RIP Poisoning Routing Table Modification (Adjacent Network)

It was possible to poison the remote host routing tables through the RIP protocol. An attacker may use this to hijack network connections. Several RIP agents reject routes that are not sent by a neighbor, so this flaw may not be exploitable from a non-adjacent network. C Tenable Network Security,...

McAfee Antivirus Detection and Status

McAfee VirusScan, an antivirus application, is installed on the remote host. However, there is a problem with the installation; either its services are not running or its virus definitions are out of date. C Tenable, Inc. This script has been rewritten by Tenable Original script was written by Je...

KB4580325: Security update for Adobe Flash Player (October 2020)

The remote Windows host is missing security update KB4580325. It is, therefore, affected by a NULL pointer dereference flaw. An unauthenticated, remote attacker can exploit this, by inserting malicious strings in an HTTP response that is by default delivered over TLS/SSL. Note that Nessus has not...

Palo Alto Networks PAN-OS for Panorama < 9.0.15 / 9.1.12-h3 / 10.0.8-h8 Multiple RCE (Log4Shell)

The version of Palo Alto Networks PAN-OS for Panorama running on the remote host is 9.0.x prior to 9.0.15, 9.1.x prior to 9.1.12-h3, or 10.0.x prior to 10.0.8-h8. It is, therefore, affected by two remote code execution vulnerabilities related to Log4Shell within the ElasticSearch component. These...

Oracle Java SE 1.7.0_321 / 1.8.0_311 / 1.11.0_13 / 1.17.0_1 Multiple Vulnerabilities (October 2021 CPU)

The version of Oracle formerly Sun Java SE or Java for Business installed on the remote host is prior to 7 Update 321, 8 Update 311, 11 Update 13, or 17 Update 1. It is, therefore, affected by multiple vulnerabilities as referenced in the October 2021 CPU advisory: - Vulnerability in the Java SE...

Apache mod_status /server-status Information Disclosure

A remote unauthenticated attacker can obtain an overview of the remote Apache web server's activity and performance by requesting the URL '/server-status'. This overview includes information such as current hosts and requests being processed, the number of workers idle and service requests, and C...

RHEL 7 : Red Hat JBoss Core Services Apache HTTP Server 2.4.29 RHEL 7 (RHSA-2018:2185)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2185 advisory. - openssl: Out-of-bounds write caused by unchecked errors in BNbn2dec CVE-2016-2182 - httpd: CRLF injection allowing HTTP response splitting...

NTP ntpd Mode 7 Error Response Packet Loop Remote DoS

The version of ntpd running on the remote host has a denial of service vulnerability. It responds to mode 7 error packets with its own mode 7 error packets. A remote attacker could exploit this by sending a mode 7 error response with a spoofed IP header, setting the source and destination IP...

CodeMeter Runtime Predictable Encryption Key

Binary data codemetercve-2020-14517.nbin...

F5 Networks BIG-IP : TLS vulnerability (K16674) (Logjam)

The TLS protocol 1.2 and earlier, when a DHEEXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHEEXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHEEXPORT and then...

Apple TV Detection

The remote host is an Apple TV, a digital media receiver. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid42825; scriptversion"1.10"; scriptsetattributeattribute:"pluginmodificationdate", value:"2025/09/29"; scriptnameenglish:"Apple TV Detection";...

Unauthenticated SMB Access Permitted (Arbitrary Credential Acceptance)

The remote host is running one of the Microsoft Windows operating systems or the SAMBA daemon. It was possible to log into it as a guest user, or a guest-like user, using a random account. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid26919; scriptversion"1.21";...

Elasticsearch Groovy Script RCE

The Elasticsearch application hosted on the remote web server is affected by a remote code execution vulnerability due to unspecified flaws in the Groovy script engine. A remote unauthenticated attacker, using a specially crafted request, can escape the sandbox and execute arbitrary Java code. A...

MS KB2871997: Update to Improve Credentials Protection and Management

The remote host is missing one or more of the following Microsoft updates: KB2871997, KB2973351, KB2975625, KB2982378, KB2984972, KB2984976, KB2984981, KB2973501, or KB3126593. These updates are needed to improve the protection against possible credential theft. - For Windows 7 / 2008 R2 :...

WordPress 5.5.x < 5.5.12 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A directory traversal via wplang. CVE-2023-2745 - A Cross-Site Request Forgery CSRF via wpajaxsetattachmentthumbnail. - An authenticated stored Cross-Site Scripting XSS vi...

OpenSSH < 7.6

According to its banner, the version of OpenSSH running on the remote host is prior to 7.6. It is, therefore, affected by a file creation restriction bypass vulnerability related to the 'processopen' function in the file 'sftp-server.c' that allows authenticated users to create zero-length files...

PHP 8.0.x < 8.0.24 Multiple Vulnerabilities

The version of PHP installed on the remote host is prior to 8.0.24. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.0.24 advisory. - In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress quines gzip files,...

Solaris 10 (sparc) : 150400-59 (deprecated)

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite subcomponent: Kernel. The supported version that is affected is 10. Easily exploitable vulnerability allows unauthenticated attacker with network access via ICMP to compromise Solaris. Successful attacks of this...

Oracle Java (Apr 2024 CPU)

The 8u401, 20.3.13, 21.3.9, 11.0.23, 17.0.10, 21.0.3, 22, and perf versions of Java installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2024 CPU advisory. - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java S...

