Apple Mac OS X Find-By-Content .DS_Store Web Directory Listing

It is possible to read a '.DSStore' file on the remote web server. This file is created by MacOS X Finder; it is used to remember the icons position on the desktop, among other things, and contains the list of files and directories present in the remote directory. Note that deleted files may stil...

HP Ink Printers Multiple Vulnerabilities (HPSBHF03589)

The firmware version running on the remote host is vulnerable to multiple vulnerabilities. An unauthenticated remote attacker could gain system-level unauthorized access to the affected device. Note that Nessus has not tested for these issues but has instead relied only on the self-reported versi...

Amazon Linux AMI : httpd (ALAS-2017-851)

Apache HTTP Request Parsing Whitespace Defects It was discovered that the HTTP parser in httpd incorrectly allowed certain characters not permitted by the HTTP protocol specification to appear unencoded in HTTP request headers. If httpd was used in conjunction with a proxy or backend server that...

Default Password 'vizxv' for 'root' Account

The account 'root' on the remote host has the default password 'vizxv'. A remote attacker can exploit this issue to gain administrative access to the affected system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. account = "root"; password = "vizxv"; include'deprecatednasllevel.inc';...

Oracle WebLogic Server Multiple Vulnerabilities (July 2018 CPU)

The version of Oracle WebLogic Server installed on the remote host is affected by multiple vulnerabilities: - An unspecified vulnerability in the Spring Framework Sample Apps subcomponent in Oracle WebLogic allows an unauthenticated, remote attacker to takeover a WebLogic server. CVE-2018-1275 - ...

Microsoft SQL Server Default Credentials

The SQL Server has a common password for one or more accounts. These accounts may be used to gain access to the records in the database or even allow remote command execution. %NASLMINLEVEL 70300 MSSQL Brute Forcer This script checks a SQL Server instance for common username and password...

MikroTik RouterOS < 6.40.9 / 6.42.7 / 6.43 multiple vulnerabilities.

According to its self-reported version, the remote networking device is running a version of MikroTik prior to 6.40.9, 6.41.x 6.42.7, or 6.43. It, therefore, vulnerable to multiple vulnerabilities. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...

Microsoft Office Unsupported Version Detection

According to its version, the installation of Microsoft Office on the remote Windows host is no longer supported. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilities. C Tenable Network...

Microsoft Windows SMB Service Config Enumeration

Nessus was able to obtain, via the SMB protocol, the launch parameters of each active service on the remote host executable path, logon type, etc.. C Tenable, Inc. include"compat.inc"; if description scriptid44401; scriptversion"1.21"; scriptsetattributeattribute:"pluginmodificationdate",...

Liferay Portal 6.2.x < 6.2.5 / 7.0.x < 7.0.6 / 7.1.x < 7.1.3 / 7.2.x < 7.2.1 RCE

The version of Liferay Portal installed on the remote host is affected by a remote code execution vulnerability in its JSON web services component. An unauthenticated, remote attacker can exploit this to bypass authentication and execute arbitrary commands. Note that Nessus has not tested for thi...

Node.js Module node-tar < 6.2.1 DoS

In the nodejs module node-tar prior to version 6.2.1, there is no validation of the number of folders created while unpacking a file. As a result, an attacker can use a malicious file to exhaust the CPU and memory on the host and crash the nodejs client. Note that Nessus has not tested for these...

HTTP Proxy CONNECT Loop DoS

The proxy allows the users to perform repeated CONNECT requests to itself. This allow anybody to saturate the proxy CPU, memory or file descriptors. Note that if the proxy limits the number of connections from a single IP e.g. acl maxconn with Squid, it is protected against saturation and you may...

ISC BIND GSS-TSIG SPNEGO Buffer Overflow (CVE-2021-25216)

According to its self-reported version, the ISC Bind present on the remote host is affected by a buffer overflow vulnerability: - GSS-TSIG is an extension to the TSIG protocol which is intended to support the secure exchange of keys for use in verifying the authenticity of communications between...

Apache Tomcat 7.0.0 < 7.0.82

The version of Tomcat installed on the remote host is prior to 7.0.82. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat7.0.82security-7 advisory. - When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81...

MS09-061: Vulnerabilities in the Microsoft .NET Common Language Runtime Could Allow Remote Code Execution (974378)

The remote Windows host is running a version of the Microsoft .NET Framework that is affected by multiple vulnerabilities : - A remote code execution vulnerability exists in the Microsoft .NET Framework that could allow a malicious Microsoft .NET application to obtain a managed pointer to stack...

WordPress 6.5.x < 6.5.5 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A Cross-Site Scripting XSS vulnerability affecting the HTML API. - A Cross-Site Scripting XSS vulnerability affecting the Template Part block. - A path traversal issue...

Microsoft Windows VP9 Video Extensions Library RCE (June 2021)

The Windows 'VP9 Extensions' app installed on the remote host is affected by a remote code execution vulnerability. An attacker who successfully exploited the vulnerability could execute arbitrary code. Exploitation of the vulnerability requires that a program process a specially crafted file...

