A few words about Gartner’s “Magic Quadrant for Application Security Testing” 2018

February and March are the hot months for marketing reports. I already wrote about IDC and Forrester reports about Vulnerability Management-related markets. And this Monday, March 19, Gartner released new "Magic Quadrant for Application Security Testing". You can buy it on the official website fo...

Webmin 1.840 / 1.880 Local File Inclusion Vulnerability

According to its self-reported version, the Webmin install hosted on the remote host is 1.840 or 1.880. It is, therefore, affected by a local file inclusion vulnerability. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid108563; scriptversion"1.3"; scriptcvsdate"Date:...

Webmin 1.140 Multiple Vulnerabilities

According to its self-reported version, the Webmin install hosted on the remote host is 1.140. It is, therefore, affected by multiple vulnerabilities. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid108545; scriptversion"1.5";...

SUSE SLES11 Security Update : postgresql94 (SUSE-SU-2018:0755-1)

This update for postgresql94 fixes the following issues: Security issues fixed : - CVE-2018-1058: Fixed uncontrolled search path element in pgdump and other client applications bsc1081925. Bug fixes : - See release notes for details : - https://www.postgresql.org/docs/9.4/static/release-9-4-17.ht...

Fedora 27 : ming (2018-38a0e1e6f5)

Security fixes for: CVE-2017-8782, CVE-2017-9988, CVE-2017-9989, CVE-2017-11704, CVE-2017-11728, CVE-2017-11729, CVE-2017-11730, CVE-2017-11731, CVE-2017-11732, CVE-2017-11733, CVE-2017-11734, CVE-2017-16883, CVE-2017-16898, CVE-2018-5251, CVE-2018-5294, CVE-2018-6315, CVE-2018-6359 Note that...

Fedora 26 : ming (2018-8be89d9ad6)

Security fixes for: CVE-2017-8782, CVE-2017-9988, CVE-2017-9989, CVE-2017-11704, CVE-2017-11728, CVE-2017-11729, CVE-2017-11730, CVE-2017-11731, CVE-2017-11732, CVE-2017-11733, CVE-2017-11734, CVE-2017-16883, CVE-2017-16898, CVE-2018-5251, CVE-2018-5294, CVE-2018-6315, CVE-2018-6359 Note that...

Juniper Junos Space < 17.2R1 Multiple Vulnerabilities (JSA10838)

According to its self-reported version number, the remote Junos Space version is prior to 17.2R1. It is, therefore, affected by multiple vulnerabilities. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid108520; scriptversion"1.8";...

Ubuntu 14.04 LTS / 16.04 LTS : Paramiko vulnerability (USN-3603-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3603-1 advisory. Matthijs Kooijman discovered that Paramiko's SSH server implementation did not properly require authentication before processing requests. An...

Ubuntu 14.04 LTS / 16.04 LTS : Memcached vulnerability (USN-3601-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-3601-1 advisory. It was discovered that Memcached incorrectly handled reusing certain items. A remote attacker could possibly use this issue to cause Memcached to cras...

EulerOS 2.0 SP2 : irssi (EulerOS-SA-2018-1061)

According to the versions of the irssi package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in Irssi before 1.0.7 and 1.1.x before 1.1.1. A NULL pointer dereference occurs for an 'empty' nick.i1/4^...

IBM WebSphere Portal XSS Vulnerability

The version of IBM WebSphere Portal installed on the remote Windows host is affected by a cross-site scripting vulnerability. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid108488; scriptversion"1.5"; scriptcvsdate"Date: 2019/11/08"; scriptcveid"CVE-2018-1401";...

SUSE SLED12 / SLES12 Security Update : ucode-intel (SUSE-SU-2018:0708-1) (Spectre)

This update for ucode-intel fixes the following issues: The Intel CPU microcode version was updated to version 20180312. This update enables the IBPB+IBRS based mitigations of the Spectre v2 flaws boo1085207 CVE-2017-5715 - New Platforms - BDX-DE EGW A0 6-56-5:10 e000009 - SKX B1 6-55-3:97 100014...

Cisco Web Security Appliance FTP Authentication Bypass Vulnerability

According to its self-reported version, the remote Cisco Web Security Appliance WSA device is affected by a FTP authentication bypass vulnerability, due to inccorect validation of credentials. A remote attacker could potentially log into the FTP server without a valid password. TRUSTED...

SUSE SLES12 Security Update : java-1_7_1-ibm (SUSE-SU-2018:0694-1)

This update for java-171-ibm fixes the following issues: The version was updated to 7.1.4.20 bsc1082810 - Security fixes : - CVE-2018-2633 CVE-2018-2637 CVE-2018-2634 CVE-2018-2582 CVE-2018-2641 CVE-2018-2618 CVE-2018-2657 CVE-2018-2603 CVE-2018-2599 CVE-2018-2602 CVE-2018-2678 CVE-2018-2677...

Oracle Linux 6 : firefox (ELSA-2018-0526)

The remote Oracle Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2018-0526 advisory. 52.7.0-1.0.1 - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat one - Force requirement of newer gdk-pixbuf2 to ensure a proper...

Oracle Linux 7 : firefox (ELSA-2018-0527)

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2018-0527 advisory. 52.7.0-1.0.1 - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file 52.7.0-1 - Update to 52.7.0 ESR Tenable has extracted the...

SUSE SLED12 / SLES12 Security Update : postgresql94 (SUSE-SU-2018:0675-1)

This update for postgresql94 fixes the following issues: PostgreSQL was updated to version 9.4.15, the full release notes are here: https://www.postgresql.org/docs/9.4/static/release-9-4-15.html - CVE-2018-1053: Ensure that all temporary files made by pgupgrade are non-world-readable. bsc1077983...

SUSE SLES11 Security Update : xen (SUSE-SU-2018:0678-1) (Meltdown) (Spectre)

This update for xen fixes several issues. These security issues were fixed : - CVE-2017-5753, CVE-2017-5715, CVE-2017-5754: Prevent information leaks via side effects of speculative execution, aka 'Spectre' and 'Meltdown' attacks bsc1074562, bsc1068032 - CVE-2018-5683: The vgadrawtext function...

Oracle Linux 6 : libreoffice (ELSA-2018-0517)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2018-0517 advisory. 1:4.3.7.2-2.0.1.2 - Replaced RedHat colors with Oracle colors, and the filename redhat.soc with oracle.soc in specfile [email protected] - Build with...

Ubuntu 17.10 : Linux kernel vulnerabilities (USN-3597-1) (Meltdown) (Spectre)

USNS 3541-1 and 3523-1 provided mitigations for Spectre and Meltdown CVE-2017-5715, CVE-2017-5753, CVE-2017-5754 for the i386, amd64, and ppc64el architectures in Ubuntu 17.10. This update provides the corresponding mitigations for the arm64 architecture. Original advisory details : Jann Horn...