EulerOS 2.0 SP8 : grub2 (EulerOS-SA-2024-1270)

According to the versions of the grub2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An out-of-bounds write flaw was found in grub2's NTFS filesystem driver. This issue may allow an attacker to present a specially crafted NTFS...

EulerOS 2.0 SP10 : sudo (EulerOS-SA-2024-1348)

According to the versions of the sudo package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Sudo before 1.9.15 might allow row hammer attacks for authentication bypass or privilege escalation because application logic sometimes is based on...

EulerOS 2.0 SP8 : golang (EulerOS-SA-2024-1269)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a...

EulerOS 2.0 SP8 : linux-firmware (EulerOS-SA-2024-1284)

According to the versions of the linux-firmware packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Improper access control for some IntelR PROSet/Wireless WiFi and KillerTM WiFi software may allow a privileged user to potentially enabl...

Microsoft Confirms Russian Hackers Stole Source Code, Some Customer Secrets

Microsoft on Friday revealed that the Kremlin-backed threat actor known as Midnight Blizzard aka APT29 or Cozy Bear managed to gain access to some of its source code repositories and internal systems following a hack that came to light in January 2024. "In recent weeks, we have seen evidence that...

Fedora 39 : python3.6 (2024-8732282e7b)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-8732282e7b advisory. Fix tests for XMLPullParser with Expat 2.6.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Ness...

Tenable Agent Identification

Binary data agentidentify.nbin...

Tenable Identity Exposure < 3.59.4 Multiple Vulnerabilities (TNS-2024-04)

The version of Tenable Identity Exposure formerly Tenable.ad installed on the remote host is prior to 3.59.4. It is, therefore, affected by multiple vulnerabilities in the bundled .NET core component as referenced in the TNS-2024-04 advisory. - .NET, .NET Framework, and Visual Studio Security...

MikroTik RouterOS Out-of-bounds Write (CVE-2018-1156)

Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to stack buffer overflow through the license upgrade interface. This vulnerability could theoretically allow a remote authenticated attacker execute arbitrary code on the system. This plugin only works with Tenable.ot. Please visit...

MikroTik RouterOs Out-of-bounds Write (CVE-2020-20231)

Mikrotik RouterOs through stable version 6.48.3 suffers from a memory corruption vulnerability in the /nova/bin/detnet process. An authenticated remote attacker can cause a Denial of Service NULL pointer dereference. This plugin only works with Tenable.ot. Please visit...

CVE-2024-1683 DLL Injection in Tenable Identity Exposure Secure Relay

A DLL injection vulnerability exists where an authenticated, low-privileged local attacker could modify application files on the TIE Secure Relay host, which could allow for overriding of the configuration and running of new Secure Relay services...

CVE-2024-1683 DLL Injection in Tenable Identity Exposure Secure Relay

A DLL injection vulnerability exists where an authenticated, low-privileged local attacker could modify application files on the TIE Secure Relay host, which could allow for overriding of the configuration and running of new Secure Relay services...

Tenable Identity Exposure Secure Relay Operating System Command Injection Vulnerability

Tenable Identity Exposure Secure Relay is a schema for transferring Active Directory data from the network to Tenable Identity Exposure using Transport Layer Security TLS from Tenable USA. A security vulnerability exists in Tenable Identity Exposure Secure Relay versions prior to 3.59.4, which...

[R2] Tenable Identity Exposure Version 3.59.4 Fixes Multiple Vulnerabilities

R2 Tenable Identity Exposure Version 3.59.4 Fixes Multiple Vulnerabilities Arnie Cabral Wed, 02/21/2024 - 13:26 Tenable Identity Exposure leverages third-party software to help provide underlying functionality. One of the third-party components ASP.NET Core was found to contain vulnerabilities, a...

[R1] Tenable Identity Exposure Secure Relay Version 3.59.4 Fixes Multiple Vulnerabilities

R1 Tenable Identity Exposure Secure Relay Version 3.59.4 Fixes Multiple Vulnerabilities Arnie Cabral Wed, 02/21/2024 - 10:51 Tenable Identity Exposure Secure Relay leverages third-party software to help provide underlying functionality. One of the third-party components Envoy was found to contain...

Tenable Security Center < 6.3.0 Multiple Vulnerabilities (TNS-2024-02)

According to its self-reported version, the Tenable Security Center running on the remote host is prior to version 6.3.0. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2024-02 advisory. - Security Center leverages third-party software to help provide underlying...

CVE-2024-1367 Command Injection Vulnerability in Tenable Security Center

A command injection vulnerability exists where an authenticated, remote attacker with administrator privileges on the Security Center application could modify Logging parameters, which could lead to the execution of arbitrary code on the Security Center host...

[R1] Security Center Version 6.3.0 Fixes Multiple Vulnerabilities

R1 Security Center Version 6.3.0 Fixes Multiple Vulnerabilities Arnie Cabral Wed, 02/14/2024 - 10:00 Security Center leverages third-party software to help provide underlying functionality. One of the third-party components sqlite was found to contain vulnerabilities, and updated versions have be...

Wago 750-88X and 750-89X Cross-site Scripting (CVE-2018-16210)

WAGO 750-88X and WAGO 750-89X Ethernet Controller devices, versions 01.09.1813 and before, have XSS in the SNMP configuration via the webserv/cplcfg/snmp.ssi SNMPDESC or SNMPLOCSNMPCONT field. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for mor...

Fat Patch Tuesday, February 2024 Edition

Microsoft Corp. today pushed software updates to plug more than 70 security holes in its Windows operating systems and related products, including two zero-day vulnerabilities that are already being exploited in active attacks. Top of the heap on this Fat Patch Tuesday is CVE-2024-21412, a...