Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2024-085 (ALASKERNEL-5.4-2024-085)

The version of kernel installed on the remote host is prior to 5.4.283-195.378. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2024-085 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: don't allow mapping the MM...

Amazon Linux 2 : python2-setuptools (ALAS-2024-2632)

The version of python2-setuptools installed on the remote host is prior to 41.2.0-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2632 advisory. A vulnerability in the packageindex module of pypa/setuptools versions up to 69.1.1 allows for remote code execution vi...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2024-053 (ALASKERNEL-5.15-2024-053)

The version of kernel installed on the remote host is prior to 5.15.162-107.160. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2024-053 advisory. A vulnerability, which was classified as problematic, was found in Linux Kernel. This affects the functi...

Photon OS 4.0: Linux PHSA-2024-4.0-0694

An update of the linux package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-4.0-0694. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Ubuntu 24.04 LTS : xmltok library vulnerabilities (USN-7001-2)

The remote Ubuntu 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7001-2 advisory. USN-7001-1 fixed vulnerabilities in xmltol library. This update provides the corresponding updates for Ubuntu 24.04 LTS. Tenable has extracted the...

Service Worker Detected

This is an informational plugin to inform the user that the scanner has detected the usage of Service Worker on the target web application. No source data...

Next.js < 14.1.1 Server Actions Server-Side Request Forgery

Next.js versions from 13.4 included before 14.1.1 suffer from a Server-Side Request Forgery SSRF when using Server Actions performing a redirection to a relative path starting with '/'. By leveraging this vulnerability, a remote and unauthenticated attacker can forge an arbitrary 'Host' header an...

Oracle Linux 8 : pcs (ELSA-2024-6670)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-6670 advisory. 0.10.18-2.0.1.el810.2 - Replace HAM-logo.png with a generic one 0.10.18-2.el810.2 - Updated rubygem rexml Resolves: RHEL-52409, RHEL-52788, RHEL-55997...

Schneider Electric Accutech Manager Stack Exhaustion (CVE-2024-6918)

Binary data schneiderelectricaccutechmanagercve-2024-6918.nbin...

Ubuntu 22.04 LTS : Expat vulnerabilities (USN-7000-2)

The remote Ubuntu 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7000-2 advisory. USN-7000-1 fixed vulnerabilities in Expat. This update provides the corresponding updates for Ubuntu 22.04 LTS. Tenable has extracted the preceding...

MLFlow < 2.12.1 File Deletion

A broken access control vulnerability exists in mlflow/mlflow versions before 2.12.1, where low privilege users with only EDIT permissions on an experiment can delete any artifacts. This issue arises due to the lack of proper validation for DELETE requests by users with EDIT permissions, allowing...

Google Chrome < 129.0.6668.58 Multiple Vulnerabilities

The version of Google Chrome installed on the remote macOS host is prior to 129.0.6668.58. It is, therefore, affected by multiple vulnerabilities as referenced in the 202409stable-channel-update-for-desktop17 advisory. - Inappropriate implementation in V8 in Google Chrome prior to 129.0.6668.58...

Amazon Linux AMI : microcode_ctl (ALAS-2024-1946)

The version of microcodectl installed on the remote host is prior to 2.1-47.43. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1946 advisory. Improper isolation in some IntelR Processors stream cache mechanism may allow an authenticated user to potentially enable...

TeamViewer < 15.51.5 Improper Privilege Management (tv-2024-1001)

The version of TeamViewer Client installed on the remote host is prior to 15.51.5. It is, therefore, affected by an improper privilege management vulnerability. Improper initialization of default settings in TeamViewer Remote Client prior version 15.51.5 for Windows, Linux and macOS, allow a low...

MLflow Registry Enumeration

Binary data mlflowregistryenumeration.nbin...

openSUSE 15 Security Update : htmldoc (openSUSE-SU-2024:0303-1)

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2024:0303-1 advisory. - CVE-2024-45508: Fixed an out-of-bounds write in parseparagraph in ps-pdf.cxx because of an attempt to strip leading whitespace from a whitespace-only...

Photon OS 3.0: Python3 PHSA-2024-3.0-0795

An update of the python3 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-3.0-0795. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Rocky Linux 8 : postgresql:16 (RLSA-2024:5927)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:5927 advisory. postgresql: PostgreSQL pgstatsext and pgstatsextexprs lack authorization checks CVE-2024-4317 postgresql: PostgreSQL relation replacement during pgdump...

macOS 13.x < 13.7 Multiple Vulnerabilities (121234)

The remote host is running a version of macOS / Mac OS X that is 13.x prior to 13.7. It is, therefore, affected by multiple vulnerabilities: - A logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.7, iOS 17.7 and iPadOS 17.7, visionOS 2, iOS 18 and iPadOS 18,...

Rocky Linux 9 : nodejs:18 (RLSA-2024:6147)

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:6147 advisory. node-tar: denial of service while parsing a tar file due to lack of folders depth validation CVE-2024-28863 nodejs: Bypass network import restriction vi...