Amazon Linux 2023 : nspr, nspr-devel, nss (ALAS2023-2024-492)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-492 advisory. It was discovered that the numerical library used in NSS for RSA cryptography leaks information whether high order bits of the RSA decryption result are zero. This information can be used to mount a...

Amazon Linux AMI : kernel (ALAS-2024-1906)

The version of kernel installed on the remote host is prior to 4.14.336-178.554. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1906 advisory. An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux Kernel. This issue coul...

Fedora 38 : kernel (2024-c4ec5006e3)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-c4ec5006e3 advisory. The 6.6.12 stable kernel update contains a number of important fixes across the tree. Tenable has extracted the preceding description block directly...

Splunk Enterprise 9.0.0 < 9.0.8, 9.1.0 < 9.1.3 (SVD-2024-0105)

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2024-0105 advisory. - In Splunk Enterprise versions below 9.0.8 and 9.1.3, Splunk app key value store KV Store improperly handles permissions for...

RHEL 9 : openssl (RHSA-2024:0310)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0310 advisory. OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols, as well as a full-strength...

NCR Atleos Terminal Handler Cross-Site Request Forgery Vulnerability

NCR Atleos Terminal Handler is an ATM enterprise software solution from NCR Atleos that reduces costs, improves business agility and increases your competitive advantage. A cross-site request forgery vulnerability exists in NCR Atleos Terminal Handler version v.1.5.1, which originates from a...

Fedora 38 : chromium (2024-049f068a8c)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-049f068a8c advisory. update to 120.0.6099.224 - High CVE-2024-0517: Out of bounds write in V8 - High CVE-2024-0518: Type Confusion in V8 - High CVE-2024-0519: Out of...

TensorFlow CI/CD Flaw Exposed Supply Chain to Poisoning Attacks

Continuous integration and continuous delivery CI/CD misconfigurations discovered in the open-source TensorFlow machine learning framework could have been exploited to orchestrate supply chain attacks. The misconfigurations could be abused by an attacker to "conduct a supply chain compromise of...

SUSE SLES12 Security Update : xorg-x11-server (SUSE-SU-2024:0116-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0116-1 advisory. - CVE-2023-6816: Fixed heap buffer overflow in DeviceFocusEvent and ProcXIQueryPointer bsc1218582 - CVE-2024-0229: Fixed reattachin...

Oracle WebLogic Server (January 2024 CPU)

The version of Oracle WebLogic Server installed on the remote host is missing a security patch from the January 2024 Critical Patch Update CPU. It is, therefore, affected by multiple vulnerabilities, including: - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware...

bouncycastle: potential blind LDAP injection attack using a self-signed certificate

A flaw was found in Bouncy Castle 1.73. This issue targets the fix of LDAP wild cards. Before the fix there was no validation for the X.500 name of any certificate, subject, or issuer, so the presence of a wild card may lead to information disclosure. This could allow a malicious user to obtain...

Design/Logic Flaw

OPCUAServerToolkit will write a log message once an OPC UA client has successfully connected containing the client's self-defined description field...

RHEL 8 : python3 (RHSA-2024:0256)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0256 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic dat...

Security Updates for Microsoft Office Products C2R RCE (January 2024)

A security vulnerability exists in FBX that could lead to remote code execution. To mitigate this vulnerability, the ability to insert FBX files has been disabled in Word, Excel, PowerPoint and Outlook for Windows and Mac. Versions of Office that had this feature enabled will no longer have acces...

AlmaLinux 9 : ipa (ALSA-2024:0141)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:0141 advisory. - A Cross-site request forgery vulnerability exists in ipa/session/loginpassword in all supported versions of IPA. This flaw allows an attacker to trick the user...

GitLab 15.3 < 16.5.6 / 16.6 < 16.6.4 / 16.7 < 16.7.2 (CVE-2023-4812)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab EE affecting all versions starting from 15.3 before 16.5.6, all versions starting from 16.6 before 16.6.4, all versions starting from 16.7 before 16.7.2. The...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : tar (SUSE-SU-2024:0070-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:0070-1 advisory. - CVE-2023-39804: Fixed extension attributes in PAX archives incorrect hanling bsc1217969. Tenable has...

RHEL 8 : python3 (RHSA-2024:0114)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0114 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...

RHEL 8 : kernel (RHSA-2024:0113)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0113 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: use after free in...

Ivanti Connect Secure 9.x / 22.x Multiple Vulnerabilities

The Ivanti Connect Secure installed on the remote host is 9.x or 22.x. It is, therefore, affected by multiple vulnerabilities: - An authentication bypass vulnerability in the web component of Ivanti Connect Secure 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted...