RHEL 8 : kernel-rt (RHSA-2023:4255)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4255 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirement...

macOS 13.x < 13.5 Multiple Vulnerabilities (HT213843)

The remote host is running a version of macOS / Mac OS X that is 13.x prior to 13.5. It is, therefore, affected by multiple vulnerabilities: - A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5. A...

Cross-site Scripting (XSS)

gitlab is vulnerable to Cross-site Scripting XSS. A specially crafted payload may allow a malicious attacker to execute arbitrary actions on self-hosted instances running without strict CSP...

Fedora 37 : ghostscript (2023-83c805b441)

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-83c805b441 advisory. fix for CVE-2023-36664 rhbz2217805 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

Fedora 38 : dotnet7.0 (2023-d25e798d6c)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-d25e798d6c advisory. This is the July 2023 monthly update for .NET 7. It updates the SDK to 7.0.109 and Runtime to 7.0.9...

Accepted proposal may be recreated at the same address with a malicious proposal if there's a self destruct function in the accepted proposal

Lines of code Vulnerability details Impact A malicious proposal can take over the contract address of the accepted proposal through self-destruct Proof of Concept This issue is regarding the Tornado cash hack, whereby the attacker deploys different contracts at the same address. If the proposal...

P2PInfect: Self-Replicating Worm Hits Redis Instances

By Waqas Known as 'P2PInfect,' the worm exploits a critical vulnerability to infiltrate Redis instances and assimilates them into a larger P2P network, enabling it to spread rapidly. This is a post from HackRead.com Read the original post: P2PInfect: Self-Replicating Worm Hits Redis Instances...

Amazon Linux AMI : kernel (ALAS-2023-1783)

The version of kernel installed on the remote host is prior to 4.14.320-168.534. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1783 advisory. A use-after-free flaw was found in the Netfilter subsystem of the Linux kernel when processing named and anonymous...

Oracle Linux 8 : nodejs:16 (ELSA-2023-4034)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-4034 advisory. nodejs 1:16.19.1-2 - Update bundled c-ares to 1.19.1 Resolves: CVE-2023-31124 CVE-2023-31130 CVE-2023-31147 CVE-2023-32067 Tenable has extracted the...

Debian DSA-5456-1 : chromium - security update

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5456 advisory. - Use after free in WebRTC. CVE-2023-3727, CVE-2023-3728 - Use after free in Tab Groups. CVE-2023-3730 - Out of bounds memory access in Mojo. CVE-2023-3732 -...

Amazon Linux 2 : libcap (ALAS-2023-2136)

The version of libcap installed on the remote host is prior to 2.54-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2136 advisory. libcap is vulnerable to a denial of service caused by the error handling in wrappthreadcreate function, which will cause memory to be...

Ubuntu 23.04 : Linux kernel vulnerabilities (USN-6224-1)

The remote Ubuntu 23.04 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6224-1 advisory. It was discovered that the XFS file system implementation in the Linux kernel did not properly perform metadata validation when mounting certain images. An...

Oracle E-Business Suite (Jul 2023 CPU)

The versions of Oracle E-Business Suite installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2023 CPU advisory. - Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite component: MS Excel Specific. Supported...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : curl (SUSE-SU-2023:2891-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:2891-1 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's...

FreeBSD : virtualbox-ose -- multiple vulnerabilities (bc90e894-264b-11ee-a468-80fa5b29d485)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the bc90e894-264b-11ee-a468-80fa5b29d485 advisory. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported...

Vulnerabilities fixed in Oracle E-Business Suite

Vulnerabilities have been fixed in Oracle E-Business Suite products. A malicious party could exploit the vulnerabilities to perform attacks that can result in the following categories of damage: Denial-of-Service DoS Manipulation of data Access to sensitive data Access to system data Oracle has...

SUSE SLED15: gdk-pixbuf-loader-libheif / libheif-devel / libheif1 / etc (SUSE-SU-2023:2223-2)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:2223-2 advisory. - CVE-2023-29659: Fixed segfault caused by divide-by-zero bsc1211174. Tenable has extracted the preceding...

CVE-2023-22009

Vulnerability in the Oracle Self-Service Human Resources product of Oracle E-Business Suite component: Workforce Management. Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2023-22009

Vulnerability in the Oracle Self-Service Human Resources product of Oracle E-Business Suite component: Workforce Management. Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

Design/Logic Flaw

Vulnerability in the Oracle Self-Service Human Resources product of Oracle E-Business Suite component: Workforce Management. Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...