openSUSE 15 Security Update : chromium (openSUSE-SU-2022:10120-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:10120-1 advisory. - Use after free in Network Service. CVE-2022-3038 - Use after free in WebSQL. CVE-2022-3039, CVE-2022-3041 - Use after free in Layout...

Trend Micro Apex One Multiple Vulnerabilities (000291528)

According to its self-reported version, the Trend Micro application running on the remote Windows host is Apex One prior to SP1 Server Build 11092 and Agent Build 11088. It is, therefore, affected by multiple vulnerabilities: - Improper validation of some components used by the rollback mechanism...

Apple iOS < 15.7 Multiple Vulnerabilities (HT213445)

Binary data appleios157check.nbin...

CentOS 8 : nodejs:16 (CESA-2022:6449)

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2022:6449 advisory. - nodejs-ansi-regex: Regular expression denial of service ReDoS matching ANSI escape codes CVE-2021-3807 - nodejs: DNS rebinding in --inspect via inval...

WordPress 3.8.x < 3.8.39 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A SQL injection vulnerability within the Link API. - A Cross-Site Scripting XSS vulnerability on the Plugins screen. - An output escaping issue within themeta. Note that t...

WordPress 5.7.x < 5.7.7 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A SQL injection vulnerability within the Link API. - A Cross-Site Scripting XSS vulnerability on the Plugins screen. - An output escaping issue within themeta. Note that t...

WordPress 4.6.x < 4.6.24 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A SQL injection vulnerability within the Link API. - A Cross-Site Scripting XSS vulnerability on the Plugins screen. - An output escaping issue within themeta. Note that t...

WordPress 4.2.x < 4.2.33 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A SQL injection vulnerability within the Link API. - A Cross-Site Scripting XSS vulnerability on the Plugins screen. - An output escaping issue within themeta. Note that t...

WordPress 3.9.x < 3.9.37 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A SQL injection vulnerability within the Link API. - A Cross-Site Scripting XSS vulnerability on the Plugins screen. - An output escaping issue within themeta. Note that t...

DotCMS 3.x < 5.3.8.10 / 21.x < 21.06.7 / 22.x < 22.03 Remote Code Execution

An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Attackers can craft a multipart form request to post a file whose filename is not initially sanitized. This allows directory traversal, in which the file is saved outside of the intended storage location. If anonymous...

[Security Nation] Gordon “Fyodor” Lyon on Nmap, the Open-Source Security Scanner

!\Security Nation\ Gordon “Fyodor” Lyon on Nmap, the Open-Source Security Scannerhttps://blog.rapid7.com/content/images/2022/08/securitynationlogo-2.jpg In this episode of Security Nation, Jen and Tod chat with Gordon “Fyodor” Lyon, author of the widely used open-source Nmap Security Scanner. On...

The Truth About False Positives in Security

TL;DR: As weird as it might sound, seeing a few false positives reported by a security scanner is probably a good sign and certainly better than seeing none. Let's explain why. Introduction False positives have made a somewhat unexpected appearance in our lives in recent years. I am, of course,...

The Truth About False Positives in Security

TL;DR: As weird as it might sound, seeing a few false positives reported by a security scanner is probably a good sign and certainly better than seeing none. Let's explain why. Introduction False positives have made a somewhat unexpected appearance in our lives in recent years. I am, of course,...

Splunk Enterprise < 8.1.0 Information Disclosure

According to its self-reported version number, the version of Splunk running on the remote web server is Splunk Enterprise prior to 8.1. It is, therefore, be affected by an information disclosure vulnerability where, when handling a mismatched authentication cookie, the application leaks the...

QNAP Helpdesk Multiple Vulnerabilities (QSA-20-08)

The version of QNAP QTS Helpdesk is affected by multiple vulnerabilities as follows: - If exploited, this improper access control vulnerability could allow attackers to compromise the security of the software by gaining privileges, or reading sensitive information. CVE-2020-2506 - If exploited,...

Expression Language Injection

Expression Language EL has been defined as part of the Java Server Pages Standard Tag Library JSTL in order to offer developers a simple way to output data from an object model. Starting from the JSP 2.0 specification, Expression Language has been made available within JSP pages, but it is also...

ThinkPHP Framework 5.1.x < 5.1.31 Arbitrary File Read

A vulnerability exists within ThinkPHP Framework 5.1.x to 5.1.31. If the site is configured in debug mode, this vulnerability allows an attacker to read arbitrary files on the system due to improper sanitization of user-supplied input. No source data...

Amazon Linux 2 : java-1.8.0-amazon-corretto (ALASCORRETTO8-2022-003)

The version of java-1.8.0-amazon-corretto installed on the remote host is prior to 1.8.0342.b07-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2CORRETTO8-2022-003 advisory. Generated code produced by C1 may leak a package-private class to a class from a differe...

RHEL 8 : java-11-openjdk (RHSA-2022:5681)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5681 advisory. The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Security Fixe...

Oracle VM VirtualBox (July 2022 CPU)

The version of VirtualBox installed on the remote host is prior to 6.1.36. It is, therefore, affected by multiple vulnerabilities as referenced in the July 2022 CPU advisory: - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that i...