Apache mod_suexec Multiple Privilege Escalation Vulnerabilities

The remote host appears to be running Apache and is potentially affected by the following vulnerabilities: - Multiple race conditions exist in suexec between the validation and usage of directories and files. Under certain conditions local users are able to escalate privileges and execute arbitra...

Do not scan printers

The remote host appears to be a network printer, multi-function device, or other fragile device. Such devices often react very poorly when scanned. To avoid problems, Nessus has marked the remote host as 'Dead' and will not scan it, beyond minimal probing traffic that allows the scanner to identi...

F5 Networks BIG-IP : OpenSSL vulnerability (K13167034)

The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted...

Apache Tomcat 9.0.30 < 9.0.65

The version of Tomcat installed on the remote host is prior to 9.0.65. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat9.0.65security-9 advisory. - In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form...

Unpassworded 'OutOfBox' Account

The account 'OutOfBox' has no password set. An attacker may use the account to gain further privileges on this system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. account = "OutOfBox"; include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid11244; scriptversion"1.36...

Security Updates for Windows 10 / Windows Server 2016 (September 2018) (Spectre)

The remote Windows host is missing a security update. It is, therefore, missing microcode updates to address Spectre Variant 2 CVE-2017-5715: Branch Target Injection vulnerability. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid119239; scriptversion"1.8";...

Microsoft Windows SMB2 and SMB3 Dialects Supported (remote check)

Nessus was able to obtain the set of SMB2 and SMB3 dialects running on the remote host by sending an authentication request to port 139 or 445. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid106716; scriptversion"1.6";...

TFTP Traversal Arbitrary File Access

The TFTP Trivial File Transfer Protocol server running on the remote host is vulnerable to a directory traversal attack that allows an attacker to read arbitrary files on the remote host by prepending their names with directory traversal sequences. %NASLMINLEVEL 70300 C Tenable Network Security,...

MySQL 8.0.x < 8.0.26 Multiple Vulnerabilities (July 2025 CPU)

The version of MySQL running on the remote host is 8.0.x prior to 8.0.26. It is, therefore, affected by multiple vulnerabilities, including the following, as noted in the July 2021 Critical Patch Update advisory: - curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting i...

ESXi 6.5 / 6.7 / 7.0 RCE (VMSA-2021-0002)

The remote VMware ESXi host is version 6.5, 6.7 or 7.0 and is affected by a remote code execution vulnerability. OpenSLP as used in ESXi 7.0 before ESXi70U1c-17325551, 6.7 before ESXi670-202102401-SG, 6.5 before ESXi650-202102101-SG has a heap-overflow vulnerability. A malicious actor residing...

WebCalendar send_reminders.php includedir Parameter Remote File Inclusion

The remote version of WebCalendar fails to sanitize user-supplied input to the 'includedir' parameter of the 'sendreminders.php' script. By leveraging this flaw, an attacker may be able to view arbitrary files on the remote host and execute arbitrary PHP code, possibly taken from third-party host...

McAfee VirusScan Enterprise < 8.8 Patch 13 Privilege Escalation Vulnerability (SB10237)

The version of McAfee VirusScan Enterprise VSE installed on the remote Windows host is prior to 8.8 Patch 13. It is, therefore, affected by a privilege escalation vulnerability. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid110272; scriptversion"1.6";...

SSH Weak MAC Algorithms Enabled

The remote SSH server is configured to allow either MD5 or 96-bit MAC algorithms, both of which are considered weak. Note that this plugin only checks for the options of the SSH server, and it does not check for vulnerable software versions. C Tenable Network Security, Inc. include"compat.inc"; i...

DNS Server Dynamic Update Record Injection

It was possible to add a record into a zone using the DNS dynamic update protocol, as described by RFC 2136. This protocol can be used by DHCP clients to enter their host names into the DNS maps, but it could be subverted by malicious users to redirect network traffic. C Tenable Network Security,...

FTP Service AUTH TLS Plaintext Command Injection

The remote FTP server contains a software flaw in its AUTH TLS implementation that could allow a remote, unauthenticated attacker to inject commands during the plaintext protocol phase that will be executed during the ciphertext protocol phase. Successful exploitation could permit an attacker to...

TLS Version 1.1 Protocol Detection

The remote service accepts connections encrypted using TLS 1.1. TLS 1.1 lacks support for current and recommended cipher suites. Ciphers that support encryption before MAC computation, and authenticated encryption modes such as GCM cannot be used with TLS 1.1 As of March 31, 2020, Endpoints that...

HP System Management Homepage Multiple Vulnerabilities (HPSBMU03593)

According to its banner, the version of HP System Management Homepage SMH hosted on the remote web server is affected by the following vulnerabilities : - A denial of service vulnerability exists in the Apache HTTP Server due to the lack of the modreqtimeout module. An unauthenticated, remote...

