AlmaLinux 8 : libndp (ALSA-2024:4620)

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2024:4620 advisory. libndp: buffer overflow in route information length field CVE-2024-5564 Tenable has extracted the preceding description block directly from the AlmaLinux security...

Hierarchical Data Format HDF5 File Detection for Linux/UNIX

Binary data detectmodelfileshdf5.nbin...

AlmaLinux 9 : qt5-qtbase (ALSA-2024:4623)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:4623 advisory. qtbase: qtbase: Delay any communication until encrypted can be responded to CVE-2024-39936 Tenable has extracted the preceding description block directly from the...

Ivanti Endpoint Manager - July 2024 Security Update

The version of Ivanti Endpoint Manager running on the remote host lacking the July 2024 Hotfix. It is, therefore, affected by an unspecified SQL Injection vulnerability in the Core server of Ivanti EPM 2024 flat that allows an authenticated attacker within the same network to execute arbitrary...

ManageEngine OpManager XSS (CVE-2024-38870)

A cross-side scripting vulnerability exists in the configured proxy server for ManageEngine OpManager 12.8.103 and below, 12.8.151 to 12.8.237, or 12.8.247 to 12.8.249. A stored XSS vulnerability was discovered in Schedule reports. Note that Nessus has not tested for this issue but has instead...

SolarWinds ARM < 2024.3 (arm_2024_3)

The version of SolarWinds ARM installed on the remote host is prior to 2024.3. It is, therefore, affected by multiple vulnerabilities as referenced in the arm2024-3 advisory, including the following: - The SolarWinds Access Rights Manager was found to be susceptible to a Remote Code Execution...

Ricoh MFP and Printer Products Buffer Overflow (ricoh-2024-000008)

The remote Ricoh MFP or printer is affected by a buffer overflow: - There is a possibility of a denial of service DoS attack or partial data destruction caused by a remote attacker. No arbitrary code can be executed. CVE-2024-39927 %NASLMINLEVEL 80900 C Tenable Network Security, Inc...

Atlassian Confluence 7.19.23 < 7.19.25 / 8.5.x < 8.5.12 / 8.9.x < 8.9.4 (CONFSERVER-96103)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-96103 advisory. - When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory erro...

NextChat / ChatGPT Next Detection

Binary data 701474.prm...

ServiceNow Server-Side Template Injection

ServiceNow is affected by a vulnerability allowing an unauthenticated attacker to obtain Server-Side Template Injection via a specially forged request. This vulnerability can be used to execute arbitrary code. No source data...

H2O Flow Detection

Binary data 701473.prm...

Atlassian Confluence < 7.19.25 / 8.5.x < 8.5.12 / 8.9.x < 8.9.4 (CONFSERVER-96101)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-96101 advisory. - When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error...

Oracle MySQL Server 9.x < 9.0.1 DoS (July 2024 CPU)

The versions of MySQL Server installed on the remote host are affected by a vulnerability as referenced in the July 2024 CPU advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 8.0.38, 8.4.1 and 9.0.0. Easily exploitabl...

Slackware Linux 15.0 / current httpd Multiple Vulnerabilities (SSA:2024-200-01)

The version of httpd installed on the remote host is prior to 2.4.62. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2024-200-01 advisory. New httpd packages are available for Slackware 15.0 and -current to fix security issues. Tenable has extracted the preceding...

VMware Aria Automation SQLi Vulnerability (VMSA-2024-0017)

The VMware Aria Automation application running on the remote host is affected by a SQL injection vulnerability due to incorrect input validation which allows for SQL-injection in the product. An authenticated malicious actor may exploit this vulnerability leading to unauthorized access to remote...

Oracle MySQL Server 8.x < 8.4.1 (January 2025 CPU)

The versions of MySQL Server installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2025 CPU advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.37 and prior an...

Atlassian Confluence < 7.19.22 Cross-Site Scripting

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 7.19.22, 7.20.x prior to 8.5.9 or 8.6.x prior to 8.9.1. It is, therefore, affected by a stored Cross-Site Scripting XSS vulnerability. Note that the scanner has not tested fo...

Apache Hugegraph 1.0.0 < 1.3.0 Remote Command Execution

Apache Hugegraph versions 1.0.0 prior to 1.3.0 is affected by a vulnerability allowing an unauthenticated attacker to execute remote commands via a specially forged request. No source data...

Bricks Theme for WordPress < 1.9.6.1 Remote Code Execution

The WordPress Bricks Theme installed on the remote host is affected by a vulnerability allowing an unauthenticated attacker to execute arbitrary code via a specially forged request. No source data...

Joomla! 3.x < 3.10.16 Multiple Vulnerabilities

According to its self-reported version, the instance of Joomla! running on the remote web server is 3.x prior to 3.10.16, 4.x prior to 4.4.6 or 5.x prior to 5.1.2. It is, therefore, affected by multiple vulnerabilities. - Inadequate input validation leads to XSS vulnerabilities in the...