Apache Struts 2 'class' Parameter ClassLoader Manipulation

The remote web application appears to use Struts 2, a web framework that utilizes OGNL Object-Graph Navigation Language as an expression language. The version of Struts 2 in use is affected by a security bypass vulnerability due to the application allowing manipulation of the ClassLoader via the...

Ubuntu 22.04 LTS : Linux kernel vulnerabilities (USN-5469-1)

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5469-1 advisory. It was discovered that the Linux kernel did not properly restrict access to the kernel debugger when booted in secure boot environments. A privileged...

Operating System Unsupported Version Detection in banner reporting (PCI-DSS check)

A service banner response from the remote host indicates an operating system install at a level that indicates the operating system running on the remote host is no longer supported. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, ...

EMC vApp Manager Default Credentials

The EMC vApp Manager web application running on the remote host uses a default set of credentials 'smc' / 'smc'. An unauthenticated, remote attacker can exploit this issue to authenticate to the application and perform actions allowed by the default account. Specifically, the attacker can login a...

Apache HTTP Server Version

The remote host is running the Apache HTTP Server, an open source web server. It was possible to read the version number from the banner. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid48204; scriptversion"1.20"; scriptsetattributeattribute:"pluginmodificationdate",...

BMC Server Automation RSCD Agent Weak ACL XML-RPC Arbitrary Command Execution

The RSCD agent running on the remote host does not have access controls in place to prevent an attacker from executing XML-RPC commands. An unauthenticated, remote attacker can exploit this to execute arbitrary commands in the context of the user in which the connections are mapped. C Tenable...

PHP Version Detection

Nessus was able to determine the version of PHP available on the remote web server. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid48243; scriptversion"1.32"; scriptsetattributeattribute:"pluginmodificationdate", value:"2026/01/22"; scriptxrefname:"IAVT",...

ISC BIND 9.11.0 < 9.11.37 / 9.11.4-S1 < 9.11.37-S1 / 9.12.0 < 9.16.27 / 9.16.8-S1 < 9.16.27-S1 / 9.17.0 < 9.18.1 Vulnerability (CVE-2021-25220)

The version of ISC BIND installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2021-25220 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number...

Flexera FlexNet Publisher < 11.16.2 Multiple Vulnerabilities

The version of Flexera FlexNet Publisher running on the remote host is prior to 11.16.2. It is, therefore, affected by multiple vulnerabilities : - A Denial of Service vulnerability related to preemptive item deletion in lmgrd and vendor daemon components of FlexNet Publisher version 11.16.1.0 an...

MS11-004: Vulnerability in Internet Information Services (IIS) FTP Service Could Allow Remote Code Execution (2489256)

The IIS FTP service running on the remote host has a heap-based buffer overflow vulnerability. The 'TELNETSTREAMCONTEXT::OnSendData' function fails to properly sanitize user input, resulting in a buffer overflow. An unauthenticated, remote attacker can exploit this to execute arbitrary code. C...

Cisco ASA / IOS IKE Fragmentation Vulnerability

The remote Cisco Adaptive Security Appliance ASA or device running IOS / IOS XE is affected by one of the following vulnerabilities in the Internet Key Exchange IKE implementation : - An overflow condition exists in both the IKE and IKEv2 implementations due to improper validation of user-supplie...

Oracle Java Runtime Environment (JRE) Detection

One or more instances of Oracle's formerly Sun's Java Runtime Environment JRE is installed on the remote host. This may include private JREs bundled with the Java Development Kit JDK. - Additional instances of Java may be discovered if thorough tests are enabled. C Tenable Network Security, Inc...

EulerOS Virtualization 2.5.1 : kernel (EulerOS-SA-2018-1280)

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - In the Linux kernel before 4.13.5, a local user could create keyrings for other users via keyctl commands, setting unwanted...

Microsoft .NET Framework Detection

Microsoft .NET Framework, a software framework for Microsoft Windows operating systems, is installed on the remote host. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid51351; scriptversion"1.40"; scriptsetattributeattribute:"pluginmodificationdate", value:"2025/10/15...

OS Identification

Using a combination of remote probes e.g., TCP/IP, SMB, HTTP, NTP, SNMP, etc., it is possible to guess the name of the remote operating system in use. It is also possible sometimes to guess the version of the operating system. %NASLMINLEVEL 70300 C Tenable, Inc. @@NOTE: The output of this plugin...

Apache 2.2.x < 2.2.16 Multiple Vulnerabilities

According to its banner, the version of Apache 2.2.x running on the remote host is prior to 2.2.16. It is, therefore, potentially affected by multiple vulnerabilities : - A denial of service vulnerability in modcache and moddav. CVE-2010-1452 - An information disclosure vulnerability in...

MySQL 5.7.x < 5.7.34 Multiple Vulnerabilities (Apr 2021 CPU)

The version of MySQL running on the remote host is 5.7.x prior to 5.7.34. It is, therefore, affected by multiple vulnerabilities, including the following, as noted in the April 2021 Critical Patch Update advisory: - Vulnerability in the MySQL Server product of Oracle MySQL component: Server:...

