.1.4 rhbz2279211,rhbz2279491 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus ha...

GNOME Shell <= 45.7 Code Execution in Portal Helper (CVE-2024-36472)

In GNOME Shell through 45.7, a portal helper can be launched automatically without user confirmation based on network responses provided by an adversary e.g., an adversary who controls the local Wi-Fi network, and subsequently loads untrusted JavaScript code, which may lead to resource consumptio...

CentOS 8 : perl-Convert-ASN1 (CESA-2024:3049)

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2024:3049 advisory. - perl-Convert-ASN1 aka the Convert::ASN1 module for Perl through 0.27 allows remote attackers to cause an infinite loop via unexpected input. CVE-2013-7488 Not...

CentOS 8 : traceroute (CESA-2024:3211)

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2024:3211 advisory. - In buc Traceroute 2.0.12 through 2.1.2 before 2.1.3, the wrapper scripts do not properly parse command lines. CVE-2023-46316 Note that Nessus has not tested f...

RHEL 6 : bluetooth (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - bluetooth: Method Confusion Pairing Vulnerability in LE Secure Connections and BR/EDR Secure Simple Pairing...

RHEL 7 : python-tornado (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - python-tornado: open redirect vulnerability in StaticFileHandler under certain configurations CVE-2023-28370 Note...

RHEL 7 : perl-crypt-openssl-rsa (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - perl-Crypt-OpenSSL-RSA: side-channel attack in PKCS1 v1.5 padding mode Marvin Attack CVE-2024-2467 Note that Nessus...

RHEL 6 : python-reportlab (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - python-reportlab: code injection in paraparser.py allows code execution CVE-2019-19450 - python-reportlab...

RHEL 6 : oddjob (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - oddjob: race condition in oddjobselinuxmkdir function in mkhomedir.c can lead to symlink attack CVE-2020-10737 Note...

RHEL 6 : jdbc-postgresql (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - jdbc-postgresql: Unchecked Class Instantiation when providing Plugin Classes CVE-2022-21724 Note that Nessus has no...

RHEL 7 : minicom (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - minicom: Out of bounds write in vt100.c CVE-2017-7467 Note that Nessus has not tested for this issue but has instea...

RHEL 5 : vim_neovim (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - vim/neovim: ':source!' command allows arbitrary command execution via modelines CVE-2019-12735 Note that Nessus has...

RHEL 8 : nodejs-kind-of (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - nodejs-kind-of: ctorName in index.js allows external user input to overwrite certain internal attributes...

RHEL 6 : alpaca (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - ALPACA: Application Layer Protocol Confusion - Analyzing and Mitigating Cracks in TLS Authentication CVE-2021-3618...

RHEL 7 : libxcursor (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - libXcursor: file.c: heap-based buffer overflow when reading/creating images CVE-2017-16612 Note that Nessus has not...

RHEL 5 : xsa240_xen (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - xsa240 xen: Unlimited recursion in linear pagetable de-typing XSA-240 CVE-2017-15595 Note that Nessus has not teste...

RHEL 5 : xsa226_xen (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - xsa226 xen: possibly unbounded recursion in grant table code XSA-226 CVE-2017-12135 Note that Nessus has not tested...