SUSE SLED15: expat / libexpat-devel / libexpat-devel-32bit / libexpat1 / etc (SUSE-SU-2024:1129-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1129-1 advisory. - CVE-2023-52425: Fixed a DoS caused by processing large tokens. bsc1219559 - CVE-2024-28757:...

KB5036922: Windows Server 2008 R2 Security Update (April 2024)

The remote Windows host is missing security update 5036922. It is, therefore, affected by multiple vulnerabilities - Microsoft WDAC SQL Server ODBC Driver Remote Code Execution Vulnerability CVE-2024-26214 - Windows rndismp6.sys Remote Code Execution Vulnerability CVE-2024-26252, CVE-2024-26253 -...

SUSE SLED15: xen / xen-devel / xen-doc-html / xen-libs / xen-libs-32bit / etc (SUSE-SU-2024:1102-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1102-1 advisory. - CVE-2023-28746: Register File Data Sampling bsc1221332 - CVE-2024-2193: Fixed GhostRace, a...

SUSE SLES12 Security Update : indent (SUSE-SU-2024:1134-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2024:1134-1 advisory. - CVE-2024-0911: Fixed heap-based buffer overflow in setbufbreak bsc1219210. Tenable has extracted the preceding description block directly...

RHEL 7 : kernel (RHSA-2024:1249)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1249 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: CVE-2024-26602, ? kernel: use-after-fr...

RHEL 8 : nodejs:20 (RHSA-2024:1687)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1687 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language...

OpenSSL 1.1.1 < 1.1.1y Multiple Vulnerabilities

The version of OpenSSL installed on the remote host is prior to 1.1.1y. It is, therefore, affected by multiple vulnerabilities as referenced in the 1.1.1y advisory. - Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impac...

OpenSSL 3.2.0 < 3.2.2 Multiple Vulnerabilities

The version of OpenSSL installed on the remote host is prior to 3.2.2. It is, therefore, affected by multiple vulnerabilities as referenced in the 3.2.2 advisory. - Issue summary: Checking excessively long DSA keys or parameters may be very slow. Impact summary: Applications that use the function...

RHEL 9 : nodejs:20 (RHSA-2024:1688)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1688 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language...

SUSE SLES12: xen / xen-devel / xen-doc-html / xen-libs / xen-libs-32bit / etc (SUSE-SU-2024:1105-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1105-1 advisory. - CVE-2023-28746: Register file data sampling. bsc1221332 - CVE-2024-2193: Fixed GhostRace, a speculative race conditions. bsc12213...

Debian dla-3780 : jetty9 - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3780 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3780-1 [email protected] https://www.debian.org/lts/security/...

Cisco Identity Services Engine XSRF (cisco-sa-ise-csrf-NfAKXrp5)

According to its self-reported version, Cisco Identity Services Engine Cross-Site Request Forgery is affected by a vulnerability. - A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to conduct a cross-site...

OracleVM 3.4 : kernel-uek (OVMSA-2024-0004)

The remote OracleVM system is missing necessary patches to address security updates: - A flaw was found in the XFRM subsystem in the Linux kernel. The specific flaw exists within the processing of state filters, which can result in a read past the end of an allocated buffer. This flaw allows a...

Rocky Linux 9 : ruby:3.1 (RLSA-2024:1576)

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:1576 advisory. - The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that...

Rocky Linux 8 : opencryptoki (RLSA-2024:1608)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2024:1608 advisory. - A timing side-channel vulnerability has been discovered in the opencryptoki package while processing RSA PKCS1 v1.5 padded ciphertexts. This flaw could...

Node.js 18.x < 18.20.1 / 20.x < 20.12.1 / 21.x < 21.7.2 Multiple Vulnerabilities (Wednesday, April 3, 2024 Security Releases).

The version of Node.js installed on the remote host is prior to 18.20.1, 20.12.1, 21.7.2. It is, therefore, affected by multiple vulnerabilities as referenced in the Wednesday, April 3, 2024 Security Releases advisory. - An attacker can make the Node.js HTTP/2 server completely unavailable by...

Rocky Linux 8 : grafana (RLSA-2024:1646)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2024:1646 advisory. - A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled...

Rocky Linux 8 : curl (RLSA-2024:1601)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:1601 advisory. - An information disclosure vulnerability exists in curl v8.1.0 when doing HTTPS transfers, libcurl might erroneously use the read callback...

Cisco Access Points Managed from WLC DoS (cisco-sa-ap-dos-h9TGGX6W)

According to its self-reported version, Cisco access points managed by this Cisco Wireless LAN Controller are affected by a denial of service vulnerability. Due to insufficient input validation of certain IPv4 packets, an unauthenticated, remote attacker can causing attached access points to relo...

Ivanti Policy Secure 9.x / 22.x Multiple Vulnerabilities (CVE-2024-21894)

The Ivanti Policy Secure installed on the remote host is 9.x or 22.x. It is, therefore, affected by multiple vulnerabilities: - A heap overflow vulnerability in IPSec component of Ivanti Connect Secure 9.x, 22.x and Ivanti Policy Secure allows an unauthenticated malicious user to send specially...