Ubuntu 14.04 LTS : Munin vulnerability (USN-3215-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3215-1 advisory. It was discovered that Munin incorrectly handled CGI graphs. A remote attacker could use this issue to overwrite arbitrary files as the www-data user. Tenable has...

Tenable Nessus Cross-Site Scripting Vulnerability (CNVD-2017-02596)

Tenable Network Security Tenable Nessus is an open source vulnerability scanner from Tenable Network Security, USA. A cross-site scripting vulnerability exists in versions of Tenable Network Security Tenable Nessus prior to 6.9.1. A remote attacker can exploit this vulnerability to inject arbitra...

Tenable Log Correlation Engine Cross-Site Scripting Vulnerability

Tenable Log Correlation Engine a.k.a. LCE is a log correlation engine that provides log analysis and event monitoring from Tenable Network Security. A cross-site scripting vulnerability exists in versions of Tenable LCE prior to 4.8.1. A remote attacker can exploit this vulnerability to execute...

CVE-2016-9261

Cross-site scripting XSS vulnerability in Tenable Log Correlation Engine aka LCE before 4.8.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-9259

Cross-site scripting XSS vulnerability in Tenable Nessus before 6.9.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in Tenable Log Correlation Engine aka LCE before 4.8.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-9261

Cross-site scripting XSS vulnerability in Tenable Log Correlation Engine aka LCE before 4.8.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-9261

Tenable Log Correlation Engine (LCE) is affected in versions prior to 4.8.1 by cross-site scripting (XSS) vulnerabilities. The Nessus plugin aggregates multiple CVEs affecting LCE, including CVE-2016-9261, describing a vulnerability where an authenticated, remote attacker can inject arbitrary web...

CVE-2016-9259

Cross-site scripting XSS vulnerability in Tenable Nessus before 6.9.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-9259

CVE-2016-9259 refers to a cross-site scripting (XSS) vulnerability in Tenable Nessus prior to version 6.9.1. Connected sources describe it as a stored XSS flaw caused by improper validation of user-supplied input, exploitable by an authenticated remote attacker via specially crafted requests to e...

Fedora 24 : 2:vim (2017-9b2cf468d5)

The newest upstream commit, fixing CVE-2017-5953 vim: Tree length values not validated properly when handling a spell file Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2017-3521)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-3521 advisory. kernel-uek 3.8.13-118.16.4 - dccp: fix freeing skb too early for IPV6RECVPKTINFO Andrey Konovalov CVE-2017-6074 Tenable has extracted the preceding...

Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2017-3522)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-3522 advisory. 2.6.39-400.294.3 - dccp: fix freeing skb too early for IPV6RECVPKTINFO Andrey Konovalov Orabug: 25598277 CVE-2017-6074 Tenable has extracted the preceding...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2017-3520)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-3520 advisory. kernel-uek 4.1.12-61.1.28 - dccp: fix freeing skb too early for IPV6RECVPKTINFO Andrey Konovalov Orabug: 25598257 CVE-2017-6074 Tenable has extracted the...

Fedora 25 : 1:xrdp (2017-8fffbae8af)

WARNING: Please note that this update comes with a slightly different syntax of sesman.ini file, so if you edited this file by hand, you may need to look at the .rpmnew file and merge any required changes by hand. This release also creates three files in /etc/xrdp directory if they don't already...

Ubuntu 14.04 LTS / 16.04 LTS : LibreOffice vulnerability (USN-3210-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3210-1 advisory. Ben Hayak discovered that it was possible to make LibreOffice Calc and Writer disclose arbitrary files to an attacker if a user opened a specially...

Oracle Linux 6 : kernel (ELSA-2017-0307)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-0307 advisory. - net dccp: fix freeing skb too early for IPV6RECVPKTINFO Hannes Frederic Sowa 1424626 1424628 CVE-2017-6074 - net sctp: validate chunk len before...

Debian DLA-832-1 : bitlbee security update

CVE-2017-5668 Fix for incomplete fix for 'NULL pointer dereference with file transfer request from unknown contacts'. Though this package wasn't in Wheezy with this issue, I mention it here. The fix was done with the second patch for CVE-2016-10189 CVE-2016-10189 NULL pointer dereference with fil...

Ubuntu 16.04 LTS : PHP vulnerabilities (USN-3211-1)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3211-1 advisory. It was discovered that PHP incorrectly handled certain invalid objects when unserializing data. A remote attacker could use this issue to cause PHP to...

SUSE SLED12 / SLES12 Security Update : util-linux (SUSE-SU-2017:0555-1)

This update for util-linux fixes the following issues: This security issue was fixed : - CVE-2017-2616: In su with PAM support it was possible for local users to send SIGKILL to selected other processes with root privileges bsc1023041. The update package also includes non-security fixes. See...