Security Updates for Microsoft Office Products C2R (February 2024)

The Microsoft Office Products are missing a security update. It is, therefore, affected by multiple vulnerabilities, as follows: - A remote code execution vulnerability. CVE-2024-21413 - A remote code execution vulnerability. CVE-2024-20673 Note that Nessus has not tested for these issues but has...

F5 Networks BIG-IP : BIG-IP Appliance mode iAppsLX vulnerability (K91054692)

The version of F5 Networks BIG-IP installed on the remote host is prior to 15.1.9 / 16.1.4 / 17.1.1. It is, therefore, affected by a vulnerability as referenced in the K91054692 advisory. - When running in Appliance mode, an authenticated attacker assigned the Administrator role may be able to...

Oracle Linux 8 / 9 : sudo (ELSA-2024-0811)

The remote Oracle Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-0811 advisory. - CVE-2023-28487 sudo: Sudo does not escape control characters in sudoreplay output Resolves: RHEL-21834 - CVE-2023-28486 sudo: Sudo does not escap...

Debian dsa-5620 : libunbound-dev - security update

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5620 advisory. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-5620...

F5 Networks BIG-IP : BIG-IP iControl REST API vulnerability (K32544615)

The version of F5 Networks BIG-IP installed on the remote host is prior to 15.1.9 / 16.1.4 / 17.1.1. It is, therefore, affected by a vulnerability as referenced in the K32544615 advisory. When BIG-IP is deployed in high availability HA and an iControl REST API token is updated, the change does no...

F5 Networks BIG-IP : BIG-IP Advanced WAF and BIG-IP ASM and vulnerability (K000137270)

The version of F5 Networks BIG-IP installed on the remote host is prior to 17.1.1. It is, therefore, affected by a vulnerability as referenced in the K000137270 advisory. - When a BIG-IP ASM/Advanced WAF security policy is configured on a virtual server, undisclosed requests can cause an increase...

Security Updates for Microsoft Dynamics 365 Business Central (February 2024)

The Microsoft Dynamics 365 Business Central install is missing a security update. It is, therefore, affected by an information disclosure vulnerability. A remote, authenticated attacker, by inducing another user to access a compromised URL and winning a race condition, can to read, modify and...

RHEL 7 : .NET 6.0 (RHSA-2024:0814)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0814 advisory. .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR...

F5 Networks BIG-IP : BIG-IP AFM vulnerability (K000137521)

The version of F5 Networks BIG-IP installed on the remote host is prior to 17.1.1. It is, therefore, affected by a vulnerability as referenced in the K000137521 advisory. When BIG-IP AFM Device DoS or DoS profile is configured with NXDOMAIN attack vector and bad actor detection, undisclosed queri...

Slackware Linux 15.0 / current dnsmasq Multiple Vulnerabilities (SSA:2024-044-02)

The version of dnsmasq installed on the remote host is prior to 2.90. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2024-044-02 advisory. - MITRE: CVE-2023-50387 DNSSEC verification complexity can be exploited to exhaust CPU resources and stall DNS resolvers...

F5 Networks BIG-IP : BIG-IP SSL Client Certificate LDAP and CRLDP Authentication profiles vulnerability (K000134516)

The version of F5 Networks BIG-IP installed on the remote host is prior to 15.1.9 / 16.1.4 / 17.1.1. It is, therefore, affected by a vulnerability as referenced in the K000134516 advisory. - When SSL Client Certificate LDAP or Certificate Revocation List Distribution Point CRLDP authentication...

F5 Networks BIG-IP : BIG-IP Advanced WAF and BIG-IP ASM vulnerability (K000137416)

The version of F5 Networks BIG-IP installed on the remote host is prior to 17.1.1. It is, therefore, affected by a vulnerability as referenced in the K000137416 advisory. - When a BIG-IP Advanced WAF or BIG-IP ASM policy with a Request Body Handling option is attached to a virtual server,...

RHEL 8 / 9 : sudo (RHSA-2024:0811)

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0811 advisory. The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute...

F5 Networks BIG-IP : BIG-IP Advanced WAF and BIG-IP ASM Configuration utility vulnerability (K000138047)

The version of F5 Networks BIG-IP installed on the remote host is prior to 15.1.10 / 16.1.4 / 17.1.1. It is, therefore, affected by a vulnerability as referenced in the K000138047 advisory. A SQL injection vulnerability exists in an undisclosed page of the BIG-IP Configuration...

F5 Networks BIG-IP : BIG-IP PEM vulnerability (K000135946)

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K000135946 advisory. - When a BIG-IP PEM classification profile is configured on a UDP virtual server, undisclosed requests can cause the...

Security Updates for Microsoft Dynamics 365 (on-premises) (February 2024)

The Microsoft Dynamics 365 on-premises is missing security updates. It is, therefore, affected by multiple vulnerabilities. - Cross-site scripting XSS in Microsoft Dynamics 365 CVE-2024-21327, CVE-2024-21389, CVE-2024-21393, CVE-2024-21395 - Spoofing vulnerability in the Sales and Field Service...

F5 Networks BIG-IP : BIG-IP AFM signature matching vulnerability (K000137595)

The version of F5 Networks BIG-IP installed on the remote host is prior to 15.1.9 / 16.1.4 / 17.1.1. It is, therefore, affected by a vulnerability as referenced in the K000137595 advisory. - For unspecified traffic patterns, BIG-IP AFM IPS engine may spend an excessive amount of time matching the...

Debian dsa-5621 : bind9 - security update

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5621 advisory. - The DNS message parsing code in named includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffic,...

Fedora 38 : firecracker / libkrun / rust-event-manager / rust-kvm-bindings / etc (2024-f2305d485f)

The remote Fedora 38 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2024-f2305d485f advisory. Update rust-vmm components and their consumers to address CVE-2023-50711 Tenable has extracted the preceding description block directly from the Fedora...

Oracle Linux 7 : openssh (ELSA-2024-12157)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-12157 advisory. 7.4p1-23.0.3 - add KEXINITIAL flag Orabug: 36160445 - implement 'strict key exchange' CVE-2023-48795Orabug: 36160445 Tenable has extracted the preceding...