Microsoft Windows SMB NativeLanManager Remote System Information Disclosure

Nessus was able to obtain the remote operating system name and version Windows and/or Samba by sending an authentication request to port 139 or 445. Note that this plugin requires SMB to be enabled on the host. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid10785;...

Weak Debian OpenSSH Keys in ~/.ssh/authorized_keys

The remote host has one or more /.ssh/authorizedkeys files containing weak SSH public keys generated on a Debian or Ubuntu system. The problem is due to a Debian packager removing nearly all sources of entropy in the remote version of OpenSSL. This problem does not only affect Debian since any us...

nginx < 1.8.1 / 1.9.x < 1.9.10 Multiple Vulnerabilities

The version of nginx hosted on the remote web server is less than 1.8.1 or 1.9.x prior to 1.9.10. It is, therefore, affected by multiple vulnerabilities as noted in the vendor advisory. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

Remote listeners enumeration (Linux / AIX)

By logging into the remote host with the supplied credentials, Nessus was able to obtain the name of the process listening on the remote port. Note that the method used by this plugin only works for hosts running Linux or AIX. TRUSTED...

Blue Coat ProxySG 6.5.x / 6.2.x / 5.5 OpenSSL Vulnerability (FREAK)

The remote Blue Coat ProxySG device's self-reported SGOS version is 6.5 prior to 6.5.6.2, or version 6.2 prior to 6.2.16.3, or else any version of 5.5. Therefore, it contains a bundled version of OpenSSL affected by a security feature bypass vulnerability, known as FREAK Factoring attack on...

Microsoft RDP RCE (CVE-2019-0708) (BlueKeep) (uncredentialed check)

Binary data msrdpcve-2019-0708.nbin...

Default nginx HTTP Server Settings

The remote webserver contains default settings such as enabled server tokens and/or default files such as the default index or error pages. These items could potentially leak useful information about the server installation. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

IIS Detailed Error Information Disclosure

The remote Microsoft IIS web server is improperly configured to deliver detailed error messages. These detailed error messages may contain confidential diagnostic information, such as the file system paths to hosted content and logon information. C Tenable Network Security, Inc...

FTP Supports Cleartext Authentication

The remote FTP server allows the user's name and password to be transmitted in cleartext, which could be intercepted by a network sniffer or a man-in-the-middle attack. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid34324; scriptversion"1.28";...

Web Server Unconfigured - Default Install Page Present

The remote web server uses its default welcome page. Therefore, it's probable that this server is not used at all or is serving content that is meant to be hidden. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid11422; scriptversion"1.45"; scriptcvsdate"Date: 2018/08/...

PPA functions.inc.php config[ppa_root_path] Parameter Remote File Inclusion

The remote host is running PPA, a free, PHP-based photo gallery. The installed version of PPA allows remote attackers to control the 'configpparootpath' variable used when including PHP code in the 'inc/functions.inc.php' script. By leveraging this flaw, an attacker may be able to view arbitrary...

Debian DLA-1444-1 : vim-syntastic security update

CVE-2018-11319 The improper handling of search for configuration files might be exploited for arbitrary code execution via a malicious gcc plugin. For Debian 8 'Jessie', this problem has been fixed in version 3.5.0-1+deb8u1. We recommend that you upgrade your vim-syntastic packages. NOTE: Tenable...

Web Server / Application favicon.ico Vendor Fingerprinting

The 'favicon.ico' file found on the remote web server belongs to a popular web server. This may be used to fingerprint the web server. This script was written by Javier Fernandez-Sanguino based on sample code written by Renaud Deraison in the nessus-plugins mailing list It is distributed under th...

Oracle WebLogic Server Deserialization RCE (CVE-2018-2628)

The remote Oracle WebLogic server is affected by a remote code execution vulnerability in the Core Components subcomponent due to unsafe deserialization of Java objects by the RMI registry. An unauthenticated, remote attacker can exploit this, via a crafted Java object, to execute arbitrary Java...

Pligg settemplate.php template Parameter Local File Inclusion

The remote host is running Pligg, an open source content management system. The installed version of Pligg fails to sanitize the 'template' cookie before using it in 'config.php' to include PHP code. An unauthenticated, remote attacker can exploit this issue to view arbitrary files or even execut...

Cacti 1.2.22 Command Injection (CVE-2022-46169)

Binary data cacticmdinjectionCVE-2022-46169.nbin...

Windows 7 and Windows 2008 R2 April 2017 Security Updates (Petya)

The remote Windows host is missing security update 4015546 or cumulative update 4015549. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists in the open-source libjpeg image processing library due to improper handling of objects in memory. An...