Apache Tomcat 9.0.0.M1 < 9.0.31 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 9.0.31. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat9.0.31security-9 advisory. - When using the Apache JServ Protocol AJP, care must be taken when trusting incoming connections to...

Windows 8.1 and Windows Server 2012 R2 July 2017 Security Updates

The remote Windows host is missing security update 4025333 or cumulative update 4025336. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists in the Windows Performance Monitor Console due to improper parsing of XML input that contains a...

Microsoft Windows IIS Default Index Page

The remote web server uses the default IIS index page. This page may contain extra version information and is an indication of a misconfigured server. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid106609; scriptversion "1.3";...

Oracle WebLogic Server Multiple Vulnerabilities (October 2017 CPU)

The version of Oracle WebLogic Server installed on the remote host is affected by multiple vulnerabilities %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid103935; scriptversion"1.16";...

Blue Coat Reporter Default Password (admin) for 'admin' Account

Nessus could gain administrative access to the Blue Coat Reporter install on the remote host using 'admin' for both the username and password. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid34346; scriptversion"$Revision: 1.8 $"; scriptcvsdate"$Date: 2013/01/25...

Microsoft Windows SMB Registry : Winlogon Cached Password Weakness

The registry key 'HKLM\Software\Microsoft\WindowsNT\CurrentVersion\ Winlogon\CachedLogonsCount' is not 0. Using a value greater than 0 for the CachedLogonsCount key indicates that the remote Windows host locally caches the passwords of the users when they login, in order to continue to allow the...

PHP 8.2.x < 8.2.18 Multiple Vulnerabilities

According to its self-reported version number, the version of PHP installed on the remote host is 8.1.x prior to 8.1.28, 8.2.x prior to 8.2.18, or 8.3.x prior to 8.3.6. It is, therefore, affected by multiple vulnerabilities: - A command injection via array-ish $command parameter of procopen...

Microsoft Windows SMB Registry Remotely Accessible

It was possible to access the remote Windows Registry using the login / password combination used for the Windows local checks SMB tests. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid10400; scriptversion"1.55"; scriptsetattributeattribute:"pluginmodificationdate",...

Target Credential Status by Authentication Protocol - No Credentials Provided

Nessus was not able to successfully authenticate directly to the remote target on an available authentication protocol. Nessus was able to connect to the remote port and identify that the service running on the port supports an authentication protocol, but Nessus failed to authenticate to the...

Apache PHP-CGI Remote Code Execution

The PHP installation on the remote web server contains a flaw that could allow a remote attacker to pass command-line arguments as part of a query string to the PHP-CGI program. This could be abused to execute arbitrary code, reveal PHP source code, cause a system crash, etc. %NASLMINLEVEL 70300 ...

dnsmasq < 2.78 Multiple Remote Vulnerabilities

The version of dnsmasq installed on the remote host is prior to 2.78, and thus, is affected by the following vulnerabilities : - Denial of service related to handling DNS queries exceeding 512 bytes. CVE-2017-13704 - Heap overflow related to handling DNS requests. CVE-2017-14491 - Heap overflow...

Splunk Enterprise < 5.0.17 / 6.0.13 / 6.1.12 / 6.2.12 / 6.3.8 / 6.4.4 or Splunk Light < 6.5.0 Multiple Vulnerabilities

According to its self-reported version number, the version of Splunk Enterprise hosted on the remote web server is 5.0.x prior to 5.0.17, 6.0.x prior to 6.0.13, 6.1.x prior to 6.1.12, 6.2.x prior to 6.2.12, 6.3.x prior to 6.3.8, or 6.4.x prior to 6.4.4; or else it is Splunk Light prior to 6.5.0. ...

Oracle WebLogic Server Java Object Deserialization RCE (July 2016 CPU)

The remote Oracle WebLogic Server is affected by a remote code execution vulnerability in the WLS Core component in the readObject function due to improper sanitization of user-supplied input. An unauthenticated, remote attacker can exploit this, via a crafted object payload, to bypass the...

OpenSSL 'ChangeCipherSpec' MiTM Vulnerability

The OpenSSL service on the remote host is vulnerable to a man-in-the-middle MiTM attack, based on its acceptance of a specially crafted handshake. This flaw could allow a MiTM attacker to decrypt or forge SSL messages by telling the service to begin encrypted communications before key material ha...

MySQL 5.5 < 5.5.24 Security Bypass Vulnerability

The version of MySQL 5.5 installed on the remote host is earlier than 5.5.24 and is, therefore, affected by the following vulnerabilities : - Several errors exist related to 'GIS Extension', 'Server', 'InnoDB' and 'Server Optimizer' components that can allow denial of service attacks...

KB4056898: Windows 8.1 and Windows Server 2012 R2 January 2018 Security Update (Meltdown)(Spectre)

The remote Windows host is missing security update 4056898 or cumulative update 4056895. It is, therefore, affected by multiple vulnerabilities : - An vulnerability exists within microprocessors utilizing speculative execution and indirect branch prediction, which may allow an attacker with local...

