MS13-002: Vulnerabilities in Microsoft XML Core Services Could Allow Remote Code Execution (2756145)

The version of Microsoft XML Core Services installed on the remote Windows host is affected by multiple code execution vulnerabilities when visiting a specially crafted web page using Internet Explorer. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid63420;...

OpenSSH 8.2 < 8.5

ssh-agent in OpenSSH 8.2 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host. Note that Nessus has not tested for these issues but has instea...

Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS : Apache HTTP Server regression (USN-6885-2)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-6885-2 advisory. USN-6885-1 fixed vulnerabilities in Apache HTTP Server. One of the security fixes introduced a regression when proxying requests to a HTTP...

PHP 7.2.x < 7.2.13 Multiple vulnerabilities

According to its banner, the version of PHP running on the remote web server is 7.2.x prior to 7.2.13. It is, therefore, affected by multiple vulnerabilities: - An arbitrary command injection vulnerability exists in the imapopen function due to improper filters for mailbox names prior to passing...

MS12-020: Vulnerabilities in Remote Desktop Could Allow Remote Code Execution (2671387)

An arbitrary remote code vulnerability exists in the implementation of the Remote Desktop Protocol RDP on the remote Windows host. The vulnerability is due to the way that RDP accesses an object in memory that has been improperly initialized or has been deleted. If RDP has been enabled on the...

Microsoft Windows SMB Shares Access

The remote has one or more Windows shares that can be accessed through the network with the given credentials. Depending on the share rights, it may allow an attacker to read / write confidential data. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid10396;...

Microsoft ASP.NET ValidateRequest Filters Bypass

According to the HTTP headers received from the remote host, the web server is configured to use the ASP.NET framework. This framework includes the ValidateRequest feature, which is used by ASP.NET web applications to filter user input in an attempt to prevent cross-site scripting attacks. Howeve...

F5 Networks BIG-IP : TMUI RCE (CVE-2020-5902) (Direct Check)

A remote code execution vulnerability exists in Traffic Management User Interface TMUI, also referred to as the Configuration utility. An unauthenticated, remote attacker can exploit this to bypass authentication and execute arbitrary system commands, create or delete files, disable services,...

OpenSSL 1.0.2 < 1.0.2i Multiple Vulnerabilities

The version of OpenSSL installed on the remote host is prior to 1.0.2i. It is, therefore, affected by multiple vulnerabilities as referenced in the 1.0.2i advisory. - Multiple memory leaks in t1lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to...

Solaris 10 Forced Login Telnet Authentication Bypass

The remote version of telnet does not sanitize the user-supplied 'USER' environment variable. By supplying a specially malformed USER environment variable, an attacker may force the remote telnet server to believe that the user has already authenticated. For instance, the following command : teln...

MS11-049: Vulnerability in the Microsoft XML Editor Could Allow Information Disclosure (2543893)

An application on the remote host has an XML external entity vulnerability. When parsing a specially crafted Web Service Discovery .disco file, external XML entities are allowed for untrusted user input. This could result in information disclosure. A remote attacker could exploit this by tricking...

Pligg Detection

The remote host is running Pligg, a web-based content management system written in PHP. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid47765; scriptversion"1.8"; scriptsetattributeattribute:"pluginmodificationdate", value:"2022/06/01"; scriptnameenglish:"Pligg...

Solaris 10 (sparc) : 119757-43 (deprecated)

SunOS 5.10: Samba patch. Date this patch was last updated by Sun : Nov/09/17 This plugin has been deprecated and either replaced with individual 119757 patch-revision plugins, or deemed non-security related. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. @DEPRECATED@ Disabled on 2018/03/12...

MikroTik RouterOS < 6.44.6 LTS or 6.45.x < 6.45.7 Multiple Vulnerabilities

According to its self-reported version, the remote networking device is running a version of MikroTik RouterOS prior to 6.44.6 LTS or 6.45.x prior to 6.45.7. It is, therefore, affected by multiple vulnerabilities : - Relative Path Traversal in NPK Parsing - RouterOS 6.45.6 Stable, RouterOS 6.44.5...

openSUSE Security Update : libreoffice (openSUSE-SU-2014:1727-1)

This libreoffice update fixes the following security and non secuirty issues : - Fix for CVE-2014-9093 bnc907636. - Fix typo %libdir - %libdir - Remove dangling symlinks from previous versions bnc884942. - Fix build with boost 1.56 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

HyperText Transfer Protocol (HTTP) Information

This test gives some information about the remote HTTP protocol - the\n' 'version used, whether HTTP Keep-Alive is enabled, etc...\n\n' 'This test is informational only and does not denote any security\n' 'problem. C Tenable Network Security, Inc. include "compat.inc"; if description scriptid2426...

Nginx 1.25.x < 1.26.1 Multiple Vulnerabilities

According to its Server response header, the installed version of nginx is 1.25.x prior to 1.26.1. It is, therefore, affected by four security issues were identified in nginx HTTP/3 implementation, which might allow an attacker that uses a specially crafted QUIC session to cause a worker process...

