Apache Tomcat XSRF Token Disclosure

The remote Apache Tomcat web server is affected by an information disclosure vulnerability in the index page of the Manager and Host Manager applications. An unauthenticated, remote attacker can exploit this vulnerability to obtain a valid cross-site request forgery XSRF token during the redirect...

Oracle JavaServer Faces Multiple Partial Directory Traversals

The remote web server contains a JavaServer Faces application that is affected by multiple partial directory traversal vulnerabilities : - A defect exists in the handling of a resource identifier that allows for directory traversal within the application. - A defect exists in the handling of a...

Cisco CallManager TFTP File Detection

The remote host has a TFTP server installed that is serving one or more Cisco CallManager files. These files do not themselves include any sensitive information, but do identify the TFTP server as being part of a Cisco CallManager environment. The CCM TFTP server is an essential part of providing...

RHEL 7 : sqlite (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - sqlite: Heap-buffer overflow in the getNodeSize function CVE-2017-10989 - sqlite: Out of bounds access...

Oracle MySQL Server 5.7.x < 5.7.42 (Apr 2023 CPU)

The versions of MySQL Server installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2023 CPU advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Security: Privileges. Supported versions that are affected are 5.7.41 and...

dnsmasq < 2.83 Multiple Vulnerabilities (DNSPOOQ)

The version of dnsmasq installed on the remote host is prior to 2.83. It is, therefore, affected by multiple vulnerabilities: - Multiple remote buffer overflows in the DNSSEC implementation. CVE-2020-25681, CVE-2020-25682, CVE-2020-25683, CVE-2020-25687 - A UDP DNS cache poisoning vulnerability...

OpenSSL 1.1.1 < 1.1.1za Vulnerability

The version of OpenSSL installed on the remote host is prior to 1.1.1za. It is, therefore, affected by a vulnerability as referenced in the 1.1.1za advisory. - Issue summary: Calling the OpenSSL API function SSLselectnextproto with an empty supported client protocols buffer may cause a crash or...

KB4343899: Windows 7 and Windows Server 2008 R2 August 2018 Security Update (Foreshadow)

The remote Windows host is missing security update 4343899 or cumulative update 4343900. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. The vulnerability could corrupt memory in a...

ClusterLabs Pacemaker PCS Daemon Default Password

The remote ClusterLabs Pacemaker PCS daemon uses a known default set of credentials. This allows a remote attacker to run arbitrary commands on cluster members. Note that some package deployment systems, such as Puppet, may be responsible for setting these default credentials. C Tenable Network...

Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel vulnerabilities (USN-6626-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6626-1 advisory. Quentin Minster discovered that a race condition existed in the KSMBD implementation in the Linux kernel when handling sessions operations. A...

Dotnetnuke < 9.11.0 Relative Path Traversal

A directory traversal vulnerability exists in DotNetNuke due to insufficient sanitization of user controlled data. An authenticated, remote attacker can exploit this, by sending a URI that contains directory traversal characters, to disclose the contents of files located outside of the server's...

Microsoft IIS Unicode Remote Command Execution

The hotfix for the 'Webserver file request parsing' problem has not been applied. This vulnerability can allow an attacker to make the remote IIS server execute arbitrary commands. %NASLMINLEVEL 70300 Approved 22Apr01 jao replaces older version This script was first written Renaud Deraison then...

Nagios NRPE Command Argument Processing Enabled

The version of Nagios Remote Plugin Executor NRPE running on the remote host has command argument processing enabled and accepts the newline character. An unauthenticated, remote attacker can exploit this issue to execute arbitrary commands within the context of the vulnerable application by...

Apache Tomcat 7.0.0 < 7.0.108 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 7.0.108. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat7.0.108security-7 advisory. - The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41,...

rsh Service Detection

The rsh service is running on the remote host. This service is vulnerable since data is passed between the rsh client and server in cleartext. A man-in-the-middle attacker can exploit this to sniff logins and passwords. Also, it may allow poorly authenticated logins without passwords. If the host...

KB5003646: Windows 10 version 1809 / Windows Server 2019 Security Update (June 2021)

The remote Windows host is missing security update 5003646. It is, therefore, affected by multiple vulnerabilities %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the Microsoft Security Updates API. The text itself is...

Pivotal Software Redis 2.0.x < 3.2.12 / 4.0.x < 4.0.3 DoS

The version of Redis installed on the remote host is affected by a denial of service vulnerability and therefore requires a security update. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid109326; scriptversion"1.6...

AD Starter Scan - Dangerous Trust Relationship

Binary data adsitrustunsafe.nbin...

