Oracle Linux 8 : libssh (ELSA-2020-4545)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4545 advisory. - Add a test for CVE-2019-14889 - Fixed CVE-2019-14889 1781782 - Fixed CVE-2020-1730 1802422 Tenable has extracted the preceding description block...

RHEL 8 : nodejs:12 (RHSA-2020:4903)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4903 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The...

Amazon Linux 2 : cups (ALAS-2020-1506)

The version of cups installed on the remote host is prior to 1.6.3-51. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1506 advisory. A localhost.localdomain whitelist entry in validhost in scheduler/client.c in CUPS before 2.2.2 allows remote attackers to...

Amazon Linux 2 : mailman (ALAS-2020-1536)

The version of mailman installed on the remote host is prior to 2.1.15-30. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1536 advisory. A cross-site scripting vulnerability XSS has been discovered in mailman due to the hostname field not being properly...

CentOS 7 : libvirt (RHSA-2020:4000)

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4000 advisory. - qemu/qemudriver.c in libvirt before 6.0.0 mishandles the holding of a monitor job during a query to a guest agent, which allows attackers to cause a...

CentOS 7 : unoconv (RHSA-2020:3944)

The remote CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:3944 advisory. - The unoconv package before 0.9 mishandles untrusted pathnames, leading to SSRF and local file inclusion. CVE-2019-17400 Note that Nessus has not tested for th...

PHP 7.3.x < 7.3.23 Multiple Vulnerabilities

According to its self-reported version number, the version of PHP running on the remote web server is 7.2.x prior to 7.2.34, 7.3.x prior to 7.3.23 or 7.4.x prior to 7.4.11. It is, therefore, affected by multiple vulnerabilities: - When AES-CCM mode is used with opensslencrypt function with 12 byt...

Oracle Linux 7 : cups (ELSA-2020-3864)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-3864 advisory. - 1823758 - CVE-2017-18190 cups: DNS rebinding attacks via incorrect whitelist rhel-7 - 1774460 - CVE-2019-8696 cups: stack-buffer-overflow in libcupss...

Oracle Linux 7 : libexif (ELSA-2020-4040)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4040 advisory. 0.6.22-1 - Upgrade to 0.6.22 - Resolves: 1841316 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory...

Amazon Linux 2 : golang (ALAS-2020-1494)

The version of golang installed on the remote host is prior to 1.13.15-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1494 advisory. The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder...

Email Subscribers & Newsletters Plugin for WordPress < 4.5.6 Email Forgery/Spoofing Vulnerability

The WordPress Email Subscribers & Newsletters Plugin installed on the remote host is affected by an email forgery/spoofing vulnerability in the class-es-newsletters.php class due to missing authentication for a critical function. An unauthenticated, remote attacker can exploit this via a speciall...

NewStart CGSL CORE 5.04 / MAIN 5.04 : krb5 Vulnerability (NS-SA-2020-0040)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has krb5 packages installed that are affected by a vulnerability: - A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 aka krb5 before 1.17. If an attacker can obtain a krbtgt ticket using an older encrypti...

Oracle Linux 8 : dovecot (ELSA-2020-3713)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-3713 advisory. - fix CVE-2020-12100 resource exhaustion via deeply nested MIME parts 1866755 - fix CVE-2020-12673 out of bound reads in dovecot NTLM implementation...

RHEL 8 : dovecot (RHSA-2020:3713)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3713 advisory. Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3...

Juniper Junos BGP DoS (JSA11024)

According to the self reported version of Junos OS on the remote device it is affected by a denial of service vulnerability as referenced in the JSA11024 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. C Tenab...

Microsoft SharePoint Server 2010 < 14.0.7256.5000 Multiple Vulnerabilities

According to its self-reported version number, the Microsoft SharePoint application running on the remote host is affected by multiple vulnerabilities : - A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected...

Microsoft SharePoint Server 2016 < 16.0.5044.1000 Multiple Vulnerabilities

According to its self-reported version number, the Microsoft SharePoint application running on the remote host is affected by multiple vulnerabilities : - A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected...

NewStart CGSL CORE 5.04 / MAIN 5.04 : rpm Multiple Vulnerabilities (NS-SA-2020-0039)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has rpm packages installed that are affected by multiple vulnerabilities: - RPM 4.4.x through 4.9.x, probably before 4.9.1.2, allows remote attackers to cause a denial of service memory corruption and possibly execute arbitrary...

NewStart CGSL MAIN 4.05 : ipmitool Vulnerability (NS-SA-2020-0053)

The remote NewStart CGSL host, running version MAIN 4.05, has ipmitool packages installed that are affected by a vulnerability: - It's been found that multiple functions in ipmitool before 1.8.19 neglect proper checking of the data received from a remote LAN party, which may lead to buffer...

NewStart CGSL MAIN 4.05 : sudo Vulnerability (NS-SA-2020-0047)

The remote NewStart CGSL host, running version MAIN 4.05, has sudo packages installed that are affected by a vulnerability: - In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. pwfeedback is a default...