Oracle Linux 7 : bind (ELSA-2017-0062)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-0062 advisory. - Fix CVE-2016-9131 ISC change 4508 - Fix CVE-2016-9147 ISC change 4510 - Fix regression introduced by CVE-2016-8864 ISC change 4530 Tenable has...

Fedora 25 : SimGear (2017-6a2709f065)

This update avoids a malicious repository writing to files outside the local storage root. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possibl...

Fedora 25 : ca-certificates (2017-9784ee67f2)

This is an update to the Mozilla CA certificates list version 2.11, which has been published as part of Mozilla NSS 3.28.1. For additional details, please refer to the NSS 3.28.1 release notes: https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS3.28 .1releasenotes Note: This package...

Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2017-3510)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-3510 advisory. - tcp: fix use after free in tcpxmitretransmitqueue Eric Dumazet Orabug: 25374376 CVE-2016-6828 - ALSA: pcm : Call killfasync in stream lock Takash...

Ubuntu 14.04 LTS / 16.04 LTS : Bind vulnerabilities (USN-3172-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3172-1 advisory. It was discovered that Bind incorrectly handled certain malformed responses to an ANY query. A remote attacker could possibly use this issue ...

Oracle Linux 5 / 6 / 7 : java-1.6.0-openjdk (ELSA-2017-0061)

The remote Oracle Linux 5 / 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-0061 advisory. 1:1.6.0.41-1.13.13.1.0.1 - Add oracle-enterprise.patch 1:1.6.0.41-1.13.13.1 - Update to new 1.13.13 and b41 tarballs to correct TCK failure. -...

Ubuntu 14.04 LTS / 16.04 LTS : LibVNCServer vulnerabilities (USN-3171-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3171-1 advisory. Josef Gajdusek discovered that the LibVNCServer client library incorrectly handled certain FrameBufferUpdate messages. If a user were tricked...

Ubuntu 16.04 LTS : Linux kernel (Qualcomm Snapdragon) vulnerabilities (USN-3169-4)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3169-4 advisory. Baozeng Ding discovered a race condition that could lead to a use-after- free in the Advanced Linux Sound Architecture ALSA subsystem of the Linux kernel...

Advantech WebAccess

CVSS V3 9.8 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Advantech Equipment: WebAccess Vulnerabilities: Authentication Bypass, SQL Injection AFFECTED PRODUCTS The following WebAccess version is affected: WebAccess Version 8.1 IMPACT Successful exploitation of this...

Ubuntu 16.04 LTS : Linux kernel (Raspberry Pi 2) vulnerabilities (USN-3169-3)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3169-3 advisory. Baozeng Ding discovered a race condition that could lead to a use-after- free in the Advanced Linux Sound Architecture ALSA subsystem of the Linux kernel...

Ubuntu 16.04 LTS : WebKitGTK+ vulnerabilities (USN-3166-1)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3166-1 advisory. A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, ...

Oracle Linux 6 : kernel (ELSA-2017-0036)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-0036 advisory. - net Fix use after free in the recvmmsg exit path Davide Caratti 1390805 1390046 CVE-2016-7117 - net tcp: fix use after free in tcpxmitretransmitqueue...

Tenable Passive Vulnerability Scanner 5.x < 5.2.0 Multiple Vulnerabilities (SWEET32)

The version of Tenable Passive Vulnerability Scanner PVS installed on the remote host is 5.x 5.2.0. It is, therefore, affected by multiple vulnerabilities : - Multiple denial of service vulnerabilities exist in Expat within file xmlparse.c due to a logical error in hash computations. An...

Tenable Nessus Cross-Site Scripting Vulnerability (CNVD-2017-00224)

Tenable Network Security Tenable Nessus is an open source vulnerability scanner from Tenable Network Security, USA. A cross-site scripting vulnerability exists in versions of Tenable Network Security Tenable Nessus prior to 6.9.3. A remote attacker can exploit this vulnerability to inject arbitra...

CVE-2017-5179

Cross-site scripting XSS vulnerability in Tenable Nessus before 6.9.3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2017-5179

CVE-2017-5179 is a stored XSS vulnerability in Tenable Nessus prior to 6.9.3. An authenticated user can inject arbitrary script/HTML into Nessus pages, potentially causing the victim’s browser to execute code in the context of the logged-in user. Affected product/version: Nessus before 6.9.3. Roo...

CVE-2017-5179

Cross-site scripting XSS vulnerability in Tenable Nessus before 6.9.3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

Oracle Linux 6 : ghostscript (ELSA-2017-0014)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-0014 advisory. 8.70-211 - Added security fixes for: - CVE-2013-5653 bug 1380327 - CVE-2016-7977 bug 1380415 - CVE-2016-7979 bug 1382305 - CVE-2016-8602 bug 1383940...

KLA10926 Cross-site scripting vulnerability in Tenable Nessus

Cross-site scripting vulnerability was found in Tenable Nessus. By exploiting this vulnerability malicious users can inject HTML code or arbitrary web script. This vulnerability can be exploited remotely via unspecified vectors. Original advisories Nessus 6.9.3 Release Notes Related products Ness...

Debian DLA-767-1 : curl security update

It was discovered that libcurl's implementation of the printf functions triggers a buffer overflow when doing a large floating point output. The bug occurs when the conversion outputs more than 255 bytes. The flaw happens because the floating point conversion is using system functions without the...