Oracle Linux 9 : 18 (ELSA-2023-3577)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-3577 advisory. nodejs 1:18.14.2-3 - Update bundled c-ares to 1.19.1 Resolves: CVE-2023-31124 CVE-2023-31130 CVE-2023-31147 CVE-2023-32067 Tenable has extracted the...

FreeBSD : jenkins -- CSRF protection bypass vulnerability (b4db7d78-bb62-4f4c-9326-6e9fc2ddd400)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the b4db7d78-bb62-4f4c-9326-6e9fc2ddd400 advisory. - In Jenkins 2.399 and earlier, LTS 2.387.3 and earlier, POST requests are sent in order to load the li...

Ubuntu 22.04 LTS / 23.04 : .NET vulnerabilities (USN-6161-1)

The remote Ubuntu 22.04 LTS / 23.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6161-1 advisory. It was discovered that .NET did not properly enforce certain restrictions when deserializing a DataSet or DataTable from XML. An attacker could...

FreeBSD : chromium -- multiple vulnerabilities (1567be8c-0a15-11ee-8290-a8a1599412c6)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 1567be8c-0a15-11ee-8290-a8a1599412c6 advisory. - Use after free in Autofill payments in Google Chrome prior to 114.0.5735.133 allowed a remot...

Apache Struts < 2.5.31 / 6.1.2.1 Denial of Service (S2-064)

The version of Apache Struts installed on the remote host is prior to 2.5.31 or 6.1.2.1. It is, therefore, affected by a vulnerability as referenced in the S2-064 advisory. - When a Multipart request has non-file normal form fields, Struts used to bring them into memory as Strings without checkin...

Amazon Linux 2023 : runc (ALAS2023-2023-208)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-208 advisory. runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was found that rootless runc makes /sys/fs/cgroup writable in following...

Fedora 38 : kernel (2023-75b22000cd)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-75b22000cd advisory. The 6.3.7 stable kernel update contains a number of important fixes across the tree. Tenable has extracted the preceding description block directly...

Artifex Ghostscript < 10.01.1 Buffer Overflow

The version of Artifex Ghostscript installed on the remote Windows host is prior to 10.01.1. It is, therefore, affected by a buffer overflow that can lead to potential corruption of data internal to the PostScript interpreter, in base/sbcp.c. This affects BCPEncode, BCPDecode, TBCPEncode, and...

Micro Focus Access Manager < 5.0 Multiple Vulnerabilities

The version of Micro Focus Access Manager installed on the remote host is prior to 5.0. It is, therefore, affected by the following vulnerabilities: - Cross-Site scripting vulnerability in Micro Focus Access Manager product, affects all version prior to version 5.0. The vulnerability could cause...

Fedora 38 : chromium (2023-6fe7ff3452)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-6fe7ff3452 advisory. update to 114.0.5735.106. Fixes the following security issue: CVE-2023-3709 Tenable has extracted the preceding description block directly from the...

Amazon Linux AMI : golang (ALAS-2023-1760)

The version of golang installed on the remote host is prior to 1.18.6-1.44. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1760 advisory. html/template: improper sanitization of CSS values Angle brackets were not considered dangerous characters when inserted...

SUSE SLES12: libpython3_6m1_0 / libpython3_6m1_0-32bit / python36 / etc (SUSE-SU-2023:2473-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:2473-1 advisory. - CVE-2007-4559: Fixed filter for tarfile.extractall bsc1203750. - Fixed unittest.mock.patch.dict returns function when applied to coroutine...

AlmaLinux 8 : webkit2gtk3 (ALSA-2023:3433)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:3433 advisory. - An out-of-bounds read was addressed with improved input validation. CVE-2023-28204 - A use-after-free issue was addressed with improved memory managemen...

RHEL 9 : kernel-rt (RHSA-2023:3470)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3470 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirement...

FreeBSD : Kanboard -- Clipboard based cross-site scripting (blocked with default CSP) in Kanboard (79514fcd-feb4-11ed-92b5-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 79514fcd-feb4-11ed-92b5-b42e991fc52e advisory. - Kanboard is project management software that focuses on the Kanban methodology. Due to improper...

FreeBSD : chromium -- multiple vulnerabilities (fd87a250-ff78-11ed-8290-a8a1599412c6)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the fd87a250-ff78-11ed-8290-a8a1599412c6 advisory. - Out of bounds write in Swiftshader in Google Chrome prior to 114.0.5735.90 allowed a remote...

RHEL 8 : openssl (RHSA-2023:3408)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3408 advisory. OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols, as well as a full-strength...

FatPipe MPVPN < 10.1.2r60p91 / 10.2.2 < 10.2.2r42 Multiple Vulnerabilities

According to its self-reported version, the instance of FatPipe MPVPN running on the remote web server is 10.1.2r60p91 or 10.2.2 10.2.2r42. It is, therefore, affected by multiple vulnerabilities, including: - FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42...

SUSE SLES12 Security Update : ucode-intel (SUSE-SU-2023:2290-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:2290-1 advisory. - Updated to Intel CPU Microcode 20230512 release. bsc1211382 - New Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Produc...

Slackware Linux 14.2 / 15.0 / current ntfs-3g Multiple Vulnerabilities (SSA:2023-145-01)

The version of ntfs-3g installed on the remote host is prior to 2022.10.3. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2023-145-01 advisory. - ntfsck in NTFS-3G through 2021.8.22 has a heap-based buffer overflow involving buffer+5123-2. NOTE: the upstream...