Apache Tomcat Snoop Servlet Remote Information Disclosure

The 'snoop' Tomcat servlet is installed. This servlet gives too much information about the remote host, such as the PATHs in use, the host kernel version, etc. A remote attacker can exploit this to gain more knowledge about the host, allowing an attacker to conduct further attacks. %NASLMINLEVEL...

Nginx 1.23.x < 1.23.2 Multiple Vulnerabilities

According to its Server response header, the installed version of nginx is prior to 1.22.1 or 1.23.x prior to 1.23.2. It is, therefore, affected by two security issues which might allow an attacker to cause a worker process crash or worker process memory disclosure by using a specially crafted mp...

Oracle WebLogic T3 Protocol Detection

The remote host is running the WebLogic t3 Protocol. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid109552; scriptversion"1.4"; scriptsetattributeattribute:"pluginmodificationdate", value:"2022/06/01"; scriptnameenglish:"Oracle WebLogic T3 Protocol Detection";...

MySQL 5.7.x < 5.7.12 Multiple Vulnerabilities (DROWN)

The version of MySQL running on the remote host is 5.7.x prior to 5.7.12. It is, therefore, affected by multiple vulnerabilities : - A cipher algorithm downgrade vulnerability exists in the bundled version of OpenSSL due to a flaw that is triggered when handling cipher negotiation. A remote...

Security Update for Microsoft Office Products (May 2017)

The Microsoft Office application, Office Web Apps, or SharePoint Server installed on the remote Windows host is missing a security update. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists in Microsoft Office software due to improper handling ...

Oracle Java SE Multiple Vulnerabilities (January 2017 CPU) (SWEET32)

The version of Oracle formerly Sun Java SE or Java for Business installed on the remote host is prior to 8 Update 121, 7 Update 131, or 6 Update 141. It is, therefore, affected by multiple vulnerabilities : - A vulnerability exists in the Libraries subcomponent, known as SWEET32, in the 3DES and...

Check Point SSL Network Extender ActiveX Control Remote Code Execution

The version of the Check Point SSL Network Extender ActiveX control installed on the remote Windows host reportedly contains a remote code execution vulnerability. If an attacker can trick a user on the affected host into viewing a specially crafted HTML document, he can leverage this issue to...

OpenSSL SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG Session Resume Ciphersuite Downgrade Issue

The version of OpenSSL on the remote host has been shown to allow resuming session with a weaker cipher than was used when the session was initiated. This means that an attacker that sees i.e., by sniffing the start of an SSL connection can manipulate the OpenSSL session cache to cause subsequent...

YaPiG Password Protected Directory Bypass

The remote host is running YaPiG, a web-based image gallery written in PHP. The remote version of this software contains a flaw that can let a malicious user view images in password protected directories. Successful exploitation of this issue may allow an attacker to access unauthorized images on...

Symantec Antivirus Software Detection and Status

A Symantec antivirus application is installed on the remote host. Note that this plugin checks that the application is running properly and that its latest virus definitions are loaded. This script has been rewritten by Montgomery County Original script was written by Jeff Adams and Tenable Netwo...

Security Updates for Internet Explorer (September 2017)

The Internet Explorer installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists when affected Microsoft scripting engines do not properly handle objects in memory. The vulnerability could...

Squirrelcart cart_content.php cart_isp_root Parameter Remote File Inclusion

The remote host is running Squirrelcart, a shopping cart program written in PHP. The version of Squirrelcart installed on the remote host fails to sanitize user-supplied input to the 'cartisproot' parameter of the 'cartcontent.php' script before using it to include PHP code. Provided PHP's...

YaPiG < 0.95b Multiple Vulnerabilities

The remote host is running YaPiG, a web-based image gallery written in PHP. The installed version of YaPiG is vulnerable to multiple flaws : - Remote and local file inclusion. - Cross-site scripting and HTML injection flaws through 'view.php'. - Directory traversal flaw through 'upload.php'...

CentOS 7 : shim (RHSA-2024:1959)

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1959 advisory. - A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an err...

Symfony Secret Fragments Remote Code Execution

The Symfony framework or Symfony based projects uses a secret that is used for its cryptographic operations such as the creation of cookies or anti-CSRF tokens. A feature not enabled by default allows to execute arbitrary PHP code via a GET parameter. If this secret is exposed, through a...

SPiD lang.php lang_path Remote File Inclusion

The remote host is running SPiD, a free, PHP-based photo gallery. The installed version of SPiD allows remote attackers to control the 'langpath' variable used when including PHP code in the 'lang/lang.php' script. By leveraging this flaw, an attacker may be able to view arbitrary files on the...

Symantec (Blue Coat) ProxySG SGOS Version

The remote host is running SGOS, an operating system for Symantec Blue Coat ProxySG devices. It is possible to read the ProxySG SGOS version number by connecting to the device via SSH. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid68992; scriptversion"1.11";...

