Odoo Unprotected Database Manager

Odoo is a popular ERP and CRM open-source platform. Odoo includes a database manager which can help administrators performing management operations on their Odoo databases through a web interface. If no master password is set, this web interface allows any unauthenticated and remote attacker to...

Grafana Default Credentials

The scanner successfully authenticated on the Grafana web application by using predictable credentials on its login form. No source data...

Ray Dashboard Detection

Binary data 701475.prm...

Odoo Database Manager Detected

Odoo is a popular ERP and CRM open-source platform. Odoo includes a database manager which can help administrators performing management operations on their Odoo databases through a web interface. When exposed, this web interface can help an attacker trying to bruteforce weak master passwords and...

Nortek Linear eMerge E3-Series < 0.32-08f Command Injection

Nortek Linear eMerge E3-Series versions prior to 0.32-08f is affected by a vulnerability allowing an unauthenticated attacker to execute remote commands via a specially forged request. No source data...

Missing 'Content-Type' Charset

The Content-Type header allows clients to find an appropriate way to render data, omission of the charset can lead to various behaviour like a Cross-Site Scripting abusing the browser's auto-detection mechanism. No source data...

H2O Flow Detected

This is an informational plugin to inform the user that the scanner has detected a publicly accessible H2O Flow instance on the target application. H2O Flow is an open-source user interface for H2O, an open-source, distributed and scalable machine learning and predictive analytics platform. This...

Oracle Primavera Gateway (Jul 2024 CPU)

The versions of Primavera Gateway installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2024 CPU advisory. - Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering component: Admin Spring Framework. Supported versions that a...

Oracle Linux 8 : qt5-qtbase (ELSA-2024-4617)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-4617 advisory. 5.15.3-8 - HTTP2: Delay any communication until encrypted can be responded to Resolves: RHEL-46340 Tenable has extracted the preceding description block directl...

Microsoft Edge (Chromium) < 126.0.2592.113 Multiple Vulnerabilities

The version of Microsoft Edge installed on the remote Windows host is prior to 126.0.2592.113. It is, therefore, affected by multiple vulnerabilities as referenced in the July 18, 2024 advisory. - Inappropriate implementation in V8 in Google Chrome prior to 126.0.6478.182 allowed a remote attacke...

Oracle Linux 9 : qt5-qtbase (ELSA-2024-4623)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-4623 advisory. 5.15.9-10 - HTTP2: Delay any communication until encrypted can be responded to Resolves: RHEL-46348 Tenable has extracted the preceding description block direct...

Zoom Workplace Desktop App For Windows < 6.0.10 RACE condition (ZSB-24028)

The version of Zoom Workplace Desktop App for Windows installed on the remote host is prior to 6.0.10. It is, therefore, affected by a privilage escalation vulnerability that may allow a local authenticated attacker to cause a denial of service via local access. Note that Nessus has not tested fo...

Atlassian Confluence 7.20.x < 8.5.9 Cross-Site Scripting

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 7.19.22, 7.20.x prior to 8.5.9 or 8.6.x prior to 8.9.1. It is, therefore, affected by a stored Cross-Site Scripting XSS vulnerability. Note that the scanner has not tested fo...

Qlik Sense Enterprise Path Traversal

Qlik Sense Enterprise for Windows is affected by a Path Traversal as well as an HTTP Request Smuggling, under specific conditions, the second vulnerability can be used to obtain an unauthenticated Remote Code Execution. No source data...

ZenML Detection

Binary data 701476.prm...

Zoom Workplace Desktop App For Windows < 6.0.10 Privilage Escalation (ZSB-24026)

The version of Zoom Workplace Desktop App for Windows installed on the remote host is prior to 6.0.10. It is, therefore, affected by a privilage escalation vulnerability that may allow a local authenticated attacker to cause a privilege escalation. Note that Nessus has not tested for this issue b...

Atlassian Confluence 8.6.x < 8.9.1 Cross-Site Scripting

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 7.19.22, 7.20.x prior to 8.5.9 or 8.6.x prior to 8.9.1. It is, therefore, affected by a stored Cross-Site Scripting XSS vulnerability. Note that the scanner has not tested fo...

Oracle Identity Manager (Jul 2024 CPU)

The 12.2.1.4.0 versions of Identity Manager installed on the remote host are affected by a vilnerabilitys as referenced in the July 2024 CPU advisory. - Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware component: Third Party Spring Framework. The supported version...

CVE-2024-40641

Nuclei is a fast and customizable vulnerability scanner based on simple YAML based DSL. In affected versions it a way to execute code template without -code option and signature has been discovered. Some web applications inherit from Nuclei and allow users to edit and execute workflow files. In...

CVE-2024-40641 Unsigned code template execution through workflows in projectdiscovery/nuclei

Nuclei is a fast and customizable vulnerability scanner based on simple YAML based DSL. In affected versions it a way to execute code template without -code option and signature has been discovered. Some web applications inherit from Nuclei and allow users to edit and execute workflow files. In...