SUSE SLES12: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (SUSE-SU-2024:1205-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1205-1 advisory. - CVE-2024-24549: Fixed denial of service during header validation for HTTP/2 stream bsc1221386 - CVE-2024-23672: Fixed denial of...

SUSE SLES12: kernel-livepatch-5_3_18-150200_24_178-default / etc (SUSE-SU-2024:1207-1)

The remote SUSE Linux SLES12 / SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1207-1 advisory. This update for the Linux Kernel 4.12.14-122194 fixes one issue. The following security issue was fixed: - CVE-2023-52340: Fixed ICMPv6 Packet...

AlmaLinux 8 : bind9.16 (ALSA-2024:1781)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:1781 advisory. - The DNS message parsing code in named includes a section whose computational complexity is overly high. It does not cause problems for typical DNS...

SAP NetWeaver AS Java Information Disclosure (April 2024)

SAP NetWeaver Application Server for Java is affected by an information disclosure vulnerability. 'Self-Registration' and 'Modify your own profile' in User Admin Application of NetWeaver AS Java does not enforce proper security requirements for the content of the newly defined security answer. Th...

Oracle Linux 9 : unbound (ELSA-2024-1750)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-1750 advisory. - Ensure group access correction reaches also updated configs CVE-2024-1488 Tenable has extracted the preceding description block directly from the Oracle Linux...

Juniper Junos OS Vulnerability (JSA79171)

The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA79171 advisory. - An Improper Handling of Exceptional Conditions vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a Denia...

RHEL 8 : httpd:2.4/mod_http2 (RHSA-2024:1786)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:1786 advisory. The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: modhttp2: CONTINUATION...

CentOS 8 : unbound (CESA-2024:1751)

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:1751 advisory. - A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime...

Juniper Junos OS Vulnerability (JSA79183)

The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA79183 advisory. - An Improper Restriction of Excessive Authentication Attempts vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause ...

RHEL 7 : squid (RHSA-2024:1787)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1787 advisory. Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. Security Fixes: squid: deni...

FreeBSD : forgejo -- HTTP/2 CONTINUATION flood in net/http (c092be0e-f7cc-11ee-aa6b-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the c092be0e-f7cc-11ee-aa6b-b42e991fc52e advisory. - An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an...

SUSE SLES15 Security Update : kernel RT (Live Patch 8 for SLE 15 SP5) (SUSE-SU-2024:1184-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1184-1 advisory. This update for the Linux Kernel 5.14.21-1505001327 fixes several issues. The following security issues were fixed: - CVE-2024-0565: Fixed an...

SUSE SLES12 Security Update : xfig (SUSE-SU-2024:1196-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2024:1196-1 advisory. - CVE-2023-45920: Fixed NULL pointer dereference when calling XGetWMHints bsc1222057. Tenable has extracted the preceding description block...

PyMongo < 4.6.3 Out-of-bounds Read

Versions of the package pymongo before 4.6.3 are vulnerable to Out-of-bounds Read in the bson module. Using the crafted payload the attacker could force the parser to deserialize unmanaged memory. The parser tries to interpret bytes next to buffer and throws an exception with string. If the...

Juniper Junos OS Multiple Vulnerabilities (JSA79102)

The version of Junos OS installed on the remote host is affected by multiple vulnerabilities as referenced in the JSA79102 advisory. - An issue was discovered in libslax through v0.22.1. slaxLexer in slaxlexer.c has a stack-based buffer overflow. CVE-2021-39531 - An issue was discovered in libsla...

Juniper Junos OS Vulnerability (JSA75728)

The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA75728 advisory. - An Improper Input Validation vulnerability in Juniper Tunnel Driver jtd and ICMP module of Juniper Networks Junos OS Evolved allows an unauthenticated attacker within the...

Ubuntu 20.04 LTS / 22.04 LTS / 23.10 : Apache HTTP Server vulnerabilities (USN-6729-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6729-1 advisory. Orange Tsai discovered that the Apache HTTP Server incorrectly handled validating certain input. A remote attacker could possibly use...

SAP NetWeaver SSRF (April 2024)

SAP NetWeaver is affected by a server-side request forgery SSRF vulnerability. Due to insufficient input validation, SAP NetWeaver application tcesiespgrmgwshealthcheckear allows an unauthenticated attacker to send crafted requests from a vulnerable web application targeting internal systems behi...

PHP 8.3.x < 8.3.6 Multiple Vulnerabilities

The version of PHP installed on the remote host is prior to 8.3.6. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.3.6 advisory. - In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard...

SAP BusinessObjects Business Intelligence Platform Information Disclosure (3421384)

The version of SAP BusinessObjects Business Intelligence Platform installed on the remote Windows host is affected by an information disclosure vulnerability. Due to improper validation, SAP BusinessObject Business Intelligence Launch Pad allows an authenticated attacker to access operating syste...