Cisco CallManager TFTP File Detection

The remote host has a TFTP server installed that is serving one or more Cisco CallManager files. These files do not themselves include any sensitive information, but do identify the TFTP server as being part of a Cisco CallManager environment. The CCM TFTP server is an essential part of providing...

Apache Log4j Unsupported Version Detection (deprecated)

This plugin has been deprecated. For plugins which identify unsupported instances of this product, search the plugin feed for Apache Log4j SEoL. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid156032;...

Oracle JavaServer Faces Multiple Partial Directory Traversals

The remote web server contains a JavaServer Faces application that is affected by multiple partial directory traversal vulnerabilities : - A defect exists in the handling of a resource identifier that allows for directory traversal within the application. - A defect exists in the handling of a...

KB4343899: Windows 7 and Windows Server 2008 R2 August 2018 Security Update (Foreshadow)

The remote Windows host is missing security update 4343899 or cumulative update 4343900. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. The vulnerability could corrupt memory in a...

ClusterLabs Pacemaker PCS Daemon Default Password

The remote ClusterLabs Pacemaker PCS daemon uses a known default set of credentials. This allows a remote attacker to run arbitrary commands on cluster members. Note that some package deployment systems, such as Puppet, may be responsible for setting these default credentials. C Tenable Network...

Oracle MySQL Server 5.7.x < 5.7.42 (Apr 2023 CPU)

The versions of MySQL Server installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2023 CPU advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Security: Privileges. Supported versions that are affected are 5.7.41 and...

Microsoft IIS Unicode Remote Command Execution

The hotfix for the 'Webserver file request parsing' problem has not been applied. This vulnerability can allow an attacker to make the remote IIS server execute arbitrary commands. %NASLMINLEVEL 70300 Approved 22Apr01 jao replaces older version This script was first written Renaud Deraison then...

Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel vulnerabilities (USN-6626-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6626-1 advisory. Quentin Minster discovered that a race condition existed in the KSMBD implementation in the Linux kernel when handling sessions operations. A...

Nagios NRPE Command Argument Processing Enabled

The version of Nagios Remote Plugin Executor NRPE running on the remote host has command argument processing enabled and accepts the newline character. An unauthenticated, remote attacker can exploit this issue to execute arbitrary commands within the context of the vulnerable application by...

Compromised Windows System (hosts File Check)

The remote Windows host uses the file 'System32\drivers\etc\hosts' to fix the name resolution of some sites to localhost or internal systems. Some viruses or spyware modify this file to prevent antivirus software or other security software from obtaining updates. Nessus has found one or more...

Pivotal Software Redis 2.0.x < 3.2.12 / 4.0.x < 4.0.3 DoS

The version of Redis installed on the remote host is affected by a denial of service vulnerability and therefore requires a security update. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid109326; scriptversion"1.6...

Security Updates for Microsoft Office Products (November 2017)

The Microsoft Office Products are missing security updates. It is, therefore, affected by multiple vulnerabilities : - Microsoft has released an update for Microsoft Office that provides enhanced security as a defense-in-depth measure. - A remote code execution vulnerability exists in Microsoft...

rsh Service Detection

The rsh service is running on the remote host. This service is vulnerable since data is passed between the rsh client and server in cleartext. A man-in-the-middle attacker can exploit this to sniff logins and passwords. Also, it may allow poorly authenticated logins without passwords. If the host...

Cisco Unified Communications Manager SSLv3 Information Disclosure (cisco-sa-20141015-poodle) (POODLE)

According to its self-reported version, the remote Cisco Unified Communications Manager CUCM device is affected by a man-in-the-middle MitM information disclosure vulnerability known as POODLE. The vulnerability is due to the way SSL 3.0 handles padding bytes when decrypting messages encrypted...

AD Starter Scan - Dangerous Trust Relationship

Binary data adsitrustunsafe.nbin...

Dotnetnuke < 9.11.0 Relative Path Traversal

A directory traversal vulnerability exists in DotNetNuke due to insufficient sanitization of user controlled data. An authenticated, remote attacker can exploit this, by sending a URI that contains directory traversal characters, to disclose the contents of files located outside of the server's...

FTP Server Detection

It is possible to obtain the banner of the remote FTP server by connecting to a remote port. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid10092; scriptversion"1.57"; scriptsetattributeattribute:"pluginmodificationdate", value:"2023/08/17";...

zenTrack index.php configFile Parameter Traversal Arbitrary Files Access

It is possible to make the remote web server show the content of arbitrary files by making requests like : index.php?configFile=../../../../../../../../../../etc/passwd %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Ref: Subject: Re: zenTrack Remote Command Execution Vulnerabilities From:...