Windows Security Feature Bypass in Secure Boot (BootHole)

Binary data windowsuefiboothole.nbin...

MS12-027: Vulnerability in Windows Common Controls Could Allow Remote Code Execution (2664258)

A memory corruption issue exists in Windows common controls, specifically within the MSCOMCTL.TreeView, MSCOMCTL.ListView2, MSCOMCTL.TreeView2, and MSCOMCTL.ListView controls component of MSCOMCTL.OCX, due to improper sanitization of user-supplied input. An unauthenticated, remote attacker can...

Oracle Java SE 1.7.0_281 / 1.8.0_271 / 1.11.0_9 / 1.15.0_1 Multiple Vulnerabilities (Oct 2020 CPU)

The version of Oracle formerly Sun Java SE or Java for Business installed on the remote host is prior to 7 Update 281, 8 Update 271, 11 Update 9, or 15 Update 1. It is, therefore, affected by multiple vulnerabilities related to the following components as referenced in the October 2020 CPU...

Microsoft Windows SMB Registry : Autologon Enabled

This script determines whether the autologon feature is enabled. This feature allows an intruder to log into the remote host as DefaultUserName with the password DefaultPassword. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid10412; scriptversion"1.36";...

CGI Generic SQL Injection (blind, time based)

By sending specially crafted parameters to one or more CGI scripts hosted on the remote web server, Nessus was able to get a slower response, which suggests that it may have been able to modify the behavior of the application and directly access the underlying database. An attacker may be able to...

SSL / TLS Versions Supported

This plugin detects which SSL and TLS versions are supported by the remote service for encrypting communications. TRUSTED...

Apache 2.4.x < 2.4.47 Multiple Vulnerabilities

The version of Apache httpd installed on the remote host is prior to 2.4.47. It is, therefore, affected by multiple vulnerabilities as referenced in the 2.4.47 changelog: - Unexpected section matching with 'MergeSlashes OFF' CVE-2021-30641 - modauthdigest: possible stack overflow by one nul byte...

Apache Tomcat 6.0.x < 6.0.24 Multiple Vulnerabilities

The version of Apache Tomcat installed on the remote host is 6.0.x prior to 6.0.24. It is, therefore, affected by multiple vulnerabilities : - An unspecified flaw exists in the handling of pipelined requests when 'Sendfile' was used. If sendfile processing completed quickly, it was possible for t...

Oracle Java JRE Unsupported Version Detection

According to its self-reported version number, at least one installation of Oracle formerly Sun Java JRE on the remote host is no longer supported. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security...

Apache Struts 2 'action:' Parameter Arbitrary Remote Command Execution

The remote web application appears to use Struts 2, a web framework that utilizes OGNL Object-Graph Navigation Language as an expression language. Due to a flaw in the evaluation of an OGNL expression prefixed by the 'action:' parameter, a remote, unauthenticated attacker can exploit this issue t...

Web Server Allows Password Auto-Completion

The remote web server contains at least one HTML form field that has an input of type 'password' where 'autocomplete' is not set to 'off'. While this does not represent a risk to this web server per se, it does mean that users who use the affected forms may have their credentials saved in their...

phpBB Advanced GuestBook addentry.php phpbb_root_path Parameter Remote File Inclusion

The remote host is running Advanced Guestbook, a free guestbook written in PHP. The version of Advanced Guestbook installed on the remote host fails to sanitize input to the 'phpbbrootpath' parameter of the 'admin/addentry.php' script before using it in a PHP 'include' function. Provided PHP's...

Security Updates for Windows 10 / Windows Server 2016 (January 2019) (Spectre)

The remote Windows host is missing a security update. It is, therefore, missing microcode updates to address Spectre Variant 2 CVE-2017-5715: Branch Target Injection vulnerability. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid121035; scriptversion"1.8";...

Jetty < 9.4.41 Multiple Vulnerabilities

According to its self-reported version number, the instance of Jetty hosted on the remote web server is prior to 9.4.41, 10.0.x prior to 10.0.3 or 11.0.x prior to 11.0.3. It is, therefore, affected by multiple vulnerabilities: - An issue with failure to invalidate sessions after an exception in t...

MS11-058: Vulnerabilities in DNS Server Could Allow Remote Code Execution (2562485)

The version of Windows DNS server running on the remote host has the following vulnerabilities : - A memory corruption vulnerability that can be triggered by making a specially crafted NAPTR query, which can result in arbitrary code execution. CVE-2011-1966 - A denial of service vulnerability...

Exim < 4.97.1 SMTP smuggling

Exim before 4.97.1 allows SMTP smuggling in certain PIPELINING/CHUNKING configurations. Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Exim supports . but...

McAfee VirusScan Enterprise < 8.8 Patch 16 Access Control Bypass Vulnerability (SB10338)

The version of McAfee VirusScan Enterprise VSE installed on the remote Windows host is prior to 8.8 Patch 16. It is, therefore, affected by an access control bypass vulnerability which allows local administrators the ability to bypass local security protections by carefully manipulating the code...