Amazon Linux 2023 : openssh, openssh-clients, openssh-keycat (ALAS2023-2024-651)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-651 advisory. A signal handler race condition vulnerability was found in OpenSSH's server sshd, where a client does not authenticate within LoginGraceTime seconds 120 by default, 600 in old OpenSSH versions, then...

EulerOS 2.0 SP8 : sudo (EulerOS-SA-2024-2055)

According to the versions of the sudo package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Sudo before 1.9.13 does not escape control characters in sudoreplay output.CVE-2023-28487 Sudo before 1.9.13 does not escape control characters in lo...

EulerOS 2.0 SP8 : openssl (EulerOS-SA-2024-2044)

According to the versions of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An...

EulerOS 2.0 SP8 : libgit2 (EulerOS-SA-2024-2039)

According to the versions of the libgit2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionalit...

Hikvision DVRs Devices Buffer Overflow (CVE-2014-4878)

While processing specified RTSP requests, buffer overflow vulnerabilities may occurs for select Hikvision DVRs, which may result in potential service interruption for users. These issues have been assigned Common Vulnerabilities and Exposures CVE ID: CVE-2014-4878, CVE-2014-4879 and CVE-2014-4880...

Amazon Linux 2023 : httpd, httpd-core, httpd-devel (ALAS2023-2024-656)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-656 advisory. Encoding problem in modproxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafte...

SUSE SLES12 Security Update : kernel (Live Patch 49 for SLE 12 SP5) (SUSE-SU-2024:2549-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2549-1 advisory. This update for the Linux Kernel 4.12.14-122179 fixes several issues. The following security issues were fixed: - CVE-2021-47383: Fixed...

Hikvision Cameras Password in Configuration File (CVE-2017-7923)

While processing a specified request code, the user privilege-escalating vulnerability may occur for select Hikvision IP cameras with particular firmware version. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL...

EulerOS 2.0 SP8 : bind (EulerOS-SA-2024-2018)

According to the versions of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Certain DNSSEC aspects of the DNS protocol in RFC 4033, 4034, 4035, 6840, and related RFCs allow remote attackers to cause a denial of service CPU...

Amazon Linux 2023 : wget (ALAS2023-2024-657)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-657 advisory. url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent i...

Hikvision IP Cameras Buffer Overflow (CVE-2013-4977)

Buffer overflow in the RTSP Packet Handler in Hikvision DS-2CD7153-E IP camera with firmware 4.1.0 b130111 Jan 2013, and possibly other devices, allows remote attackers to cause a denial of service device crash and reboot and possibly execute arbitrary code via a long string in the Range header...

Amazon Linux 2023 : wireshark-cli, wireshark-devel (ALAS2023-2024-673)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-673 advisory. Memory handling issue in editcap could cause denial of service via crafted capture file CVE-2024-4853 MONGO and ZigBee TLV dissector infinite loops in Wireshark 4.2.0 to 4.2.4, 4.0.0 to 4.0.14,...

EulerOS 2.0 SP8 : python-idna (EulerOS-SA-2024-2049)

According to the versions of the python-idna packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability was identified in the kjd/idna library, specifically within the idna.encode function, affecting version 3.6. The issue arises...

Hikvision Multiple Products OS Command Injection (CVE-2021-36260)

A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands. This plugin only works with Tenable.ot. Please vis...

EulerOS 2.0 SP8 : graphviz (EulerOS-SA-2024-2031)

According to the versions of the graphviz packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Graphviz 2.36.0 through 9.x before 10.0.1 has an out-of-bounds read via a crafted config6a file. NOTE: exploitability may be uncommon because th...

EulerOS 2.0 SP8 : grub2 (EulerOS-SA-2024-2033)

According to the versions of the grub2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in the grub2-set-bootflag utility of grub2. After the fix of CVE-2019-14865, grub2-set- bootflag will create a temporary file with...

Amazon Linux 2023 : default-editor, nano, nano-default-editor (ALAS2023-2024-652)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-652 advisory. nano: running chmod and chown on the filename allows malicious user to replace the emergency file with a malicious symlink to a root-owned file CVE-2024-5742 Tenable has extracted the preceding...

Hikvision NVRs Devices HTTP Buffer Overflow (CVE-2015-4408)

Buffer overflow on Hikvision NVR DS-76xxNI-E1/2 and DS-77xxxNI-E4 devices before 3.4.0 allows remote authenticated users to cause a denial of service service interruption via a crafted HTTP request, aka the ISAPI issue. This plugin only works with Tenable.ot. Please visit...

Amazon Linux 2023 : ecs-service-connect-agent (ALAS2023-2024-655)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-655 advisory. dd-trace-cpp is the Datadog distributed tracing for C++. When the library fails to extract trace context due to malformed unicode, it logs the list of audited headers and their values using the nlohmann...

EulerOS 2.0 SP8 : dnsmasq (EulerOS-SA-2024-2023)

According to the versions of the dnsmasq packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Certain DNSSEC aspects of the DNS protocol in RFC 4033, 4034, 4035, 6840, and related RFCs allow remote attackers to cause a denial of service CP...