KB5008218: Windows 10 version 1809 / Windows Server 2019 Security Update (December 2021)

The Windows 10 1809 / Windows Server 2019 installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges. CVE-2021-41333, CVE-2021-43207,...

Apache Struts 2 REST Plugin XStream XML Request Deserialization RCE

The remote web application appears to use the Apache Struts 2 web framework. A remote code execution vulnerability exists in the REST plugin, which uses XStreamHandler to insecurely deserialize user-supplied input in XML requests. An unauthenticated, remote attacker can exploit this, via a...

OpenSSL 1.0.2 < 1.0.2ze Vulnerability

The version of OpenSSL installed on the remote host is prior to 1.0.2ze. It is, therefore, affected by a vulnerability as referenced in the 1.0.2ze advisory. - The crehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some...

Serv-U FTP Server <= 15.2.3 Hotfix 1 Memory Escape Vulnerability

According to its banner, the installed version of Serv-U is a version prior to 15.2.3 Hotfix 2. It is, therefore, affected memory escape vulnerability. An unauthenticated remote attacker who successfully exploited this vulnerability could run arbitrary code with privileges, which could then insta...

ESXi 5.5 / 6.0 / 6.5 / 6.7 Speculative Execution Side Channel Vulnerability (Foreshadow) (VMSA-2018-0020) (remote check)

The remote VMware ESXi host is version 5.5, 6.0, 6.5, or 6.7 and is missing a security patch. It is, therefore, vulnerable to a speculative execution side channel attack known as L1 Terminal Fault L1TF. An attacker who successfully exploited L1TF may be able to read privileged data across trust...

IBM Rational ClearQuest 7.1.x < 7.1.2.16 / 8.0.0.x < 8.0.0.13 / 8.0.1.x < 8.0.1.6 Multiple Vulnerabilities (credentialed check) (POODLE)

The remote host has a version of IBM Rational ClearQuest 7.1.x prior to 7.1.2.16 / 8.0.0.x prior to 8.0.0.13 / 8.0.1.x prior to 8.0.1.6 installed. It is, therefore, potentially affected by multiple vulnerabilities in third party libraries : - An error exists in the libcURL and OpenSSL libraries...

WordPress 6.0 < 6.3.2 Multiple Vulnerabilities

The version of Wordpress Core installed on the remote host are affected by multiple vulnerabilities. - The Popup Builder WordPress plugin through 4.1.15 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting...

OpenSSH 6.2 < 8.8

sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with...

SSH settings

This plugin initializes the SSH credentials as set by the user. To set the credentials, edit your scan policy and go to the section 'Credentials'. TRUSTED...

MariaDB 10.11.0 < 10.11.8

The version of MariaDB installed on the remote host is prior to 10.11.8. It is, therefore, affected by a vulnerability as referenced in the 10.11.8 advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: Client: mysqldump. Supported versions that are affected are 8.0.36 a...

MS12-070: Vulnerability in SQL Server Could Allow Elevation of Privilege (2754849)

The remote host has a version of Microsoft SQL Server installed. This version of SQL Server is running SQL Server Reporting Services SRSS, that is affected by a cross-site scripting XSS vulnerability that could allow elevation of privileges. Successful exploitation could allow an attacker to...

Juniper Junos OS Multiple Vulnerabilities (JSA11171)

The version of Junos OS installed on the remote host is affected by multiple vulnerabilities as referenced in the JSA11171 advisory. - The control mode mode 6 functionality in ntpd in NTP before 4.2.8p9 allows remote attackers to set or unset traps via a crafted control mode packet. CVE-2016-9310...

Janitza Hard-Coded FTP Password

The remote Janitza FTP server can be accessed with hard-coded credentials. A remote attacker can leverage the credentials to upload and download arbitrary files. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid86905; scriptversion"1.7"; scriptcvsdate"Date: 2018/11/15...

Juniper Junos NTP Server Amplification Remote DoS (JSA10613)

According to its self-reported version number, the remote Juniper Junos device is affected by a vulnerability in the NTP daemon related to the handling of the 'monlist' command. A remote attacker can exploit this by forging a request that results in a distributed denial of service. Note that this...

Apache Tomcat 9.0.0.M1 < 9.0.43 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 9.0.43. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat9.0.43security-9 advisory. - The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to...

Telerik UI for ASP.NET AJAX RadAsyncUpload Multiple Vulnerabilities

The version of Telerik UI for ASP.NET AJAX installed on the remote Windows host is affected by multiple vulnerabilities in Telerik.Web.UI.dll. An unauthenticated, remote attacker can exploit this, via specially crafted data, to execute arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Securit...

Microsoft Windows Search Remote Code Execution Vulnerability (CVE-2017-8543)

By sending two malformed Windows Search Protocol packets over SMB, Nessus was able to overflow an allocated buffer. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid102683; scriptversion"1.12"; scriptsetattributeattribute:"pluginmodificationdate", value:"2026/08/12";...

