Amazon Linux 2023 : polkit, polkit-devel, polkit-libs (ALAS2023-2024-508)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-508 advisory. A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make...

Nessus SQL Injection Vulnerability

Tenable Network Security Nessus is an open source system vulnerability scanner from Tenable Network Security, USA. Nessus suffers from a SQL injection vulnerability. Exploitation of this vulnerability by a low-privileged remote attacker could alter the contents of the scanned database...

Google Chrome < 121.0.6167.160 Multiple Vulnerabilities

The version of Google Chrome installed on the remote Windows host is prior to 121.0.6167.160. It is, therefore, affected by multiple vulnerabilities as referenced in the 202402stable-channel-update-for-desktop advisory. - Use after free in Mojo in Google Chrome prior to 121.0.6167.160 allowed a...

Amazon Linux 2 : tomcat (ALASTOMCAT9-2024-011)

The version of tomcat installed on the remote host is prior to 9.0.50-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2TOMCAT9-2024-011 advisory. 2024-02-15: CVE-2021-33037 was added to this advisory. Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5...

Amazon Linux 2 : firefox (ALASFIREFOX-2024-021)

The version of firefox installed on the remote host is prior to 115.7.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2024-021 advisory. An out of bounds write in ANGLE could have allowed an attacker to corrupt memory leading to a potentially...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2024-510)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-510 advisory. A flaw has been found in Xen. An unprivileged guest can cause Denial of Service DoS of the host by sending network packets to the backend, causing the backend to crash. CVE-2023-46838 A Null...

Amazon Linux AMI : postfix (ALAS-2024-1914)

The version of postfix installed on the remote host is prior to 2.6.6-2.17. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1914 advisory. Postfix through 3.8.4 allows SMTP smuggling unless configured with smtpddatarestrictions=rejectunauthpipelining and...

Amazon Linux 2 : snakeyaml (ALAS-2024-2450)

The version of snakeyaml installed on the remote host is prior to 1.11-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2450 advisory. Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks DOS. If the parser is running on user...

SUSE SLES15 Security Update : kernel RT (Live Patch 7 for SLE 15 SP5) (SUSE-SU-2024:0344-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0344-1 advisory. This update for the Linux Kernel 5.14.21-1505001324 fixes several issues. The following security issues were fixed: - CVE-2023-6932: Fixed a...

SUSE SLES15: libpython2_7-1_0 / libpython2_7-1_0-32bit / python / python-32bit / etc (SUSE-SU-2024:0329-1)

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:0329-1 advisory. - CVE-2023-27043: Fixed incorrectly parses e-mail addresses which contain a special character bsc1210638. Tenable has extracted the...

Amazon Linux 2 : squid (ALAS-2024-2433)

The version of squid installed on the remote host is prior to 3.5.20-17. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2433 advisory. Squid is a caching proxy for the Web. Due to an expired pointer reference bug, Squid prior to version 6.6 is vulnerable to a Denial...

Amazon Linux 2023 : nspr, nspr-devel, nss (ALAS2023-2024-507)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-507 advisory. A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make...

Amazon Linux AMI : libtiff (ALAS-2024-1913)

The version of libtiff installed on the remote host is prior to 4.0.3-35.50. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1913 advisory. An out-of-memory flaw was found in libtiff. Passing a crafted tiff file to TIFFOpen API may allow a remote attacker to cause a...

Amazon Linux 2 : wireshark (ALAS-2024-2441)

The version of wireshark installed on the remote host is prior to 2.6.2-15. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2441 advisory. IEEE 1609.2 dissector crash in Wireshark 4.2.0, 4.0.0 to 4.0.11, and 3.6.0 to 3.6.19 allows denial of service via packet injecti...

Amazon Linux 2023 : ansible-core, ansible-test (ALAS2023-2024-505)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-505 advisory. The upstream report describes this issue as follows: When installing a maliciously created Ansible role using 'ansible-galaxy role install', arbitrary files the user has access to can be...

SUSE SLES15: kernel-livepatch-5_14_21-150400_15_62-rt / etc (SUSE-SU-2024:0347-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2024:0347-1 advisory. This update for the Linux Kernel 5.14.21-1504001562 fixes one issue. The following security issue was fixed: - CVE-2023-6932: Fixed a use-after-free...

Amazon Linux 2023 : sudo, sudo-devel, sudo-logsrvd (ALAS2023-2024-514)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-514 advisory. 2024-02-26: The severity of this advisory has been changed from important to low. Sudo before 1.9.15 might allow row hammer attacks for authentication bypass or privilege escalation because application...

Tenable Network Security Nessus Cross-Site Scripting Vulnerability

Tenable Network Security Nessus is an open source system vulnerability scanner from Tenable Network Security, USA. Nessus suffers from a cross-site scripting vulnerability. A remote attacker exploiting this vulnerability may be able to change Nessus proxy settings, which could lead to the executi...

Amazon Linux 2 : vim (ALAS-2024-2452)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2452 advisory. 2024-02-29: CVE-2023-48706 was added to this advisory. Vim is a UNIX editor that, prior to version 9.0.2121, has a heap-use-after-free vulnerability. When executing a :s command for the very firs...

PT-2024-15935 · Tenable · Tenable Nessus

Name of the Vulnerable Software and Affected Versions: Tenable Nessus affected versions not specified Description: A stored XSS issue exists where an authenticated, remote attacker with administrator privileges on the Nessus application could alter Nessus proxy settings, leading to the execution ...