MS12-020: Vulnerabilities in Remote Desktop Could Allow Remote Code Execution (2671387)

An arbitrary remote code vulnerability exists in the implementation of the Remote Desktop Protocol RDP on the remote Windows host. The vulnerability is due to the way that RDP accesses an object in memory that has been improperly initialized or has been deleted. If RDP has been enabled on the...

Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS : Apache HTTP Server regression (USN-6885-2)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-6885-2 advisory. USN-6885-1 fixed vulnerabilities in Apache HTTP Server. One of the security fixes introduced a regression when proxying requests to a HTTP...

OpenSSH 8.2 < 8.5

ssh-agent in OpenSSH 8.2 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host. Note that Nessus has not tested for these issues but has instea...

Pligg Detection

The remote host is running Pligg, a web-based content management system written in PHP. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid47765; scriptversion"1.8"; scriptsetattributeattribute:"pluginmodificationdate", value:"2022/06/01"; scriptnameenglish:"Pligg...

Solaris 10 Forced Login Telnet Authentication Bypass

The remote version of telnet does not sanitize the user-supplied 'USER' environment variable. By supplying a specially malformed USER environment variable, an attacker may force the remote telnet server to believe that the user has already authenticated. For instance, the following command : teln...

Webmin 1.890 - 1.920 Remote Command Execution (CVE-2019-15107, CVE-2019-15231)

The Webmin install hosted on the remote host is affected by a remote command execution vulnerability. A remote, unauthenticated attacker and exploit this to execute arbitrary commands on the remote host. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...

Solaris 10 (sparc) : 119757-43 (deprecated)

SunOS 5.10: Samba patch. Date this patch was last updated by Sun : Nov/09/17 This plugin has been deprecated and either replaced with individual 119757 patch-revision plugins, or deemed non-security related. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. @DEPRECATED@ Disabled on 2018/03/12...

NFS Share Export List

This plugin retrieves the list of NFS exported shares. C Tenable Network Security, Inc. include 'compat.inc' ; if description scriptid10437; scriptversion"1.36"; scriptcvsdate"Date: 2019/10/04 16:48:26"; scriptnameenglish:"NFS Share Export List"; scriptsummaryenglish:"Gets a list of exported NFS...

Microsoft ASP.NET ValidateRequest Filters Bypass

According to the HTTP headers received from the remote host, the web server is configured to use the ASP.NET framework. This framework includes the ValidateRequest feature, which is used by ASP.NET web applications to filter user input in an attempt to prevent cross-site scripting attacks. Howeve...

F5 Networks BIG-IP : TMUI RCE (CVE-2020-5902) (Direct Check)

A remote code execution vulnerability exists in Traffic Management User Interface TMUI, also referred to as the Configuration utility. An unauthenticated, remote attacker can exploit this to bypass authentication and execute arbitrary system commands, create or delete files, disable services,...

KB5004948: Windows 10 1607 and Windows Server 2016 OOB Security Update RCE (July 2021)

A remote command execution vulnerability exists in Windows Print Spooler service improperly performs privileged file operations. An authenticated, remote attacker can exploit this to bypass and run arbitrary code with SYSTEM privileges. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

dnsmasq < 2.83 Multiple Vulnerabilities (DNSPOOQ)

The version of dnsmasq installed on the remote host is prior to 2.83. It is, therefore, affected by multiple vulnerabilities: - Multiple remote buffer overflows in the DNSSEC implementation. CVE-2020-25681, CVE-2020-25682, CVE-2020-25683, CVE-2020-25687 - A UDP DNS cache poisoning vulnerability...

Apache Struts 2 REST Plugin XStream XML Request Deserialization RCE

The remote web application appears to use the Apache Struts 2 web framework. A remote code execution vulnerability exists in the REST plugin, which uses XStreamHandler to insecurely deserialize user-supplied input in XML requests. An unauthenticated, remote attacker can exploit this, via a...

IBM Rational ClearQuest 7.1.x < 7.1.2.16 / 8.0.0.x < 8.0.0.13 / 8.0.1.x < 8.0.1.6 Multiple Vulnerabilities (credentialed check) (POODLE)

The remote host has a version of IBM Rational ClearQuest 7.1.x prior to 7.1.2.16 / 8.0.0.x prior to 8.0.0.13 / 8.0.1.x prior to 8.0.1.6 installed. It is, therefore, potentially affected by multiple vulnerabilities in third party libraries : - An error exists in the libcURL and OpenSSL libraries...

OpenSSL 1.0.2 < 1.0.2ze Vulnerability

The version of OpenSSL installed on the remote host is prior to 1.0.2ze. It is, therefore, affected by a vulnerability as referenced in the 1.0.2ze advisory. - The crehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some...

KB5008218: Windows 10 version 1809 / Windows Server 2019 Security Update (December 2021)

The Windows 10 1809 / Windows Server 2019 installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges. CVE-2021-41333, CVE-2021-43207,...