Security Updates for Microsoft Office Products (November 2017)

The Microsoft Office Products are missing security updates. It is, therefore, affected by multiple vulnerabilities : - Microsoft has released an update for Microsoft Office that provides enhanced security as a defense-in-depth measure. - A remote code execution vulnerability exists in Microsoft...

RHEL 7 : Red Hat JBoss Enterprise Application Platform 6.4.7 update (Moderate) (RHSA-2016:0597)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:0597 advisory. - tomcat: non-persistent DoS attack by feeding data by aborting an upload CVE-2014-0230 - EAP: HTTPS NIO connector uses no timeout when...

Cisco Unified Communications Manager SSLv3 Information Disclosure (cisco-sa-20141015-poodle) (POODLE)

According to its self-reported version, the remote Cisco Unified Communications Manager CUCM device is affected by a man-in-the-middle MitM information disclosure vulnerability known as POODLE. The vulnerability is due to the way SSL 3.0 handles padding bytes when decrypting messages encrypted...

ASP.NET DEBUG Method Enabled

It is possible to send debug statements to the remote ASP scripts. An attacker might use this to alter the runtime of the remote scripts. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid33270; scriptversion"1.18";...

Atlassian Jira < 8.13.22 / 8.20.x < 8.20.10 / 8.22.x < 8.22.4 / 9.0.0 XSS (JRASERVER-73897)

The version of Atlassian Jira Server running on the remote host is affected by a vulnerability as referenced in the JRASERVER-73897 advisory. - A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps. Th...

FTP Server Detection

It is possible to obtain the banner of the remote FTP server by connecting to a remote port. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid10092; scriptversion"1.57"; scriptsetattributeattribute:"pluginmodificationdate", value:"2023/08/17";...

McAfee VirusScan Enterprise < 8.8 Patch 9 Scriptscan COM Object DoS (SB10194)

The version of McAfee VirusScan Enterprise VSE installed on the remote Windows host is prior to 8.9 Patch 9. It is, therefore, affected by a memory corruption issue in the Scriptscan COM object. An unauthenticated, remote attacker can exploit this, via a specially crafted HTML link, to cause a...

zenTrack index.php configFile Parameter Traversal Arbitrary Files Access

It is possible to make the remote web server show the content of arbitrary files by making requests like : index.php?configFile=../../../../../../../../../../etc/passwd %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Ref: Subject: Re: zenTrack Remote Command Execution Vulnerabilities From:...

MS15-099: Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (3089664)

The remote Windows host has a version of Microsoft Office, Excel, Excel Viewer, SharePoint Server, Microsoft Office Compatibility Pack, Microsoft Office Web Apps, and/or Microsoft SharePoint Foundation installed that is affected by one or more of the following vulnerabilities : - Multiple remote...

RomPager HTTP Referer Header XSS

The remote RomPager HTTP server is affected by a cross-site scripting vulnerability. The server does not properly sanitize the referer header value when generating a 404 error page. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

MySQL 5.7.x < 5.7.30 Multiple Vulnerabilities (Jan 2020 CPU)

The version of MySQL running on the remote host is 5.7.x prior to 5.7.30. It is, therefore, affected by multiple vulnerabilities, as noted in the April 2020 Critical Patch Update advisory: - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Parser. Supported versions th...

jQuery 1.7.1 < 1.9.0 Cross-Site Scripting

According to its self-reported version number, jQuery is at least 1.7.1 and prior to 1.9.0. Therefore, it may be affected by a cross-site scripting vulnerability due to jQuerystrInput. Note that the scanner has not tested for these issues but has instead relied only on the application's...

NFS Share Export List

This plugin retrieves the list of NFS exported shares. C Tenable Network Security, Inc. include 'compat.inc' ; if description scriptid10437; scriptversion"1.36"; scriptcvsdate"Date: 2019/10/04 16:48:26"; scriptnameenglish:"NFS Share Export List"; scriptsummaryenglish:"Gets a list of exported NFS...

SUSE SLES15 / openSUSE 15 Security Update : nodejs16 (SUSE-SU-2022:3251-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3251-1 advisory. - CVE-2022-35949: Fixed SSRF when an application takes in user input into the path/pathname option of undici.request...

SSH Rate Limited Device

The remote host is a device that may rate limit connections, potentially causing intermittent authentication failures in other plugins. Local checks will be enabled in this plugin where possible. TRUSTED...

Fortinet OpenSSL Multiple Vulnerabilities

The firmware of the remote Fortinet host is running a version of OpenSSL that is affected by one or more of the following vulnerabilities : - An error exists in the function 'ssl3readbytes' that could allow data to be injected into other sessions or allow denial of service attacks. Note this issu...

