Cisco IoT Field Network Director Missing API Authentication (cisco-sa-FND-APIA-xZntFS2V)

A Rest API vulnerability exists in Cisco IoT Field Network Director IoT-FND due to IoT-FND not properly authenticating REST API calls. An unauthenticated, remote attacker can exploit this, by sending API requests to an affected system, to view sensitive information on the affected system, includi...

Cisco IoT Field Network Director Unauthenticated REST API (cisco-sa-FND-BCK-GHkPNZ5F)

A Rest API vulnerability exists in Cisco IoT Field Network Director IoT-FND due to IoT-FND not properly authenticating REST API calls. An unauthenticated, remote attacker can exploit this, by obtaining a cross-site request forgery CSRF token and then using the token with REST API requests, to...

RHEL 6 : chromium-browser (RHSA-2020:5165)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:5165 advisory. Chromium is an open-source web browser, powered by WebKit Blink. This update upgrades Chromium to version 86.0.4240.198. Security Fixes:...

Intel Converged Security Management Engine (CSME) Active Management Technology (AMT) Multiple Vulnerabilities (INTEL-SA-00391)

Binary data wmiINTEL-SA-00391.nbin...

Intel Active Management Technology (AMT) Multiple Vulnerabilities (INTEL-SA-00391) (remote check)

The Intel Management Engine on the remote host has Active Management Technology AMT enabled, and, according to its self-reported, is a version containing multiple vulnerabilities, including the following: - Out-of-bounds write in IPv6 subsystem for IntelR AMT, IntelR ISM versions before 11.8.80,...

Drupal 7.x < 7.74 / 8.x < 8.8.11 / 8.9.x < 8.9.9 / 9.0.x < 9.0.8 RCE (SA-CORE-2020-012)

According to its self-reported version, the instance of Drupal running on the remote web server is 7.x prior to 7.74, 8.x prior to 8.8.11, 8.9.x prior to 8.9.9, or 9.0.x prior to 9.0.8. It is, therefore, affected by a remote code execution vulnerability in its file upload functionality due to a...

Amazon Linux AMI : libtiff (ALAS-2020-1447)

The version of libtiff installed on the remote host is prior to 4.0.3-35.36. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1447 advisory. TIFFCheckMalloc and TIFFCheckRealloc in tifaux.c in LibTIFF through 4.0.10 mishandle Integer Overflow checks because th...

Amazon Linux AMI : python27, python34, python35 (ALAS-2020-1454)

The version of python27 installed on the remote host is prior to 2.7.18-2.140. The version of python34 installed on the remote host is prior to 3.4.10-1.53. The version of python35 installed on the remote host is prior to 3.5.10-1.29. It is, therefore, affected by a vulnerability as referenced in...

Amazon Linux AMI : mod24_auth_openidc (ALAS-2020-1448)

The version of mod24authopenidc installed on the remote host is prior to 1.8.8-7.6. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1448 advisory. An open redirect flaw was discovered in modauthopenidc, where it handles logout redirection. The module does not...

RHEL 8 : libreoffice (RHSA-2020:1598)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1598 advisory. LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor...

Oracle Linux 6 : microcode_ctl (ELSA-2020-5084)

The remote Oracle Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-5084 advisory. - Update Intel CPU microcode to microcode-20201027 release, addresses CVE-2020-8694, CVE-2020-8695, CVE-2020-8696, CVE-2020-8698 1893243, 1893238: -...

Oracle Linux 8 : microcode_ctl (ELSA-2020-5085)

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-5085 advisory. - Update Intel CPU microcode to microcode-20201027 release, addresses CVE-2020-8694, CVE-2020-8695, CVE-2020-8696, CVE-2020-8698 1893265, 1893253,...

Mozilla Firefox ESR < 78.5

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 78.5. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-51 advisory. - Mozilla developers Steve Fink, Jason Kratzer, Randell Jesup, Christian Holler, and Byron Campen reported...

Palo Alto Networks PAN-OS 8.1.x < 8.1.17 / 9.0.x < 9.0.11 / 9.1.x < 9.1.5 / 10.0.x < 10.0.1 Authentication Bypass Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is 8.1.x prior to 8.1.17 or 9.0.x prior to 9.0.11 or 9.1.x prior to 9.1.5 or 10.0.x prior to 10.0.1. It is, therefore, affected by a vulnerability. - An authentication bypass vulnerability exists in the GlobalProtect SSL VPN...

Zimbra Collaboration Server 9.x < 9.0.0 P2 XSS

According to its self-reported version number, Zimbra Collaboration Server is 9.x prior to 9.0.0 Patch 2. It is, therefore, affected by a cross-site scripting XSS vulnerability in the web client. An unauthenticated, remote attacker can exploit this, by convincing a user to click a specially craft...

Palo Alto Networks PAN-OS 8.1.x < 8.1.17 / 9.0.x < 9.0.11 / 9.1.x < 9.1.2 Information Exposure Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is 8.1.x prior to 8.1.17 or 9.0.x prior to 9.0.11 or 9.1.x prior to 9.1.2. It is, therefore, affected by a vulnerability. - An information exposure through log file vulnerability exists where the password for the configured syste...

Palo Alto Networks PAN-OS 7.1.x < 8.1.17 / 8.x < 8.1.17 / 9.0.x < 9.0.11 / 9.1.x < 9.1.5 Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is 7.1.x prior to 8.1.17 or 8.0.x prior to 8.1.17 or 8.1.x prior to 8.1.17 or 9.0.x prior to 9.0.11 or 9.1.x prior to 9.1.5. It is, therefore, affected by a vulnerability. - A vulnerability exists in the Palo Alto Network PAN-OS...

Palo Alto Networks PAN-OS 8.1.x < 8.1.16 / 9.0.x < 9.0.10 / 9.1.x < 9.1.4 / 10.0.x < 10.0.1 Command Injection Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is 8.1.x prior to 8.1.16 or 9.0.x prior to 9.0.10 or 9.1.x prior to 9.1.4 or 10.0.x prior to 10.0.1. It is, therefore, affected by a vulnerability. - An OS command injection and memory corruption vulnerability in the PAN-OS...

Oracle Linux 8 : oniguruma (ELSA-2020-4827)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-4827 advisory. 6.8.2-2 - Fix CVE-2019-13225 Resolves: 1771052 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that...

Oracle Linux 8 : oddjob (ELSA-2020-4687)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-4687 advisory. 0.34.5-3 - Support HOMEMODE from /etc/login.defs Resolves: rhbz1886362 0.34.5-2 - Add gating tests using idm:DL1 module stream and upstream tests Resolves:...