Oracle WebLogic Server Multiple Vulnerabilities (Jul 2020 CPU)

The version of WebLogic Server installed on the remote host is affected by multiple vulnerabilities as referenced in the July 2020 CPU advisory. - A vulnerability Centralized Thirdparty Jars jackson-databind exists. An unauthenticated, remote attacker can exploit this issue via the HTTP protocol ...

Oracle Java SE 1.7.0_271 / 1.8.0_261 / 1.11.0_8 / 1.14.0_2 Multiple Vulnerabilities (Jul 2020 CPU)

The version of Oracle formerly Sun Java SE or Java for Business installed on the remote host is prior to 7 Update 271, 8 Update 261, 11 Update 8, or 14 Update 2. It is, therefore, affected by multiple vulnerabilities related to the following components as referenced in the July 2020 CPU advisory:...

Security Updates for Microsoft Office Products (January 2019)

The Microsoft Office Products are missing security updates. It is, therefore, affected by multiple vulnerabilities: - A remote code execution vulnerability exists in the way that the MSHTML engine improperly validates input. An attacker could execute arbitrary code in the context of the current...

SSL DROWN Attack Vulnerability (Decrypting RSA with Obsolete and Weakened eNcryption)

The remote host supports SSLv2 and therefore may be affected by a vulnerability that allows a cross-protocol Bleichenbacher padding oracle attack known as DROWN Decrypting RSA with Obsolete and Weakened eNcryption. This vulnerability exists due to a flaw in the Secure Sockets Layer Version 2 SSLv...

FTPS Cleartext Fallback Security Bypass

The remote FTPS server running on the remote host is affected by a security bypass vulnerability due to accepting unencrypted commands if SSL negotiations fail. A man-in-the-middle attacker can exploit this to intercept credentials and modify files. C Tenable Network Security, Inc...

Oracle WebLogic Server Multiple Vulnerabilities (July 2021 CPU)

The 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0 versions of WebLogic Server installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2021 CPU advisory. - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware...

KB5015808: Windows 10 Version 1607 and Windows Server 2016 Security Update (July 2022)

The remote Windows host is missing security update 5015808. It is, therefore, affected by multiple vulnerabilities: - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. CVE-2022-22024, CVE-2022-22027,...

Firebird DataBase Server fbserver.exe p_cnct_count Value Remote Overflow

The version of Firebird installed on the remote host is vulnerable to a buffer overflow in its protocol handling routine. By sending a specially crafted 'opconnect' request, a remote, unauthenticated attacker can execute code on the affected host with SYSTEM privileges. %NASLMINLEVEL 70300 C...

HP System Management Homepage 7.3.x / 7.4.x < 7.5.0 Multiple Vulnerabilities (FREAK)

According to the web server's banner, the version of HP System Management Homepage SMH hosted on the remote web server is prior to 7.5.0. It is, therefore, affected by multiple vulnerabilities : - A flaw exists within the 'moddeflate' module when handling highly compressed bodies. A remote attack...

OpenSSL 1.0.1 < 1.0.1u Multiple Vulnerabilities

The version of OpenSSL installed on the remote host is prior to 1.0.1u. It is, therefore, affected by multiple vulnerabilities as referenced in the 1.0.1u advisory. - Multiple memory leaks in t1lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to...

Windows 7 and Windows Server 2008 R2 July 2017 Security Updates

The remote Windows host is missing security update 4025337 or cumulative update 4025341. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists in the Windows Performance Monitor Console due to improper parsing of XML input that contains a...

SUSE SLES12 Security Update : gcc9 (SUSE-SU-2020:0394-1)

This update for gcc9 fixes the following issues : The GNU Compiler Collection is shipped in version 9. A detailed changelog on what changed in GCC 9 is available at https://gcc.gnu.org/gcc-9/changes.html The compilers have been added to the SUSE Linux Enterprise Toolchain Module. To use these...

Apache Tomcat 10.0.0.M1 < 10.0.20 Spring4Shell (CVE-2022-22965) Mitigations

The version of Apache Tomcat installed on the remote host is 10.x prior to 10.0.20. - The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing but extremely hard to trigger concurrency bug in Apache Tomcat...

Microsoft Teams < 1.6.0.18681 RCE

The version of Microsoft Teams installed on the remote Windows host is version prior to 1.6.0.18681. It is, therefore, affected by a remote code execution vulnerability. An unauthenticated, remote attacker can exploit this to bypass authentication and execute arbitrary commands. Note that Nessus...

Web Server PROPFIND Method Internal IP Disclosure

The remote installation of IIS leaks a private IP address through the WebDAV interface. This may expose internal IP addresses that are usually hidden or masked behind a Network Address Translation NAT Firewall or proxy server. This is typical of IIS installations that are not configured properly...

News Desk newsdesk.cgi t Parameter Traversal Arbitrary File Access

The 'newsdesk.cgi' CGI is installed. This CGI has a well known security flaw that lets an attacker read arbitrary files with the privileges of the http daemon usually root or nobody. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include 'compat.inc' ; ifdescription scriptid10586;...