MikroTik RouterOS < 6.44.6 LTS or 6.45.x < 6.45.7 Multiple Vulnerabilities

According to its self-reported version, the remote networking device is running a version of MikroTik RouterOS prior to 6.44.6 LTS or 6.45.x prior to 6.45.7. It is, therefore, affected by multiple vulnerabilities : - Relative Path Traversal in NPK Parsing - RouterOS 6.45.6 Stable, RouterOS 6.44.5...

MS12-070: Vulnerability in SQL Server Could Allow Elevation of Privilege (2754849)

The remote host has a version of Microsoft SQL Server installed. This version of SQL Server is running SQL Server Reporting Services SRSS, that is affected by a cross-site scripting XSS vulnerability that could allow elevation of privileges. Successful exploitation could allow an attacker to...

Nginx 1.25.x < 1.26.1 Multiple Vulnerabilities

According to its Server response header, the installed version of nginx is 1.25.x prior to 1.26.1. It is, therefore, affected by four security issues were identified in nginx HTTP/3 implementation, which might allow an attacker that uses a specially crafted QUIC session to cause a worker process...

WordPress 6.0 < 6.3.2 Multiple Vulnerabilities

The version of Wordpress Core installed on the remote host are affected by multiple vulnerabilities. - The Popup Builder WordPress plugin through 4.1.15 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting...

ESXi 5.5 / 6.0 / 6.5 / 6.7 Speculative Execution Side Channel Vulnerability (Foreshadow) (VMSA-2018-0020) (remote check)

The remote VMware ESXi host is version 5.5, 6.0, 6.5, or 6.7 and is missing a security patch. It is, therefore, vulnerable to a speculative execution side channel attack known as L1 Terminal Fault L1TF. An attacker who successfully exploited L1TF may be able to read privileged data across trust...

OpenSSH 6.2 < 8.8

sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with...

Juniper Junos NTP Server Amplification Remote DoS (JSA10613)

According to its self-reported version number, the remote Juniper Junos device is affected by a vulnerability in the NTP daemon related to the handling of the 'monlist' command. A remote attacker can exploit this by forging a request that results in a distributed denial of service. Note that this...

MS11-049: Vulnerability in the Microsoft XML Editor Could Allow Information Disclosure (2543893)

An application on the remote host has an XML external entity vulnerability. When parsing a specially crafted Web Service Discovery .disco file, external XML entities are allowed for untrusted user input. This could result in information disclosure. A remote attacker could exploit this by tricking...

Serv-U FTP Server <= 15.2.3 Hotfix 1 Memory Escape Vulnerability

According to its banner, the installed version of Serv-U is a version prior to 15.2.3 Hotfix 2. It is, therefore, affected memory escape vulnerability. An unauthenticated remote attacker who successfully exploited this vulnerability could run arbitrary code with privileges, which could then insta...

Apache Tomcat 9.0.0.M1 < 9.0.43 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 9.0.43. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat9.0.43security-9 advisory. - The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to...

SSH settings

This plugin initializes the SSH credentials as set by the user. To set the credentials, edit your scan policy and go to the section 'Credentials'. TRUSTED...

Janitza Hard-Coded FTP Password

The remote Janitza FTP server can be accessed with hard-coded credentials. A remote attacker can leverage the credentials to upload and download arbitrary files. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid86905; scriptversion"1.7"; scriptcvsdate"Date: 2018/11/15...

MS05-027: Vulnerability in SMB Could Allow Remote Code Execution (896422)

The remote version of Windows contains a flaw in the Server Message Block SMB implementation that could allow an attacker to execute arbitrary code on the remote host. An attacker does not need to be authenticated to exploit this flaw. C Tenable Network Security, Inc. include"compat.inc"; if...

Telerik UI for ASP.NET AJAX RadAsyncUpload Multiple Vulnerabilities

The version of Telerik UI for ASP.NET AJAX installed on the remote Windows host is affected by multiple vulnerabilities in Telerik.Web.UI.dll. An unauthenticated, remote attacker can exploit this, via specially crafted data, to execute arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Securit...

KB4056893: Windows 10 LTSB January 2018 Security Update (Meltdown)(Spectre)

The remote Windows host is missing security update 4056893 or 4075199. It is, therefore, affected by multiple vulnerabilities : - An vulnerability exists within microprocessors utilizing speculative execution and indirect branch prediction, which may allow an attacker with local user access to...

Oracle WebLogic Server (Jan 2023 CPU)

The version of Oracle WebLogic Server installed on the remote host is missing a security patch from the January 2023 Critical Patch Update CPU. It is, therefore, affected by multiple vulnerabilities, including: - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware...

Security Updates for Microsoft Office Products (Oct 2022) (macOS)

The Microsoft Office Products are missing security updates. It is, therefore, affected by multiple vulnerabilities: - A remote code execution vulnerabilities. An attacker can exploit these to bypass authentication and execute unauthorized arbitrary commands. CVE-2022-38048, CVE-2022-41031 - A...

