CVE-2018-1142

Tenable Appliance versions 4.6.1 and earlier have been found to contain a single XSS vulnerability. Utilizing a specially crafted request, an authenticated attacker could potentially execute arbitrary JavaScript code by manipulating certain URL parameters related to offline plugins...

CVE-2018-1142

Tenable Appliance (v4.6.1 and earlier) is affected by a stored cross-site scripting (XSS) vulnerability in the web interface. An authenticated attacker could exploit this by sending a specially crafted request that manipulates URL parameters related to offline plugins to execute arbitrary JavaScr...

Tenable Nessus < 7.0.3 Sub-directory Missing Secure Permission Local Privilege Escalation (TNS-2018-01)

According to its self-reported version, the Tenable Nessus application running on the remote host is prior to 7.0.3. It is, therefore, affected by a local privilege escalation vulnerability due to the program failing to enforce secure permissions for sub-directories when a directory is installed...

Fedora 27 : chromium (2018-faff5f661e)

The remote Fedora 27 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2018-faff5f661e advisory. Update to Chromium 65. For EPEL7, it has been a long time since a successful build has been possible, so this will fix a LOT of CVEs. CVE-2017-15396...

Fedora 26 : kernel (2018-ba39fc0e07)

Incremental update to fix kernel-devel issues. ---- The 4.15.12 update contains a variety of fixes across the tree. ---- The 4.15.11 update contains a number of important fixes across the tree Note that Tenable Network Security has extracted the preceding description block directly from the Fedor...

[R1] Tenable Appliance 4.7.0 Fixes One Vulnerability

Tenable Appliance versions 4.6.1 and earlier have been found to contain a single XSS vulnerability. Utilizing a specially crafted request, an authenticated attacker could potentially execute arbitrary JavaScript code by manipulating certain URL parameters related to offline plugins...

Fedora 27 : php-simplesamlphp-saml2 (2018-6db40b0c37)

SSPSA 201803-01 / CVE-2018-7711 - SSPSA 201802-01 / CVE-2018-7644 - SSPSA 201801-01 / CVE-2018-6519 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much...

Debian DLA-1319-1 : firefox-esr security update

Richard Zhu and Huzaifa Sidhpurwala discovered that an out-of-bounds memory write when playing Vorbis media files could result in the execution of arbitrary code. For Debian 7 'Wheezy', these problems have been fixed in version 52.7.2esr-1deb7u1. We recommend that you upgrade your firefox-esr...

SUSE SLES11 Security Update : ntp (SUSE-SU-2018:0808-1)

This update for ntp fixes the following issues: Security issues fixed : - CVE-2016-1549: Significant additional protections against CVE-2016-1549 that was fixed in ntp-4.2.8p7 bsc1082210. - CVE-2018-7170: Ephemeral association time spoofing additional protection bsc1083424. - CVE-2018-7182: Buffe...

SUSE SLED12 / SLES12 Security Update : wireshark (SUSE-SU-2018:0811-1)

This update for wireshark fixes the following issues: Security issue fixed bsc1082692 : - CVE-2018-7335: The IEEE 802.11 dissector could crash wnpa-sec-2018-05 - CVE-2018-7321: thrift long dissector loop dissectthriftmap - CVE-2018-7322: DICOM: inifinite loop dissectdcmtag - CVE-2018-7323: WCCP:...

Debian DLA-1315-1 : libvirt security update

Daniel P. Berrange and Peter Krempa of Red Hat discovered a flaw in libvirt, a virtualization API. A lack of restriction for the amount of data read by QEMU Monitor socket can lead to a denial of service by exhaustion of memory resources. For Debian 7 'Wheezy', these problems have been fixed in...

Debian DLA-1317-1 : net-snmp security update

It was discovered that there was a heap corruption vulnerability in the net-snmp framework which exchanges server management information in a network. For Debian 7 'Wheezy', this issue has been fixed in net-snmp version 5.7.2.1+dfsg-1+deb8u1. We recommend that you upgrade your net-snmp packages...

Fedora 26 : monitorix (2018-1d3d0e6f2e)

Prior Monitorix versions are vulnerable to cross-site scripting XSS, caused by improper validation of user-supplied input by the monitorix.cgi file. A remote attacker could exploit this vulnerability using some of the arguments provided graph= or when= in a specially crafted URL to execute script...

Fedora 27 : puppet (2018-45d8b8ae21)

Update to latest puppet 4 release 4.10.10. Fixing a minor security issue. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without...

Fedora 26 : php-simplesamlphp-saml2 (2018-f4ab4d96f9)

SSPSA 201803-01 / CVE-2018-7711 - SSPSA 201802-01 / CVE-2018-7644 - SSPSA 201801-01 / CVE-2018-6519 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much...

Ubuntu 14.04 LTS / 16.04 LTS : Screen Resolution Extra vulnerability (USN-3607-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-3607-1 advisory. It was discovered that Screen Resolution Extra was using PolicyKit in an unsafe manner. A local attacker could potentially exploit this issue to bypas...

Fedora 27 : php-simplesamlphp-saml2_3 (2018-37e28670f2)

SSPSA 201803-01 / CVE-2018-7711 - SSPSA 201802-01 / CVE-2018-7644 - SSPSA 201801-01 / CVE-2018-6519 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much...

Virtuozzo 7 : readykernel-patch (VZA-2018-015)

According to the version of the vzkernel package and the readykernel-patch installed, the Virtuozzo installation on the remote host is affected by the following vulnerability : - It was discovered that the implementation of ebtables in the kernel did not properly validate the offsets received fro...

SUSE SLED12 / SLES12 Security Update : curl (SUSE-SU-2018:0769-1)

This update for curl fixes the following issues: Following security issues were fixed : - CVE-2018-1000120: A buffer overflow exists in the FTP URL handling that allowed an attacker to cause a denial of service or possible code execution bsc1084521. - CVE-2018-1000121: A NULL pointer dereference...

IBM DB2 9.7 < FP11 Special Build 37314 / 10.1 < FP6 Special Build 37313 / 10.5 < FP10 Special Build 37311 / 11.1.3 < FP3 JDBC Driver Unsafe Deserialization Local Privilege Escalation (UNIX)

According to its version, the installation of IBM DB2 running on the remote host is either 9.7 prior to Fix Pack 11 Special Build 37314, 10.1 prior to Fix Pack 6 Special Build 37313, 10.5 prior to Fix Pack 10 Special Build 37311, or 11.1.3 prior to Fix Pack 3. It is, therefore, affected by a loca...