RHEL 7 : rh-nodejs14 (RHSA-2024:1354)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:1354 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes...

Amazon Linux 2 : ipa (ALAS-2024-2498)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2498 advisory. A flaw was found in FreeIPA. This issue may allow a remote attacker to craft a HTTP request with parameters that can be interpreted as command arguments to kinit on the FreeIPA server, which can lead to a...

Amazon Linux 2 : tomcat (ALASTOMCAT9-2024-012)

The version of tomcat installed on the remote host is prior to 9.0.83-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2TOMCAT9-2024-012 advisory. Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through...

Fedora 39 : freeimage / mingw-freeimage (2024-c0b61ab46b)

The remote Fedora 39 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2024-c0b61ab46b advisory. Add downstream fixes for CVE-2023-47995 and CVE-2023-47997. Tenable has extracted the preceding description block directly from the Fedora security...

AlmaLinux 9 : dnsmasq (ALSA-2024:1334)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:1334 advisory. - Certain DNSSEC aspects of the DNS protocol in RFC 4033, 4034, 4035, 6840, and related RFCs allow remote attackers to cause a denial of service CPU...

Amazon Linux 2 : apache-commons-compress (ALAS-2024-2493)

The version of apache-commons-compress installed on the remote host is prior to 1.5-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2493 advisory. Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Commons Compress.This issue affects Apac...

Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-6699-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6699-1 advisory. Reima Ishii discovered that the nested KVM implementation for Intel x86 processors in the Linux kernel did not properly validate control registers in...

Cisco Unified IP Phones 7900 Permissions, Privileges, and Access Controls (CVE-2011-1602)

The su utility on Cisco Unified IP Phones 7900 devices aka TNP phones with software before 9.0.3 allows local users to gain privileges via unspecified vectors, aka Bug ID CSCtf07426. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more...

RHEL 7 / 8 / 9 : Red Hat JBoss Web Server 5.7.8 (RHSA-2024:1318)

The remote Redhat Enterprise Linux 7 / 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1318 advisory. Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of...

Apple iTunes < 12.13.1 A Vulnerability (credentialed check)

The version of Apple iTunes installed on the remote Windows host is prior to 12.13.1. It is, therefore, affected by a vulnerability as referenced in the HT214091 advisory. - A logic issue was addressed with improved checks. This issue is fixed in iTunes 12.13.1 for Windows. A local attacker may b...

Amazon Linux 2 : libpq (ALASPOSTGRESQL14-2024-010)

The version of libpq installed on the remote host is prior to 14.8-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2POSTGRESQL14-2024-010 advisory. In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos...

Amazon Linux 2 : pcs (ALAS-2024-2492)

The version of pcs installed on the remote host is prior to 0.9.169-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2492 advisory. A Denial of Service DoS vulnerability was found in rubygem-rack in how it parses Content-Type. Carefully crafted content typ...

Amazon Linux 2 : ruby (ALAS-2024-2503)

The version of ruby installed on the remote host is prior to 2.0.0.648-36. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2503 advisory. The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant ...

FreeBSD : amavisd-new -- multipart boundary confusion (0a48e552-e470-11ee-99b3-589cfc0f81b0)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 0a48e552-e470-11ee-99b3-589cfc0f81b0 advisory. - The Amavis project reports: Emails which consist of multiple parts Content-Type: multipart/ incorpora...

Amazon Linux 2 : grub2 (ALAS-2024-2499)

The version of grub2 installed on the remote host is prior to 2.06-14. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2499 advisory. A flaw was found in the grub2-set-bootflag utility of grub2. After the fix of CVE-2019-14865, grub2-set- bootflag will create a...

RHEL 8 : postgresql:10 (RHSA-2024:1348)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:1348 advisory. PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: non-owner 'REFRESH MATERIALIZED VIEW...

Fedora 38 : freeimage / mingw-freeimage (2024-e6a35cd250)

The remote Fedora 38 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2024-e6a35cd250 advisory. Add downstream fixes for CVE-2023-47995 and CVE-2023-47997. Tenable has extracted the preceding description block directly from the Fedora security...

SUSE SLES12 Security Update : spectre-meltdown-checker (SUSE-SU-2024:0885-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2024:0885-1 advisory. - updated to 0.46 This release mainly focuses on the detection of the new Zenbleed CVE-2023-20593 vulnerability, among few other changes tha...

SUSE SLES12 Security Update : python36-pip (SUSE-SU-2024:0892-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2024:0892-1 advisory. - CVE-2023-5752: Fixed possible injection of arbitrary configuration through Mercurial parameter. bsc1217353 Tenable has extracted the...

SUSE SLES15 Security Update : sudo (SUSE-SU-2024:0889-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:0889-1 advisory. - CVE-2023-42465: Fixed issues introduced by first patches bsc1221151, bsc1221134. Tenable has extracted the preceding description block...