KB5003646: Windows 10 version 1809 / Windows Server 2019 Security Update (June 2021)

The remote Windows host is missing security update 5003646. It is, therefore, affected by multiple vulnerabilities %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the Microsoft Security Updates API. The text itself is...

ASP.NET DEBUG Method Enabled

It is possible to send debug statements to the remote ASP scripts. An attacker might use this to alter the runtime of the remote scripts. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid33270; scriptversion"1.18";...

SUSE SLES15 / openSUSE 15 Security Update : nodejs16 (SUSE-SU-2022:3251-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3251-1 advisory. - CVE-2022-35949: Fixed SSRF when an application takes in user input into the path/pathname option of undici.request...

MS15-099: Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (3089664)

The remote Windows host has a version of Microsoft Office, Excel, Excel Viewer, SharePoint Server, Microsoft Office Compatibility Pack, Microsoft Office Web Apps, and/or Microsoft SharePoint Foundation installed that is affected by one or more of the following vulnerabilities : - Multiple remote...

Fortinet OpenSSL Multiple Vulnerabilities

The firmware of the remote Fortinet host is running a version of OpenSSL that is affected by one or more of the following vulnerabilities : - An error exists in the function 'ssl3readbytes' that could allow data to be injected into other sessions or allow denial of service attacks. Note this issu...

RomPager HTTP Referer Header XSS

The remote RomPager HTTP server is affected by a cross-site scripting vulnerability. The server does not properly sanitize the referer header value when generating a 404 error page. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

Microsoft Windows NTLMSSP Authentication Request Remote Network Name Disclosure

The remote host listens on tcp port 445 and replies to SMB requests. By sending an NTLMSSP authentication request it is possible to obtain the name of the remote system and the name of its domain. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid42410; scriptversion...

Apache Tomcat 7.0.0 < 7.0.108 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 7.0.108. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat7.0.108security-7 advisory. - The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41,...

Scientific Linux Security Update : kernel on SL4.x i386/x86_64

This update fixes the following security issue : - When an application has a stack overflow, the stack could silently overwrite another memory mapped area instead of a segmentation fault occurring, which could cause an application to execute arbitrary code, possibly leading to privilege escalatio...

jQuery 1.7.1 < 1.9.0 Cross-Site Scripting

According to its self-reported version number, jQuery is at least 1.7.1 and prior to 1.9.0. Therefore, it may be affected by a cross-site scripting vulnerability due to jQuerystrInput. Note that the scanner has not tested for these issues but has instead relied only on the application's...

McAfee VirusScan Enterprise < 8.8 Patch 9 Scriptscan COM Object DoS (SB10194)

The version of McAfee VirusScan Enterprise VSE installed on the remote Windows host is prior to 8.9 Patch 9. It is, therefore, affected by a memory corruption issue in the Scriptscan COM object. An unauthenticated, remote attacker can exploit this, via a specially crafted HTML link, to cause a...

DUware Products Multiple Remote Vulnerabilities (SQLi, XSS)

The remote host is running a product published by DUware - either DUclassmate, DUclassified or DUforum. There is a flaw in the remote version of this software that could allow an attacker to execute arbitrary SQL statements on the remote host by supplying malformed values to the arguments of...

Atlassian Jira < 8.13.22 / 8.20.x < 8.20.10 / 8.22.x < 8.22.4 / 9.0.0 XSS (JRASERVER-73897)

The version of Atlassian Jira Server running on the remote host is affected by a vulnerability as referenced in the JRASERVER-73897 advisory. - A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps. Th...

MySQL 5.7.x < 5.7.30 Multiple Vulnerabilities (Jan 2020 CPU)

The version of MySQL running on the remote host is 5.7.x prior to 5.7.30. It is, therefore, affected by multiple vulnerabilities, as noted in the April 2020 Critical Patch Update advisory: - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Parser. Supported versions th...

RIP-2 Poisoning Routing Table Modification

This host is running a RIP-2 agent. RIP-2 requests can be authenticated but Nessus cannot check this in the current configuration. If authentication is not implemented, an attacker on the same network may feed the target machine bogus routes and hijack network connections. Note that this may be a...

Joomla! < 3.6.5 Multiple Vulnerabilities

According to its self-reported version number, the Joomla! installation running on the remote web server is prior to 3.6.5. It is, therefore, affected by multiple vulnerabilities : - A flaw exists in the JFilterInput::isFileSafe function due to improper validation of file types and extensions of...

