Oracle Linux 9 : curl (ELSA-2024-1129)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-1129 advisory. 7.76.1-26.el93.3 - cap SFTP packet size sent RHEL-14697 - lowercase the domain names before PSL checks CVE-2023-46218 Tenable has extracted the preceding...

RHEL 8 : openvswitch3.1 (RHSA-2024:1235)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1235 advisory. Open vSwitch provides standard network bridging functions and support for the OpenFlow protocol for remote per-flow control of traffic...

Golang < 1.33.0 DOS

The version of Golang running on the remote host is prior to 1.33.0. It is, therefore, is affected by a Denial of Service vulnerability. A maliciously crafted file could could cause the protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This...

CBL Mariner 2.0 Security Update: kernel (CVE-2013-6381)

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2013-6381 advisory. - Buffer overflow in the qethsnmpcommand function in drivers/s390/net/qethcoremain.c in the Linux kernel throug...

OracleVM 3.4 : kernel-uek (OVMSA-2024-0003)

The remote OracleVM system is missing necessary patches to address security updates: - An issue was discovered in drivers/input/input.c in the Linux kernel before 5.17.10. An attacker can cause a denial of service panic because inputsetcapability mishandles the situation in which an event code...

Foxit PDF Reader for Mac < 2024.1 Multiple Vulnerabilities

According to its version, the Foxit PDF Reader for Mac application previously named Foxit Reader for Mac installed on the remote macOS host is prior to 2024.1. It is, therefore affected by multiple vulnerabilities: Note that Nessus has not tested for this issue but has instead relied only on the...

FreeBSD : go -- multiple vulnerabilities (b1b039ec-dbfc-11ee-9165-901b0e9408dc)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the b1b039ec-dbfc-11ee-9165-901b0e9408dc advisory. - When following an HTTP redirect to a domain which is not a subdomain match or exact match of...

Debian dla-3753 : yard - security update

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3753 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3753-1 [email protected]...

Oracle Linux 9 : skopeo (ELSA-2024-1149)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-1149 advisory. 2:1.13.3-4 - Rebuild with golang 1.20.12: golang:net/http/internal: Denial of Service DoS via Resource Consumption via HTTP requests CVE-2023-39326 Tenable has...

AlmaLinux 9 : keylime (ALSA-2024:1139)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:1139 advisory. - A flaw was found in the keylime attestation verifier, which fails to flag a device's submitted TPM quote as faulty when the quote's signature does not validate f...

FreeBSD : chromium -- multiple security fixes (fd3401a1-b6df-4577-917a-2c22fee99d34)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the fd3401a1-b6df-4577-917a-2c22fee99d34 advisory. - Out of bounds memory access in V8 in Google Chrome prior to 122.0.6261.111 allowed a remote...

SUSE SLES12: libpython3_4m1_0 / libpython3_4m1_0-32bit / python3 / python3-base / etc (SUSE-SU-2024:0785-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0785-1 advisory. - CVE-2023-40217: Fixed bypass TLS handshake on closed sockets bsc1214692. - CVE-2023-6597: Fixed symlink bug in cleanup bsc1219666...

AlmaLinux 9 : haproxy (ALSA-2024:1142)

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2024:1142 advisory. - HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x...

Fedora 38 : suricata (2024-7b063bce0a)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-7b063bce0a advisory. This update fixes: CVE-2024-23835, CVE-2024-23836, CVE-2024-23837, CVE-2024-23839, CVE-2024-24568. Tenable has extracted the preceding description...

CBL Mariner 2.0 Security Update: qt5-qtbase / qt5-qtsvg (CVE-2021-38593)

The version of qt5-qtbase / qt5-qtsvg installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2021-38593 advisory. - Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in...

F5 Networks BIG-IP : OpenSSH vulnerability (K000138827)

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K000138827 advisory. - In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters,...

Amazon Linux 2 : postgresql (ALASPOSTGRESQL13-2024-006)

The version of postgresql installed on the remote host is prior to 13.14-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2POSTGRESQL13-2024-006 advisory. Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute...

Amazon Linux 2 : ecs-service-connect-agent (ALASECS-2024-034)

The version of ecs-service-connect-agent installed on the remote host is prior to v1.27.3.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2024-034 advisory. Envoy is a high-performance edge/middle/service proxy. Envoy will crash when certain timeouts happ...

Amazon Linux 2023 : nodejs20, nodejs20-devel, nodejs20-full-i18n (ALAS2023-2024-544)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-544 advisory. 2024-03-13: CVE-2024-22025 was added to this advisory. The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file...

Oracle Linux 8 : edk2 (ELSA-2024-1063)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-1063 advisory. - edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45230-Pa.patch RHEL-21840 RHEL-21842 - edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45230-Un.pat...