Nagios XI 5.7.3 Remote Command Injection

Exploit Title: Nagios XI 5.7.3 - 'mibs.php' Remote Command Injection Authenticated Date: 10-27-2020 Vulnerability Discovery: Chris Lyne Vulnerability Details: https://www.tenable.com/security/research/tra-2020-58 Exploit Author: Matthew Aberegg Vendor Homepage:...

Ubuntu 20.10 : PHP vulnerabilities (USN-4583-2)

The remote Ubuntu 20.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4583-2 advisory. Several security issues were fixed in PHP. Tenable has extracted the preceding description block directly from the Ubuntu security advisory. Note that Nessus...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : MySQL vulnerabilities (USN-4604-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4604-1 advisory. Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues. MySQL...

Fedora 32 : mupdf / python-PyMuPDF / zathura-pdf-mupdf (2020-3cea1ac8f3)

mupdf 1.18.0 and depending packages Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable...

Fedora 33 : claws-mail (2020-1f60842034)

Update to 3.17.7 -- https://www.claws-mail.org/news.php Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...

Fedora 32 : singularity (2020-0fbf0db920)

Upgrade to upstream 3.6.4. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network...

Debian DLA-2415-1 : freetype security update

Sergei Glazunov discovered a heap-based buffer overflow vulnerability in the handling of embedded PNG bitmaps in FreeType. Opening malformed fonts may result in denial of service or the execution of arbitrary code. For Debian 9 stretch, this problem has been fixed in version 2.6.3-3.2+deb9u2. We...

Fedora 33 : mupdf / python-PyMuPDF / zathura-pdf-mupdf (2020-972ad7c8a8)

mupdf 1.18.0 and depending packages Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable...

Fedora 33 : 1:wireshark (2020-9bda6ae1cd)

New version 3.2.7 Security fix for CVE-2020-25862, CVE-2020-25863, CVE-2020-25866 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without...

Fedora 31 : ant (2020-3ce0f55bc5)

Update to version 1.10.9. Addresses CVE-2020-11979 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues....

Ubuntu 20.04 LTS : Tomcat vulnerabilities (USN-4596-1)

The remote Ubuntu 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4596-1 advisory. It was discovered that Tomcat did not properly manage HTTP/2 streams. An attacker could possibly use this to cause Tomcat to consume resources, resulting...

Juniper Junos OS SRX Series: High CPU Load Utilization Vulnerability (JSA11081)

The version of Junos OS installed on the remote host is SRX Series prior to 12.3X48-D105, 15.1X49-D221, 17.4R3-S3, 18.1R3-S11, 18.2R3-S3, 18.3R2-S4, 18.4R2-S5, 19.1R2-S2, 19.2R1-S5, 19.3R3, or 19.4R2. It is, therefore, affected by a vulnerability as referenced in the JSA11081 advisory. Note that...

Ubuntu 16.04 LTS : LibEtPan vulnerability (USN-4598-1)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4598-1 advisory. It was discovered that LibEtPan incorrectly handled STARTTLS when using IMAP, SMTP and POP3. A remote attacker could possibly use this issue to perform a response...

Ubuntu 16.04 LTS : mod_auth_mellon vulnerabilities (USN-4597-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4597-1 advisory. Franois Kooman discovered that modauthmellon incorrectly handled cookies. An attacker could possibly use this issue to cause a Cross-Site Session Transfe...

Ubuntu 18.04 LTS : pip vulnerability (USN-4601-1)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4601-1 advisory. It was discovered that pip did not properly sanitize the filename during pip install. A remote attacker could possible use this issue to read and write arbitrary...

Ubuntu 16.04 LTS : Pam-python vulnerability (USN-4552-2)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4552-2 advisory. Malte Kraus discovered that Pam-python mishandled certain environment variables. A local attacker could potentially use this vulnerability to execute programs as...

EulerOS 2.0 SP9 : lldpad (EulerOS-SA-2020-2234)

According to the version of the lldpad package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - lldptool version 1.0.1 and older can print a raw, unsanitized attacker controlled buffer when mngAddr information is displayed. This may allow an...

Scientific Linux Security Update : libpng on SL7.x x86_64 (20201001)

Security Fixes : - libpng: does not check length of chunks against user limit CVE-2017-12652 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid141657; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate",...

Scientific Linux Security Update : samba on SL7.x x86_64 (20201001)

Security Fixes : - samba: Crash after failed character conversion at log level 3 or above CVE-2019-14907 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid141648; scriptversion"1.3";...

Photon OS 1.0: Elasticsearch PHSA-2020-1.0-0321

An update of the elasticsearch package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-1.0-0321. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...