TightVNC Viewer < 1.3.10 Multiple Integer Overflows

The installed version of TightVNC Viewer is earlier than 1.3.10. Such versions reportedly miscalculate a buffer size on the heap. If an attacker can trick a user on the remote host into connecting to a malicious server, he can probably exploit this issue using specially crafted messages to execut...

AWStats < 6.3 awstats.pl configdir Parameter Remote Command Execution

Binary data 2534.prm...

SimpleBoard sbp Parameter Remote File Inclusion

Binary data 3684.prm...

SSH Rate Limited Device

The remote host is a device that may rate limit connections, potentially causing intermittent authentication failures in other plugins. Local checks will be enabled in this plugin where possible. TRUSTED...

Cisco AnyConnect Secure Mobility Client 4.0.x < 4.3.05017 / 4.4.x < 4.4.00243 SBL Module Privilege Escalation

The version of Cisco AnyConnect Secure Mobility Client installed on the remote Windows host is 4.0.x prior to 4.3.05017 or 4.4.x prior to 4.4.00243. It is, therefore, affected by a privilege escalation vulnerability in the Start Before Logon SBL module due to insufficient access controls. A local...

Microsoft SQL Server STARTTLS Support

The remote Microsoft SQL Server service supports the use of encryption initiated during pre-login to switch from a cleartext to an encrypted communications channel. TRUSTED...

OpenSSL 1.1.1 < 1.1.1za Vulnerability

The version of OpenSSL installed on the remote host is prior to 1.1.1za. It is, therefore, affected by a vulnerability as referenced in the 1.1.1za advisory. - Issue summary: Calling the OpenSSL API function SSLselectnextproto with an empty supported client protocols buffer may cause a crash or...

Palo Alto Networks PAN-OS < 5.0.15 / 5.1.x < 5.1.10 / 6.0.x < 6.0.6 / 6.1.x < 6.1.1 Bash Shell Remote Code Execution (Shellshock)

The remote host is running a version of Palo Alto Networks PAN-OS prior to 5.0.15 / 5.1.10 / 6.0.6 / 6.1.1. It is, therefore, affected by a command injection vulnerability in GNU Bash known as Shellshock, which is due to the processing of trailing strings after function definitions in the values ...

Oracle WebLogic Server Multiple Vulnerabilities (Jan 2021 CPU)

The version of WebLogic Server installed on the remote host is affected by multiple vulnerabilities as referenced in the January 2021 CPU advisory. - An unspecified vulnerability exists in the Core component. An unauthenticated, remote attacker with network access via IIOP, T3 can exploit this...

Telerik UI for ASP.NET AJAX Cryptographic Weakness

The version of Telerik UI for ASP.NET AJAX installed on the remote Windows host is affected by a cryptographic weakness in Telerik.Web.UI.dll. An unauthenticated, remote attacker can exploit this, via specially crafted data, to disclose encryption keys. %NASLMINLEVEL 70300 C Tenable Network...

MS16-136: Security Update for SQL Server (3199641)

The remote Microsoft SQL Server is missing a security update. It is, therefore, affected by multiple vulnerabilities : - Multiple elevation of privilege vulnerabilities exist in the SQL RDBMS Engine due to improper handling of pointer casting. An authenticated, remote attacker can exploit these t...

PHP 7.2.x < 7.2.13 Multiple vulnerabilities

According to its banner, the version of PHP running on the remote web server is 7.2.x prior to 7.2.13. It is, therefore, affected by multiple vulnerabilities: - An arbitrary command injection vulnerability exists in the imapopen function due to improper filters for mailbox names prior to passing...

MS13-002: Vulnerabilities in Microsoft XML Core Services Could Allow Remote Code Execution (2756145)

The version of Microsoft XML Core Services installed on the remote Windows host is affected by multiple code execution vulnerabilities when visiting a specially crafted web page using Internet Explorer. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid63420;...

RHEL 7 : Red Hat JBoss Enterprise Application Platform 6.4.7 update (Moderate) (RHSA-2016:0597)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:0597 advisory. - tomcat: non-persistent DoS attack by feeding data by aborting an upload CVE-2014-0230 - EAP: HTTPS NIO connector uses no timeout when...

Microsoft Windows SMB Shares Access

The remote has one or more Windows shares that can be accessed through the network with the given credentials. Depending on the share rights, it may allow an attacker to read / write confidential data. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid10396;...

OpenSSL 1.0.2 < 1.0.2i Multiple Vulnerabilities

The version of OpenSSL installed on the remote host is prior to 1.0.2i. It is, therefore, affected by multiple vulnerabilities as referenced in the 1.0.2i advisory. - Multiple memory leaks in t1lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to...