D-Link Router HNAP GetDeviceSettings Remote Command Execution

The remote D-Link device is affected by a remote command execution vulnerability due to a flaw in the GetDeviceSettings functionality of the HNAP Home Network Administration Protocol server. A remote attacker can exploit this, via a crafted SOAPAction header, to bypass authentication and inject...

PHP 8.1.x < 8.1.11 Multiple Vulnerabilities

The version of PHP installed on the remote host is prior to 8.1.11. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.1.11 advisory. - In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress quines gzip files,...

Exim < 4.93 Privilege Escalation vulnerability

According to its banner, the version of Exim running on the remote host is prior to 4.93. It is, therefore, potentially affected by a privilege escalation vulnerability. A flaw exists in the UNIX symbolic link that could allow an attacker to execute to escalate from the mail user to root. C Tenab...

PHP 7.4.x < 7.4.32 Multiple Vulnerabilities

The version of PHP installed on the remote host is prior to 7.4.32. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 7.4.32 advisory. - In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress quines gzip files,...

Default Password (artica) for 'root' Account

The account 'root' on the remote host has the password 'artica'. An attacker may leverage this issue to gain total control of the affected system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. account = "root"; password = "artica"; include'deprecatednasllevel.inc'; include'compat.inc'; if...

Apache Log4j 1.x Multiple Vulnerabilities

According to its self-reported version number, the installation of Apache Log4j on the remote host is 1.x and is no longer supported. Log4j reached its end of life prior to 2016. Additionally, Log4j 1.x is affected by multiple vulnerabilities, including : - Log4j includes a SocketServer that...

Server Message Block (SMB) Protocol Version 1 Enabled

The remote Windows host supports Server Message Block Protocol version 1 SMBv1. Microsoft recommends that users discontinue the use of SMBv1 due to the lack of security features that were included in later SMB versions. Additionally, the Shadow Brokers group reportedly has an exploit that affects...

Target Access Problems by Authentication Protocol - Maximum Privilege Account Used in Scan

Nessus was able to log in to the remote host using the provided credentials. The provided credentials have the highest privilege possible on the remote host. Yet Nessus encountered permissions issues while accessing items during the scan. It is likely that this condition is caused by one or more ...

MariaDB 5.5.0 < 5.5.54 Multiple Vulnerabilities

The version of MariaDB installed on the remote host is prior to 5.5.54. It is, therefore, affected by multiple vulnerabilities as referenced in the 5.5.54 advisory. - mysqldsafe in Oracle MySQL through 5.5.51, 5.6.x through 5.6.32, and 5.7.x through 5.7.14; MariaDB; Percona Server before...

MySQL 5.7.x < 5.7.28 Multiple Vulnerabilities (Oct 2019 CPU)

The version of MySQL running on the remote host is 5.7.x prior to 5.7.28. It is, therefore, affected by multiple vulnerabilities, including three of the top vulnerabilities below, as noted in the October 2019 Critical Patch Update advisory: - Vulnerabilities in the MySQL Server product of Oracle...

WordPress 'xmlrpc.php' pingback.ping Server-Side Request Forgery

The WordPress install hosted on the remote web server is affected by a server-side request forgery vulnerability because the 'pingback.ping' method used in 'xmlrpc.php' fails to properly validate source URIs Uniform Resource Identifiers. A remote, unauthenticated attacker can exploit this issue t...

IBM WebSphere Application Server Malformed Host Header JSP Source Disclosure

It is possible to make the remote web server disclose the source code of its JSP pages by requesting the pages with a nonexistent hostname in the HTTP 'Host' header request when WebSphere Application is sharing the document root of the web server. An attacker may use this flaw to get the source...

MS KB2927432: Visual Studio Update 2 for Debug Interface Access SDK

The version of the Microsoft Debug Interface Access Library on the remote host is affected by a memory corruption vulnerability related to parsing PDB files. An attacker could exploit this issue by tricking a user into loading a malicious file. This could allow an attacker to execute arbitrary co...

Windows Kerberos Elevation of Privilege Vulnerability (CVE-2022-37967) (November 2022)

The remote Windows host is missing a security update. It is, therefore, affected by a Windows Kerberos Elevation of Privilege Vulnerability CVE-2022-37967 %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid176328; scriptversion"1.7";...

HP iLO 4 <= 2.52 RCE

According to its version number, the remote HP Integrated Lights-Out 4 iLO 4 server is affected by multiple unspecified flaws that allow a remote attacker to bypass authentication and execute arbitrary code. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid102803;...

Geeklog auth.inc.php loginname Parameter SQL Injection

The version of Geeklog installed on the remote fails to sanitize input to the 'loginname' and 'passwd' parameters before using it in the script 'admin/auth.inc.php' to construct database queries. Provided PHP's 'magicquotesgpc' setting is enabled, an unauthenticated attacker can exploit this flaw...