1962 matches found
Johnsoncontrols Metasys Use of Hard-coded Credentials
Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a shared RSA key pair for certain encryption operations involving the Site Management Portal SMP. File data ot500401.nasl...
Rockwellautomation Factorytalk Improper Handling of Exceptional Conditions
An attacker can craft and send an OpenNamespace message to port 4241 with valid session-id that triggers an unhandled exception in CFTLDManager::HandleRequest function in RnaDaSvr.dll, resulting in process termination. Observed in FactoryTalk Linx 6.11. All versions of FactoryTalk Linx are...
AD Starter Scan - Null sessions
Binary data adsinullsession.nbin...
Adminer < 4.2.2 Cross-Site Scripting
The version of Adminer installed on the remote host does not sanitize user input on the alter table function potentially leading to a XSS vulnerability. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No source d...
X-Cart 5.0.10 < 5.3.3.0 Multiple Vulnerabilities
According to the self-reported version in its response header, the version of X-Cart hosted on the remote web server is 5.0.10 5.3.3.0. It is, therefore, affected by multiples vulnerabilities : - A Remote Code execution vulnerability due to insufficient checking of uploaded content. This...
Atlassian Confluence < 6.13.11 Improper Authorization
According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 6.13.11 or 6.14.x 7.3.3. It is, therefore, affected by an improper authorization check vulnerability allowing remote attackers with administrator privileges to edit existing...
Atlassian Confluence < 7.4.5 Template Injection
According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 7.4.5 or 7.5.x 7.5.1. It is, therefore, affected by an injection vulnerability in custom user macros allowing remote attackers with system administration permissions to bypas...
Atlassian Jira < 8.5.11 Multiple Vulnerabilities
According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.5.11, 8.6.x 8.13.3 or 8.14.x 8.15.0. It is, therefore, affected by multiple vulnerabilities: - An information disclosure vulnerability in the...
Debian DLA-2686-1 : python-urllib3 - LTS security update
The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2686 advisory. Several vulnerabilities were discovered in python-urllib3, a HTTP client for Python. CVE-2018-20060 Urllib3 does not remove the Authorization HTTP header when...
FreeBSD : polkit -- local privilege escalation using polkit_system_bus_name_get_creds_sync (36a35d83-c560-11eb-84ab-e0d55e2a8bf9)
Cedric Buissart reports : The function polkitsystembusnamegetcredssync is used to get the uid and pid of the process requesting the action. It does this by sending the unique bus name of the requesting process, which is typically something like ':1.96', to dbus-daemon. These unique names are...
HPE Edgeline Infrastructure Manager Authentication Bypass (HPESBGN04124)
Binary data hpeeimcve-2021-29203.nbin...
Exposed Session Token
Web applications use sessions to retain information about each user, keep track of their activity or define proper access rights and permissions. Each session has an identifier token or ID defined by the application to bind users to their HTTP traffic, being temporarily equivalent to the stronges...
CentOS 8 : raptor2 (CESA-2021:1842)
The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:1842 advisory. - raptor: heap-based buffer overflows due to an error in calculating the maximum nspace declarations for the XML writer CVE-2017-18926 - raptor2:...
NewStart CGSL CORE 5.04 / MAIN 5.04 : resource-agents Vulnerability (NS-SA-2021-0034)
The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has resource-agents packages installed that are affected by a vulnerability: - In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for httplib2.Http.request could change request headers and body, se...
Debian DLA-2650-1 : exim4 security update
The Qualys Research Labs reported several vulnerabilities in Exim, a mail transport agent, which could result in local privilege escalation and remote code execution. Details can be found in the Qualys advisory at https://www.qualys.com/2021/05/04/21nails/21nails.txt For Debian 9 stretch, these...
Drupal 7.x < 7.80 Cross-Site Scripting
According to its self-reported version, the instance of Drupal running on the remote web server is 7.0.x prior to 7.80, 8.9.x prior to 8.9.14, 9.0.x prior to 9.0.12 or 9.1.x prior to 9.1.7. It is, therefore, affected by a Cross-Site Scripting XSS vulnerability due to Drupal core's sanitization AP...
SUSE SLES12 Security Update : xen (SUSE-SU-2021:1268-1)
This update for xen fixes the following issues : CVE-2021-27379: Fixed an issue where entries in the IOMMU were not being updated under certain circumstances due to improper backport of XSA-321 XSA-366, bsc1182431 Fixed an issue where xenstored was crashing with segfault bsc1182155. Note that...
WordPress 5.6.x < 5.6.3 Multiple Vulnerabilities
According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - An XML External Entity XXE vulnerability exists in the media library affecting PHP 8. - A data exposure vulnerability exists in the REST API. Note that the scanner has not...
SAP NetWeaver AS Java and AS ABAP Multiple Vulnerabilities (Apr 2021)
The version of SAP Netweaver Application Server for Java installed on the remote host may be affected by multiple vulnerabilities, including the following: - An unauthorized attacker may be able to entice an administrator to invoke telnet commands of an SAP NetWeaver Application Server for Java...