Microsoft Windows NTLMSSP Authentication Request Remote Network Name Disclosure

The remote host listens on tcp port 445 and replies to SMB requests. By sending an NTLMSSP authentication request it is possible to obtain the name of the remote system and the name of its domain. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid42410; scriptversion...

DUware Products Multiple Remote Vulnerabilities (SQLi, XSS)

The remote host is running a product published by DUware - either DUclassmate, DUclassified or DUforum. There is a flaw in the remote version of this software that could allow an attacker to execute arbitrary SQL statements on the remote host by supplying malformed values to the arguments of...

Joomla! < 3.6.5 Multiple Vulnerabilities

According to its self-reported version number, the Joomla! installation running on the remote web server is prior to 3.6.5. It is, therefore, affected by multiple vulnerabilities : - A flaw exists in the JFilterInput::isFileSafe function due to improper validation of file types and extensions of...

Scientific Linux Security Update : kernel on SL4.x i386/x86_64

This update fixes the following security issue : - When an application has a stack overflow, the stack could silently overwrite another memory mapped area instead of a segmentation fault occurring, which could cause an application to execute arbitrary code, possibly leading to privilege escalatio...

RIP-2 Poisoning Routing Table Modification

This host is running a RIP-2 agent. RIP-2 requests can be authenticated but Nessus cannot check this in the current configuration. If authentication is not implemented, an attacker on the same network may feed the target machine bogus routes and hijack network connections. Note that this may be a...

MS16-136: Security Update for SQL Server (3199641)

The remote Microsoft SQL Server is missing a security update. It is, therefore, affected by multiple vulnerabilities : - Multiple elevation of privilege vulnerabilities exist in the SQL RDBMS Engine due to improper handling of pointer casting. An authenticated, remote attacker can exploit these t...

Cisco AnyConnect Secure Mobility Client 4.0.x < 4.3.05017 / 4.4.x < 4.4.00243 SBL Module Privilege Escalation

The version of Cisco AnyConnect Secure Mobility Client installed on the remote Windows host is 4.0.x prior to 4.3.05017 or 4.4.x prior to 4.4.00243. It is, therefore, affected by a privilege escalation vulnerability in the Start Before Logon SBL module due to insufficient access controls. A local...

TightVNC Viewer < 1.3.10 Multiple Integer Overflows

The installed version of TightVNC Viewer is earlier than 1.3.10. Such versions reportedly miscalculate a buffer size on the heap. If an attacker can trick a user on the remote host into connecting to a malicious server, he can probably exploit this issue using specially crafted messages to execut...

SimpleBoard sbp Parameter Remote File Inclusion

Binary data 3684.prm...

AWStats < 6.3 awstats.pl configdir Parameter Remote Command Execution

Binary data 2534.prm...

KB5004948: Windows 10 1607 and Windows Server 2016 OOB Security Update RCE (July 2021)

A remote command execution vulnerability exists in Windows Print Spooler service improperly performs privileged file operations. An authenticated, remote attacker can exploit this to bypass and run arbitrary code with SYSTEM privileges. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Oracle WebLogic Server Multiple Vulnerabilities (Jan 2021 CPU)

The version of WebLogic Server installed on the remote host is affected by multiple vulnerabilities as referenced in the January 2021 CPU advisory. - An unspecified vulnerability exists in the Core component. An unauthenticated, remote attacker with network access via IIOP, T3 can exploit this...

Webmin 1.890 - 1.920 Remote Command Execution (CVE-2019-15107, CVE-2019-15231)

The Webmin install hosted on the remote host is affected by a remote command execution vulnerability. A remote, unauthenticated attacker and exploit this to execute arbitrary commands on the remote host. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...

Microsoft SQL Server STARTTLS Support

The remote Microsoft SQL Server service supports the use of encryption initiated during pre-login to switch from a cleartext to an encrypted communications channel. TRUSTED...

Telerik UI for ASP.NET AJAX Cryptographic Weakness

The version of Telerik UI for ASP.NET AJAX installed on the remote Windows host is affected by a cryptographic weakness in Telerik.Web.UI.dll. An unauthenticated, remote attacker can exploit this, via specially crafted data, to disclose encryption keys. %NASLMINLEVEL 70300 C Tenable Network...

Palo Alto Networks PAN-OS < 5.0.15 / 5.1.x < 5.1.10 / 6.0.x < 6.0.6 / 6.1.x < 6.1.1 Bash Shell Remote Code Execution (Shellshock)

The remote host is running a version of Palo Alto Networks PAN-OS prior to 5.0.15 / 5.1.10 / 6.0.6 / 6.1.1. It is, therefore, affected by a command injection vulnerability in GNU Bash known as Shellshock, which is due to the processing of trailing strings after function definitions in the values ...