Gallery 3.0.x < 3.0.8 Multiple XSS

According to its version number, the Gallery install hosted on the remote web server contains cross-site scripting vulnerabilities in the 'uploadify.swf' and 'flowplay.swf' files, where URL fragments and parameters are not properly sanitized when called via direct requests. An attacker may be abl...

strange_http_codes

Analyze HTTP response codes sent by the remote web application and report uncommon findings. Plugin type Grep Options This plugin doesnt have any user configured options. Source For more information about this plugin and the associated tests, theres always the source code to understand exactly...

hmap

This plugin fingerprints the remote web server and tries to determine the server type, version and patch level. It uses fingerprinting, not just the Server header returned by remote server. This plugin is a wrapper for Dustin Lees hmap. One configurable parameters exist: genFpF If genFpF is set t...

afd

This plugin sends custom requests to the remote web server in order to verify if the remote network is protected by an IPS or WAF. afd plugin detects both TCP-Connection-reset and HTTP level filters, the first one usually implemented by IPS devices is easy to verify: if afd requests the custom pa...

fingerprint_os

This plugin fingerprints the remote web server and tries to determine the Operating System family Windows, Unix, etc.. The fingerprinting is at this moment really trivial, because it only uses one technique: windows path separator in the URL. For example, if the input URL is...

Splunk 5.0.x < 5.0.3 Multiple Vulnerabilities

According to its version number, the Splunk Web hosted on the remote web server is affected by multiple vulnerabilities : - The application is affected by an unspecified cross-site scripting vulnerability. An attacker can exploit this issue to inject arbitrary HTML and script code into a user's...

Citrix Access Gateway User Web Interface Detection

The remote web server hosts the web interface for using Citrix Access Gateway, an SSL VPN appliance. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid65951; scriptversion"1.5"; scriptsetattributeattribute:"pluginmodificationdate", value:"2020/09/22";...

Citrix Access Gateway Administrative Web Interface Detection

The remote web server hosts the web interface for administering Citrix Access Gateway, an SSL VPN appliance. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid65949; scriptversion"1.4"; scriptsetattributeattribute:"pluginmodificationdate", value:"2020/09/22";...

MoinMoin rsslink() Function page_name Parameter XSS

The MoinMoin install hosted on the remote web server fails to properly sanitize user-supplied input in the 'pagename' parameter when creating an rss link. An attacker may be able to leverage this issue to inject arbitrary HTML and script code into a user's browser to be executed within the securi...

Cisco Prime LAN Management Solution Web Detection

Cisco Prime LAN Management solution, a network management application, was detected on the remote web server. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid64789; scriptversion"1.5"; scriptcvsdate"Date: 2019/11/25"; scriptnameenglish:"Cisco Prime LAN Management...

php-Charts url.php Remote PHP Code Execution

The php-Charts install hosted on the remote web server contains a flaw that could allow arbitrary PHP code execution. Input passed to the 'wizard/url.php' script is not properly sanitized before being used in a PHP eval call. An unauthenticated, remote attacker could leverage this vulnerability t...

WordPress 'xmlrpc.php' pingback.ping Server-Side Request Forgery

The WordPress install hosted on the remote web server is affected by a server-side request forgery vulnerability because the 'pingback.ping' method used in 'xmlrpc.php' fails to properly validate source URIs Uniform Resource Identifiers. A remote, unauthenticated attacker can exploit this issue t...

Dell OpenManage Server Administrator index_main.htm DOM-based XSS

The version of Dell OpenManage Server Administrator hosted on the remote web server has a cross-site scripting vulnerability. Making a specially crafted request for indexmain.htm can result in client-side script injection. An attacker could exploit this by tricking a user into requesting a...

Drupal 6.x < 6.27 / 7.x < 7.18 Multiple Vulnerabilities

The remote web server is running a version of Drupal that is 6.x prior to 6.27 or 7.x prior to 7.18. It is, therefore, potentially affected by multiple vulnerabilities : - An access bypass vulnerability exists that allows search results to improperly display information about blocked users...

NetIQ Privileged User Manager Default Admin Password

Nessus was able to login to the NetIQ Privileged User Manager install running on the remote host using default, known credentials for the 'admin' user. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid62990;...

WebYaST Web Client Detection

WebYaST web client, a web interface for YaST, was detected on the remote host. YaST is used for administration of hosts running SUSE Linux operating systems. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid62966; scriptversion"1.5"; scriptcvsdate"Date: 2019/11/22";...

Mutiny Detection

The remote web server hosts Mutiny, a network monitoring application that uses SNMP to gather infrastructure information and process and display the results in a web-based interface. This information is used to assess the health of network devices. C Tenable Network Security, Inc...

Drupal 7.x < 7.16 Multiple Vulnerabilities

The remote web server is running a version of Drupal that is 7.x prior to 7.16. It is, therefore, potentially affected by multiple vulnerabilities : - An arbitrary PHP code execution vulnerability exists due to an error in the 'installer.php' script. An attacker, under certain conditions, could u...

[SECURITY] Fedora 16 Update: phpldapadmin-1.2.2-3.gitbbedf1.fc16

PhpLDAPadmin is a web-based LDAP client. It provides easy, anywhere-accessible, multi-language administration for your LDAP server. Its hierarchical tree-viewer and advanced search functionality make it intuitive to browse and administer your LDAP director y. Since it is a web application, this...

phpMyAdmin server_sync.php Backdoor (PMASA-2012-5)

The phpMyAdmin install hosted on the remote web server contains a backdoor script, probably obtained from the cdnetworks-kr-1 SourceForge.net mirror site as part of the file phpMyAdmin-3.5.2.2-all-languages.zip. An unauthenticated, remote attacker can use this backdoor to execute arbitrary PHP co...