Fedora 37 : webkitgtk (2023-be1ed6a2b4)

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-be1ed6a2b4 advisory. Update to 2.40.3: Make memory pressure monitor honor memory.memsw.usageinbytes if exists. Include key modifiers in wheel events. Apply cookie blocking policy...

openSUSE 15 Security Update : rekor (SUSE-SU-2023:2744-1)

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2023:2744-1 advisory. - rebuild the package with the go 1.20 security release bsc1206346. Tenable has extracted the preceding description block directly from the SUSE security...

Debian DSA-5442-1 : flask - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-5442 advisory. It was discovered that in some conditions the Flask web framework may disclose a session cookie. For the oldstable distribution bullseye, this problem has been fixed in...

Amazon Linux 2023 : openssl, openssl-devel, openssl-libs (ALAS2023-2023-222)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-222 advisory. Issue summary: Processing some specially crafted ASN.1 object identifiers ordata containing them may be very slow. Impact summary: Applications that use OBJobj2txt directly, or use any ofthe OpenSSL...

LearnDash Plugin for WordPress < 4.6.0.1 Insecure Direct Object Reference

The WordPress LearnDash Plugin installed on the remote host is affected by an Insecure Direct Object Reference. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for attackers with existin...

Amazon Linux 2023 : screen (ALAS2023-2023-224)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-224 advisory. socket.c in GNU Screen through 4.9.0, when installed setuid or setgid the default on platforms such as Arch Linux and FreeBSD, allows local users to send a privileged SIGHUP signal to any PID, causing a...

FreeBSD : chromium -- multiple vulnerabilities (ad05a737-14bd-11ee-8290-a8a1599412c6)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ad05a737-14bd-11ee-8290-a8a1599412c6 advisory. - Type Confusion in V8 in Google Chrome prior to 114.0.5735.198 allowed a remote attacker to...

RHEL 8 : Red Hat Single Sign-On 7.6.4 security update on RHEL 8 (Important) (RHSA-2023:3884)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3884 advisory. Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single...

Rocky Linux 8 : webkit2gtk3 (RLSA-2023:3433)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:3433 advisory. - An out-of-bounds read was addressed with improved input validation. This issue is fixed in watchOS 9.5, iOS 15.7.6 and iPadOS 15.7.6, macOS Ventura...

AlmaLinux 9 : libvirt (ALSA-2023:3715)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2023:3715 advisory. - A vulnerability was found in libvirt. This security flaw ouccers due to repeatedly querying an SR-IOV PCI device's capabilities that exposes a memory leak caused...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : golang-github-vpenso-prometheus_slurm_exporter (SUSE-SU-2023:2297-2)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:2297-2 advisory. - rebuild the package with the go 1.19 security release bsc1200441 bsc1209658. Tenable has extracted the...

Fedora 37 : dotnet6.0 (2023-edb993aeaf)

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-edb993aeaf advisory. This is the June 2023 monthly update for .NET 6. It includes fixes for several CVEs. Release Notes: - Runtime:...

F5 Networks BIG-IP : BIG-IP SIP profile vulnerability (K34525368)

The version of F5 Networks BIG-IP installed on the remote host is prior to 14.1.5.3 / 15.1.8 / 16.1.3.3. It is, therefore, affected by a vulnerability as referenced in the K34525368 advisory. - On BIG-IP versions 16.1.x before 16.1.3.3, 15.1.x before 15.1.8, 14.1.x before 14.1.5.3, and all versio...

F5 Networks BIG-IP : Apache Commons FileUpload vulnerability (K000133052)

The version of F5 Networks BIG-IP installed on the remote host is prior to 17.1.3 / 17.5.1.1. It is, therefore, affected by a vulnerability as referenced in the K000133052 advisory. Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the...

SUSE SLED15 / SLES15 Security Update : terraform-provider-helm (SUSE-SU-2023:2322-2)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:2322-2 advisory. - rebuild the package with the go 1.19 security release bsc1200441. Tenable has extracted the preceding description blo...

Oracle Linux 9 : postgresql (ELSA-2023-3714)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-3714 advisory. 13.11-1.0.1 - Fixed postgresql port binding issue during bootup Orabug: 35420628 13.11-1 - Update to 13.11 - Resolves: 2207935 Tenable has extracted th...

ISC BIND 9.16.33 < 9.16.42 / 9.16.33-S1 < 9.16.42-S1 / 9.18.7 < 9.18.16 / 9.18.11-S1 < 9.18.16-S1 Vulnerability (cve-2023-2911)

The version of ISC BIND installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the cve-2023-2911 advisory. - If the recursive-clients quota is reached on a BIND 9 resolver configured with both stale-answer-enable yes; and...

Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 ESM : VLC media player vulnerabilities (USN-6180-1)

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6180-1 advisory. It was discovered that VLC could be made to read out of bounds when decoding image files. If a user were tricked into...

Fedora 38 : golang (2023-802ea02cf1)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-802ea02cf1 advisory. go1.20.5 released 2023-06-06 includes four security fixes to the cmd/go and runtime packages, as well as bug fixes to the compiler, the go command, the...

Security Updates for Microsoft Team Foundation Server and Azure DevOps Server (June 2023)

The Microsoft Team Foundation Server or Azure DevOps install is missing security updates. It is, therefore, affected by multiple server spoofing vulnerabilities. An attacker who successfully exploited the vulnerability could access data that is available for the current user. Depending on the...