Apple iTunes < 12.12 Multiple Vulnerabilities (credentialed check)

The version of Apple iTunes installed on the remote Windows host is prior to 12.12. It is, therefore, affected by multiple vulnerabilities as referenced in the HT212817 advisory. - Processing a maliciously crafted image may lead to arbitrary code execution CVE-2021-30835, CVE-2021-30847 -...

Amazon Linux AMI : containerd (ALAS-2021-1540)

The version of containerd installed on the remote host is prior to 1.4.6-3.9. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1540 advisory. A bug was found in containerd where container root directories and some plugins had insufficiently restricted permissions,...

Amazon Linux AMI : docker (ALAS-2021-1537)

The version of docker installed on the remote host is prior to 20.10.7-3.71. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1537 advisory. A bug was found in Moby Docker Engine where attempting to copy files using docker cp into a specially- crafted containe...

Debian DLA-2777-1 : tiff - LTS security update

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2777 advisory. Two security issues were found in TIFF, a widely used format for storing image data, as follows: CVE-2020-19131 Buffer Overflow in LibTiff allows attackers to caus...

Microsoft Edge (Chromium) < 94.0.992.38 Multiple Vulnerabilities

The version of Microsoft Edge installed on the remote Windows host is prior to 94.0.992.38. It is, therefore, affected by multiple vulnerabilities as referenced in the October 1, 2021 advisory. - Use after free in V8 in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to potentially...

Dell EMC NetWorker 18.x / 19.x < 19.4.0.4 Multiple Vulnerabilities (DSA-2021-124)

The version of Dell EMC NetWorker installed on the remote Windows host is 18.x or 19.x prior to 19.4.0.4. It is, therefore, affected by multiple vulnerabilities, as follows: - Dell NetWorker, versions 18.x and 19.x contain a Path traversal vulnerability. A NetWorker server user with remote access...

Dell SupportAssist < 3.10 Multiple Vulnerabilities (DSA-2021-163)

According to its self-reported version number, the version of Dell SupportAssist Client Consumer is prior to 3.10. It is, therefore, affected by multiple vulnerabilities. - An arbitrary file deletion vulnerability exists due to how Dell SupportAssist handles symbolic links and NTFS junction point...

AMD Platform Security Processor (PSP) Chipset Driver Information Disclosure (AMD-SB-1009)

The version of the AMD Platform Security Processor PSP chipset driver found on the remote host is prior to 5.17.0.0. It is, therefore, affected by an information disclosure vulnerability. The discretionary access control list DACL may allow low privileged users to open a handle and send requests ...

Ubuntu 18.04 LTS / 20.04 LTS : Apache Commons IO vulnerability (USN-5095-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-5095-1 advisory. It was discovered that Apache Commons IO incorrectly handled certain inputs. An attacker could possibly use this issue to expose sensitive information...

SUSE SLED15: postgresql12 / postgresql12-contrib / postgresql12-devel / etc (SUSE-SU-2021:3256-1)

The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:3256-1 advisory. - CVE-2021-3677: Fixed memory disclosure in certain queries bsc1189748. - Fixed build with llvm12 on s390x bsc1185952. - Re-enabled icu for...

Amazon Linux 2 : kernel (ALAS-2021-1699)

The version of kernel installed on the remote host is prior to 4.14.243-185.433. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1699 advisory. A flaw was found in the Linux kernel's KVM implementation, where improper handing of the VMIO|VMPFNMAP VMAs in KVM bypasses...

openSUSE 15 Security Update : nodejs14 (openSUSE-SU-2021:1313-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1313-1 advisory. - nodejs: Use-after-free on close http2 on stream canceling CVE-2021-22930 - Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to...

openSUSE 15 Security Update : grilo (openSUSE-SU-2021:3194-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:3194-1 advisory. - In GNOME grilo though 0.3.13, grl-net-wc.c does not enable TLS certificate verification on the SoupSessionAsync objects it creates, leaving users...

Microsoft Edge (Chromium) < 94.0.992.31 Multiple Vulnerabilities

The version of Microsoft Edge installed on the remote Windows host is prior to 94.0.992.31. It is, therefore, affected by multiple vulnerabilities as referenced in the September 24, 2021 advisory. - Use after free in Portals in Google Chrome prior to 94.0.4606.61 allowed a remote attacker who had...

Tenable SecurityCenter OpenSSL < 1.1.1l Multiple Vulnerabilities (TNS-2021-16)

According to its self-reported version, the Tenable SecurityCenter application installed on the remote host is missing the security patch SC-202109.1, therefore affected by multiple vulnerabilities as referenced in the 1.1.1l advisory: - A heap-based buffer overflow condition exists due to the...

Oracle Linux 7 / 8 : Unbreakable Enterprise kernel-container (ELSA-2021-9461)

The remote Oracle Linux 7 / 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-9461 advisory. 5.4.17-2102.205.7.3.el7 - btrfs: fix NULL pointer dereference when deleting device by invalid id Qu Wenruo Orabug: 33281078 CVE-2021-3739 Tenable has...

Debian DSA-4976-1 : wpewebkit - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-4976 advisory. The following vulnerabilities have been discovered in the wpewebkit web engine: CVE-2021-30858 An anonymous researcher discovered that processing maliciously crafted web...

Oracle Linux 8 : curl (ELSA-2021-3582)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-3582 advisory. - fix bad connection reuse due to flawed path name checks CVE-2021-22924 Tenable has extracted the preceding description block directly from the Oracle...

Oracle Linux 7 : Unbreakable Enterprise kernel-container (ELSA-2021-9458)

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2021-9458 advisory. - Bluetooth: defer cleanup of resources in hciunregisterdev Tetsuo Handa Orabug: 33369947 CVE-2021-3573 - Bluetooth: fix the erroneous flushwork order...

VMware vCenter Server < 7.0 U2d Multiple Vulnerabilities (VMSA-2021-0020)

The version of VMware vCenter Server installed on the remote host is prior to 7.0 U2d. It is, therefore, affected by multiple vulnerabilities: - An unauthenticated API endpoint vulnerability exists in the vCenter Server Content Library. An unauthenticated, remote attacker can exploit this to...