Synology DiskStation Manager SQL Injection (CVE-2021-43927)

Improper neutralization of special elements used in an SQL command 'SQL Injection' vulnerability in Security Management functionality in Synology DiskStation Manager DSM before 7.0.1-42218-2 allows remote attackers to inject SQL commands via unspecified vectors. This plugin only works with...

Synology DiskStation Manager Open Redirect (CVE-2024-0854)

URL redirection to untrusted site 'Open Redirect' vulnerability in file access component in Synology DiskStation Manager DSM before 7.2.1-69057-2 allows remote authenticated users to conduct phishing attacks via unspecified vectors. This plugin only works with Tenable.ot. Please visit...

Synology DiskStation Manager Netatalk Out-of-bounds Write (CVE-2018-1160)

Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsiopensess.c. This is due to lack of bounds checking on attacker controlled data. A remote unauthenticated attacker can leverage this vulnerability to achieve arbitrary code execution. This plugin only works with Tenable.ot. Pleas...

Synology DiskStation Manager Exposure of Sensitive Information to an Unauthorized Actor (CVE-2018-8919)

Information exposure vulnerability in SYNO.Core.Desktop.SessionData in Synology DiskStation Manager DSM before 6.1.6-15266 allows remote attackers to steal credentials via unspecified vectors. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for mor...

Slackware Linux 15.0 / current mozilla-firefox Multiple Vulnerabilities (SSA:2024-275-02)

The version of mozilla-firefox installed on the remote host is prior to 115.16.0esr / 128.3.0esr. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2024-275-02 advisory. New mozilla-firefox packages are available for Slackware 15.0 and -current to fix security issues...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS : Python vulnerability (USN-7015-3)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-7015-3 advisory. USN-7015-1 fixed several vulnerabilities in Python. This update provides the corresponding updates for CVE-2023-27043 for...

RHEL 8 : kpatch-patch-4_18_0-305_120_1 and kpatch-patch-4_18_0-305_138_1 (RHSA-2024:7427)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:7427 advisory. This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patch...

Synology DiskStation Manager Server-Side Request Forgery (SSRF) (CVE-2022-27622)

Server-Side Request Forgery SSRF vulnerability in Package Center functionality in Synology DiskStation Manager DSM before 7.1-42661 allows remote authenticated users to access intranet resources via unspecified vectors. This plugin only works with Tenable.ot. Please visit...

F5 Networks BIG-IP : Perl vulnerability (K000141301)

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K000141301 advisory. Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers to execute...

Synology DiskStation Manager Improper Neutralization of Special Elements used in a Command (CVE-2017-12075)

Command injection vulnerability in EZ-Internet in Synology DiskStation Manager DSM before 6.2-23739 allows remote authenticated users to execute arbitrary command via the username parameter. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more...

Oracle Linux 7 : krb5 (ELSA-2024-5076)

"The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-5076 advisory. - Fix integer overflows in PAC parsing CVE-2022-42898 - Fix KDC null deref on TGS inner body null server CVE-2021-37750 - Fix flaws in LDAP DN checkin...

RHEL 8 : cups-filters (RHSA-2024:7461)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:7461 advisory. The cups-filters package contains back ends, filters, and other software that was once part of the core Common UNIX Printing System CUPS...

FreeBSD : Slixmpp -- Lack of SSL Certificate hostname validation in XMLStream (f9cfdb00-7f43-11ef-9b27-592d55dd336d)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the f9cfdb00-7f43-11ef-9b27-592d55dd336d advisory. NIST reports: Slixmpp before 1.8.3 lacks SSL Certificate hostname validation in XMLStream, allowing an...

Ubuntu 20.04 LTS : Knot Resolver vulnerabilities (USN-7047-1)

The remote Ubuntu 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7047-1 advisory. Vladimr unt discovered that Knot Resolver incorrectly handled input during DNSSEC validation. A remote attacker could possibly use this issue to bypass...

FreeBSD : chromium -- multiple security fixes (2f82696c-adad-447b-9938-c99441805fa3)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 2f82696c-adad-447b-9938-c99441805fa3 advisory. Chrome Releases reports: This update includes 5 security fixes: Tenable has extracted the...

Rocky Linux 9 : firefox (RLSA-2024:6681)

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:6681 advisory. firefox: 115.15/128.2 ESR mozilla: Type confusion when looking up a property name in a with block CVE-2024-8381 mozilla: Internal event interfaces were...

Rocky Linux 9 : pcp (RLSA-2024:6848)

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:6848 advisory. pcp: pmpost symlink attack allows escalating pcp to root user CVE-2024-45770 pcp: pmcd heap corruption through metric pmstore operations CVE-2024-45769...

SUSE SLES15 Security Update : kernel (Live Patch 1 for SLE 15 SP6) (SUSE-SU-2024:3468-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3468-1 advisory. This update for the Linux Kernel 6.4.0-150600235 fixes several issues. The following security issues were fixed: - CVE-2024-40909: Fix a...

Oracle Linux 8 / 9 : Unbreakable Enterprise kernel (ELSA-2024-12682)

The remote Oracle Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-12682 advisory. - dmaengine: idxd: add a write method for applications to submit work Nikhil Rao Orabug: 36770955 CVE-2024-21823 - dmaengine: idxd: add a new...

RockyLinux 8 : kernel-rt (RLSA-2024:7001)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:7001 advisory. CVE-2023-6040 CVE-2024-26595 CVE-2021-46984 CVE-2023-52478 CVE-2023-52476 CVE-2023-52522 CVE-2021-47101 CVE-2021-47097 CVE-2023-52605 CVE-2024-26645...