CVE-2024-45293

CVE-2024-45293 involves an XXE in PHPSpreadsheet’s XLSX reader where the security scanner that prevents XXE can be bypassed by whitespace in the XML encoding attribute, allowing a crafted XLSX to disclose server data. The root cause is a flawed XML encoding check in XmlScanner.php that defaults t...

CVE-2024-45293 XML External Entity Reference (XXE) in PHPSpreadsheet's XLSX reader

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The security scanner responsible for preventing XXE attacks in the XLSX reader can be bypassed by slightly modifying the XML structure, utilizing white-spaces. On servers that allow users to upload their own Excel XLS...

XXE in PHPSpreadsheet's XLSX reader

Summary The security scanner responsible for preventing XXE attacks in the XLSX reader can be bypassed by slightly modifying the XML structure, utilizing white-spaces. On servers that allow users to upload their own Excel XLSX sheets, Server files and sensitive information can be disclosed by...

GHSA-6HWR-6V2F-3M88 XXE in PHPSpreadsheet's XLSX reader

Summary The security scanner responsible for preventing XXE attacks in the XLSX reader can be bypassed by slightly modifying the XML structure, utilizing white-spaces. On servers that allow users to upload their own Excel XLSX sheets, Server files and sensitive information can be disclosed by...

Exploit for CVE-2024-47176

Quick Start Example usage: python3 cupsscanner.py --targets...

PostgreSQL pgAdmin4 Installed (macOS)

Binary data postgresqlpgadmin4macosinstalled.nbin...

Ubuntu 16.04 LTS : cups-filters vulnerability (USN-7043-3)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-7043-3 advisory. USN-7043-1 fixed a vulnerability in cups-filters. This update provides the corresponding update for Ubuntu 16.04 LTS Tenable has extracted the preceding descripti...

Progress Telerik UI for WinForms Installed

Binary data progresstelerikuiforwinformsinstalled.nbin...

PostgreSQL pgAdmin4 Installed (Windows)

Binary data postgresqlpgadmin4wininstalled.nbin...

Fedora 39 : firefox (2024-86edbf4d85)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-86edbf4d85 advisory. - New upstream version 131.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has...

Oracle Linux 9 : golang (ELSA-2024-7550)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-7550 advisory. - Fix CVE-2024-9355 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has not tested for...

VegaBird Vooki 安全漏洞

VegaBird Vooki is a free web application vulnerability scanning tool from VegaBird Open Source that helps users to scan any web application and find vulnerabilities.Vooki consists of three main parts: a web application scanner, a Rest API scanner, and a reporting feature. VegaBird Vooki version...

FreeBSD : Unbound -- Denial of service attack (2368755b-83f6-11ef-8d2e-a04a5edf46d9)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 2368755b-83f6-11ef-8d2e-a04a5edf46d9 advisory. NLnet labs report: A vulnerability has been discovered in Unbound when handling replies with very large...

Ubuntu 16.04 LTS : CUPS vulnerability (USN-7041-3)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-7041-3 advisory. USN-7041-1 fixed a vulnerability in CUPS. This update provides the corresponding update for Ubuntu 16.04 LTS. Tenable has extracted the preceding description bloc...

CBL Mariner 2.0 Security Update: hyperv-daemons (CVE-2024-27397)

The version of hyperv-daemons installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-27397 advisory. - In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: use timesta...

Fedora 40 : p7zip (2024-5c99e1d579)

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-5c99e1d579 advisory. Fix wrapper to hide password from process history Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

CBL Mariner 2.0 Security Update: python3 (CVE-2024-4032)

The version of python3 installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-4032 advisory. - The ipaddress module contained incorrect information about whether certain IPv4 and IPv6 addresses were...

CBL Mariner 2.0 Security Update: heimdal / samba (CVE-2022-3116)

The version of heimdal / samba installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-3116 advisory. - The Heimdal Software Kerberos 5 implementation is vulnerable to a null pointer dereferance. An...

Exploit for OS Command Injection in Php

CVE-2024-4577 Vulnerability Checker The CVE-2024-4577 Vulnera...

Neptune AI SDK Detection

A Neptune AI Python library is installed on the remote host. Note that Nessus has relied upon on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid208132; scriptversion"1.7";...