PHP 7.2.x / 7.3.x < 7.3.22 Memory Leak Vulnerability

According to its self-reported version number, the version of PHP running on the remote web server is 7.2.x or 7.3.x prior to 7.3.21. It is, therefore affected by a memory leak vulnerability in the LDAP component. An unauthenticated, remote attacker could exploit this issue to cause a...

MS05-027: Vulnerability in SMB Could Allow Remote Code Execution (896422)

The remote version of Windows contains a flaw in the Server Message Block SMB implementation that could allow an attacker to execute arbitrary code on the remote host. An attacker does not need to be authenticated to exploit this flaw. C Tenable Network Security, Inc. include"compat.inc"; if...

ProFTPD 1.3.1 SQL injection protection bypass

The remote host is using ProFTPD, a free FTP server for Unix and Linux. According to its banner, the version of ProFTPD installed on the remote host is 1.3.1x and may be affected by SQL injection protection bypass when NLS support is enabled. C Tenable Network Security, Inc. include'compat.inc'; ...

Oracle WebLogic Server (Jan 2023 CPU)

The version of Oracle WebLogic Server installed on the remote host is missing a security patch from the January 2023 Critical Patch Update CPU. It is, therefore, affected by multiple vulnerabilities, including: - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware...

Security Updates for Microsoft Office Products (Oct 2022) (macOS)

The Microsoft Office Products are missing security updates. It is, therefore, affected by multiple vulnerabilities: - A remote code execution vulnerabilities. An attacker can exploit these to bypass authentication and execute unauthorized arbitrary commands. CVE-2022-38048, CVE-2022-41031 - A...

Jetty < 9.4.39 Multiple Vulnerabilities

According to its self-reported version number, the instance of Jetty hosted on the remote web server is prior to 9.4.39, 10.0.x prior to 10.0.2 or 11.0.x prior to 11.0.2. It is, therefore, affected by multiple vulnerabilities: - An issue where CPU usage can reach 100% with a large invalid TLS...

KB4056893: Windows 10 LTSB January 2018 Security Update (Meltdown)(Spectre)

The remote Windows host is missing security update 4056893 or 4075199. It is, therefore, affected by multiple vulnerabilities : - An vulnerability exists within microprocessors utilizing speculative execution and indirect branch prediction, which may allow an attacker with local user access to...

Web Application Sitemap

The remote web server contains linkable content that can be used to gather information about a target. C Tenable Network Security, Inc. if NASLLEVEL 5201 exit0, "webmirror3.nbin is required."; include"compat.inc"; ifdescription scriptid91815; scriptversion "$Revision: 1.1 $"; scriptcvsdate"$Date:...

Oracle WebLogic 10.3.6.0.0 / 12.1.3.0.0 / 12.2.1.4.0 / 14.1.1.0.0 Authentication Bypass

Oracle Weblogic versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.4.0 & 14.1.1.0.0 suffer from a weakness allowing to bypass authentication and to access the management panel due to a bad character management %252e "." & %252f "/". In some cases, exploiting this vulnerability can lead to the execution of...

CentOS 7 : kernel (CESA-2018:3083)

An update for kernel is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

FCKeditor 'CurrentFolder' Arbitrary File Upload

FCKeditor is installed on the remote host. It is an open source HTML text editor that is typically bundled with web applications such Dokeos, GForge, Geeklog, and Xoops, although it can also be installed on its own. The installed version of the software fails to sanitize input passed to the...

Telerik UI for ASP.NET AJAX RadAsyncUpload .NET Deserialization Vulnerability

Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is exploitable when the encryption keys are known due to the presence of CVE-2017-11317 or CVE-2017-11357, or other means. Exploitation can result in remote...

RHEL 7 : kernel (RHSA-2018:3651)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3651 advisory. - kernel: stack-based buffer overflow in chapservercomputemd5 in iscsi target CVE-2018-14633 - kernel: NULL pointer dereference in...

Apache Shiro URI Path Security Directory Traversal Information Disclosure

The version of the Apache Shiro open source security framework running on the remote web server is affected by an error in the path-based filter chain mechanism due to a failure to properly normalize URI paths before comparing them with entries in the shiro.ini file. An unauthenticated, remote...

JamMail jammail.pl mail Parameter Arbitrary Command Execution

The remote host is running JamMail, a webmail application written in Perl. The version of JamMail running on the remote host has an arbitrary command execution vulnerability. Input to the 'mail' parameter of jammail.pl is not sanitized. A remote attacker could exploit this to execute arbitrary...

Bandmin 1.4 index.cgi Multiple Parameter XSS

The remote host is running the Bandmin CGI suite. There is a cross-site scripting issue in this suite that may allow an attacker to steal your users cookies. The flaw lies in the cgi bandwitdh/index.cgi %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Date: 28 May 2003 16:38:40 -0000 From:...