EulerOS 2.0 SP9 : sudo (EulerOS-SA-2023-1113)

According to the versions of the sudo package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Sudo 1.8.0 through 1.9.12, with the crypt password backend, contains a plugins/sudoers/auth/passwd.c array-out-of-bounds error that can result in a...

CVE-2021-4235 affecting package etcd 3.5.1-6

CVE-2021-4235 affecting package etcd 3.5.1-6. An upgraded version of the package is available that resolves this issue...

Fedora 35 : lighttpd (2022-c26b19568d)

The remote Fedora 35 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-c26b19568d advisory. 1.4.67 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this issue but h...

CVE-2022-25948

The package liquidjs before 10.0.0 are vulnerable to Information Exposure when ownPropertyOnly parameter is set to False, which results in leaking properties of a prototype. Workaround For versions 9.34.0 and higher, an option to disable this functionality is provided...

Fedora 36 : dotnet3.1 (2022-f9ca76e479)

The remote Fedora 36 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-f9ca76e479 advisory. This is the October 2022 release of .NET Core 3.1 This updates .NET Core 3.1 SDK to 3.1.424 and Runtime to 3.1.30. This includes fixes for CVE-2022-41032...

Fedora 35 : ruby (2022-b9b710f199)

The remote Fedora 35 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-b9b710f199 advisory. Upgrade to Ruby 3.0.5. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

Fedora 36 : dotnet3.1 (2022-980d492c98)

The remote Fedora 36 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-980d492c98 advisory. Update to the September 2022 update release of .NET Core 3.1 Release Notes: https://github.com/dotnet/core/blob/main/release-notes/3.1/3.1.29/3.1.29.md This...

Directory traversal

All versions of package easy-static-server are vulnerable to Directory Traversal due to missing input sanitization and sandboxes being employed to the req.url user input that is passed to the server code...

CVE-2022-24377 Command Injection

The package cycle-import-check before 1.3.2 are vulnerable to Command Injection via the writeFileToTmpDirAndOpenIt function due to improper user-input sanitization...

SUSE: Security Advisory (SUSE-SU-2022:4478-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2022-24377

The package cycle-import-check before 1.3.2 are vulnerable to Command Injection via the writeFileToTmpDirAndOpenIt function due to improper user-input sanitization...

CVE-2022-24377 Command Injection

The package cycle-import-check before 1.3.2 are vulnerable to Command Injection via the writeFileToTmpDirAndOpenIt function due to improper user-input sanitization...

CVE-2022-46996

vSphereselfuse commit 2a9fe074a64f6a0dd8ac02f21e2f10d66cac5749 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges...

Regular Expression Denial of Service (ReDoS)

Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS which leads to excessive backtracking when attempting to sanitize certain SVG attributes. This can lead to CPU resource consumption. Details Denial of Service DoS describes a family of attacks,...

CVE-2022-3821 affecting package systemd for versions less than 250.3-10

CVE-2022-3821 affecting package systemd for versions less than 250.3-10. A patched version of the package is available...

CVE-2022-24441

CVE-2022-24441 relates to a code injection flaw in Snyk when analyzing a project. According to the provided description, snyk before 1.1064.0 can be leveraged by convincing a user to scan a malicious project, including commands in build files (e.g., build.gradle or gradle-wrapper.jar), which will...

CVE-2022-2058 affecting package libtiff 4.4.0-1

CVE-2022-2058 affecting package libtiff 4.4.0-1. A patched version of the package is available...

Ubuntu: Security Advisory (USN-5735-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : rustup (SUSE-SU-2022:3949-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3949-1 advisory. Updated to version 1.25.10: - CVE-2022-24713: Fixed Regex denial of service bsc1196972. -...

Fedora: Security Advisory for mbedtls (FEDORA-2022-1dd9dc5140)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...