CentOS 7 : kernel (CESA-2018:3083)

An update for kernel is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

JamMail jammail.pl mail Parameter Arbitrary Command Execution

The remote host is running JamMail, a webmail application written in Perl. The version of JamMail running on the remote host has an arbitrary command execution vulnerability. Input to the 'mail' parameter of jammail.pl is not sanitized. A remote attacker could exploit this to execute arbitrary...

Oracle WebLogic 10.3.6.0.0 / 12.1.3.0.0 / 12.2.1.4.0 / 14.1.1.0.0 Authentication Bypass

Oracle Weblogic versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.4.0 & 14.1.1.0.0 suffer from a weakness allowing to bypass authentication and to access the management panel due to a bad character management %252e "." & %252f "/". In some cases, exploiting this vulnerability can lead to the execution of...

RHEL 7 : kernel (RHSA-2018:3651)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3651 advisory. - kernel: stack-based buffer overflow in chapservercomputemd5 in iscsi target CVE-2018-14633 - kernel: NULL pointer dereference in...

HyperText Transfer Protocol (HTTP) Information

This test gives some information about the remote HTTP protocol - the\n' 'version used, whether HTTP Keep-Alive is enabled, etc...\n\n' 'This test is informational only and does not denote any security\n' 'problem. C Tenable Network Security, Inc. include "compat.inc"; if description scriptid2426...

FCKeditor 'CurrentFolder' Arbitrary File Upload

FCKeditor is installed on the remote host. It is an open source HTML text editor that is typically bundled with web applications such Dokeos, GForge, Geeklog, and Xoops, although it can also be installed on its own. The installed version of the software fails to sanitize input passed to the...

Bandmin 1.4 index.cgi Multiple Parameter XSS

The remote host is running the Bandmin CGI suite. There is a cross-site scripting issue in this suite that may allow an attacker to steal your users cookies. The flaw lies in the cgi bandwitdh/index.cgi %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Date: 28 May 2003 16:38:40 -0000 From:...

MariaDB 10.11.0 < 10.11.8

The version of MariaDB installed on the remote host is prior to 10.11.8. It is, therefore, affected by a vulnerability as referenced in the 10.11.8 advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: Client: mysqldump. Supported versions that are affected are 8.0.36 a...

Web Application Sitemap

The remote web server contains linkable content that can be used to gather information about a target. C Tenable Network Security, Inc. if NASLLEVEL 5201 exit0, "webmirror3.nbin is required."; include"compat.inc"; ifdescription scriptid91815; scriptversion "$Revision: 1.1 $"; scriptcvsdate"$Date:...

Red Hat Update Level

The remote Red Hat server is missing the latest bugfix update package. As a result, it is likely to contain multiple security vulnerabilities. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid14657; scriptversion"1.41";...

ProFTPD 1.3.1 SQL injection protection bypass

The remote host is using ProFTPD, a free FTP server for Unix and Linux. According to its banner, the version of ProFTPD installed on the remote host is 1.3.1x and may be affected by SQL injection protection bypass when NLS support is enabled. C Tenable Network Security, Inc. include'compat.inc'; ...

Hydra: PostgreSQL

This plugin runs Hydra to find PostgreSQL accounts and passwords by brute force. To use this plugin, enter the 'Logins file' and the 'Passwords file' under the 'Hydra NASL wrappers options' advanced settings block. TRUSTED...

MS16-120: Security Update for Microsoft Graphics Component (3192884)

The remote Windows host is missing a security update. It is, therefore, affected by multiple vulnerabilities : - Multiple information disclosure vulnerabilities exist in the Windows GDI component due to improper handling of objects in memory. A local attacker can exploit these vulnerabilities, vi...

Telerik UI for ASP.NET AJAX RadAsyncUpload .NET Deserialization Vulnerability

Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is exploitable when the encryption keys are known due to the presence of CVE-2017-11317 or CVE-2017-11357, or other means. Exploitation can result in remote...

PHP 7.2.x / 7.3.x < 7.3.22 Memory Leak Vulnerability

According to its self-reported version number, the version of PHP running on the remote web server is 7.2.x or 7.3.x prior to 7.3.21. It is, therefore affected by a memory leak vulnerability in the LDAP component. An unauthenticated, remote attacker could exploit this issue to cause a...

CyberArk Password Vault Web Access .NET Object Deserialization (Direct Check)

The CyberArk Password Vault Web Access running on the remote host is affected by a remote code execution vulnerability due to unsafe deserialization of an .NET object. An unauthenticated, remote attacker can exploit this, via a crafted a .NET object, to execute arbitrary .NET code in the context ...

ESXi 5.5 < Build 5230635 Multiple Vulnerabilities (VMSA-2017-0006) (remote check)

The version of the remote VMware ESXi 5.5 host is prior to build 5230635. It is, therefore, affected by multiple vulnerabilities : - An unspecified flaw exists in memory initialization that allows an attacker on the guest to execute arbitrary code on the host. CVE-2017-4904 - An unspecified flaw...