MS16-077: Security Update for WPAD (3165191)

The remote Windows host is missing a security update. It is, therefore, affected by multiple elevation of privilege vulnerabilities : - An elevation of privilege vulnerability exists in the Web Proxy Auto Discovery WPAD protocol due to improper handling of the proxy discovery process. A remote...

SSL/TLS Recommended Cipher Suites

The remote host has open SSL/TLS ports which advertise discouraged cipher suites. It is recommended to only enable support for the following cipher suites: TLSv1.3: - 0x13,0x01 TLS13AES128GCMSHA256 - 0x13,0x02 TLS13AES256GCMSHA384 - 0x13,0x03 TLS13CHACHA20POLY1305SHA256 TLSv1.2: - 0xC0,0x2B...

Visual Studio Tools for Applications Elevation of Privilege (CVE-2025-29803)

In VSTA 2019 prior 16.0.35907.0 and VSTA 2022 prior to 17.0.35906.0, the software contains a vulnerability CVE-2025-29803 that could allow remote or local attackers to execute arbitrary code or escalate privileges within the host application, potentially compromising systems that rely on VSTA for...

@lex Guestbook livre_include.php chem_absolu Parameter Remote File Inclusion

The remote host seems to be running @lex guestbook, a guestbook web application written in PHP. The reported version may permit remote attackers, without prior authentication, to include and execute malicious PHP scripts. By modifying the 'chemabsolu' parameter of the 'livreinclude.php' script, i...

Azul Zulu Java Multiple Vulnerabilities (2024-04-16)

The version of Azul Zulu installed on the remote host is 6 prior to 6.63.0.14 / 7 prior to 7.69.0.14 / 8 prior to 8.77.0.14 / 11 prior to 11.71.14 / 17 prior to 17.49.16 / 21 prior to 21.33.14 / 22 prior to 22.30.14. It is, therefore, affected by multiple vulnerabilities as referenced in the...

F5 Networks BIG-IP : TLS/DTLS 'Lucky 13' vulnerability (K14190)

A vulnerability exists in the TLS and DTLS protocols that may allow an attacker to recover plaintext from TLS/DTLS connections that use CBC-mode encryption. CVE-2013-0169 Note: Stream ciphers, such as RC4, are not vulnerable to this issue. C Tenable Network Security, Inc. The descriptive text and...

SMB Use Domain SID to Enumerate Users

Using the domain security identifier SID, Nessus was able to enumerate the domain users on the remote Windows system. C Tenable Network Security, Inc. @PREFERENCES@ include"compat.inc"; if description scriptid10399; scriptversion"1.82"; scriptcvsdate"Date: 2020/01/07"; scriptnameenglish:"SMB Use...

Conexant Audio Driver MicTray.exe / MicTray64.exe Keylogger

The Conexant audio driver package installed on the remote Windows host is affected by an information disclosure vulnerability in the debugging features of MicTray.exe or MicTray64.exe due to a LowLevelKeyboardProc Windows hook that is being used to capture keystrokes. This data is then leaked via...

Intel PXE Server Remote Overflow

The remote host is running PXE Preboot eXecution Environment, a service which can be used to boot diskless clients. There is a flaw in the remote PXE which may allow an attacker to gain a root shell on this host. Nessus disabled this service to perform this security check C Tenable Network...

Attachmate Reflection X Heartbeat Information Disclosure (Heartbleed)

The Attachmate Reflection X install on the remote host is affected by an out-of-bounds read error, known as the 'Heartbleed Bug' in the included OpenSSL version. This error is related to handling TLS heartbeat extensions that could allow an attacker to obtain sensitive information such as primary...

AgoraCart agora.cgi cart_id Parameter XSS

Agora is a CGI-based, e-commerce package. Due to poor input validation, Agora allows an attacker to execute cross-site scripting attacks. %NASLMINLEVEL 70300 This script was written by Matt Moore See the Nessus Scripts License for details include'deprecatednasllevel.inc'; include'compat.inc'; if...

Oracle GlassFish Server 3.0.1.x < 3.0.1.17 / 3.1.2.x < 3.1.2.18 (October 2017 CPU)

According to its self-reported version, the Oracle GlassFish Server running on the remote host is 3.0.1.x prior to 3.0.1.17 or 3.1.2.x prior to 3.1.2.18. It is, therefore, affected by multiple vulnerabilities, including multiple denial of service vulnerabilities and unauthorized access to sensiti...

TLS ALPN Supported Protocol Enumeration

The remote host supports the TLS ALPN extension. This plugin enumerates the protocols the extension supports. TRUSTED...

Default Password 'P@ssw0rd' for 'admin' Account

The account 'admin' on the remote host has the default password 'P@ssw0rd'. A remote attacker can exploit this issue to gain administrative access to the affected system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. account = "admin"; password = "P@ssw0rd"; include'deprecatednasllevel.inc...

OpenSSL < 1.0.2i Default Weak 64-bit Block Cipher (SWEET32)

According to its banner, the version of OpenSSL running on the remote host is prior to 1.0.2i. It is, therefore, affected by a vulnerability, known as SWEET32, in the 3DES and Blowfish algorithms due to the use of weak 64-bit block ciphers by default. A man-in-the-middle attacker who has sufficie...

MS15-002: Vulnerability in Windows Telnet Service Could Allow Remote Code Execution (3020393)

The remote Windows host is affected by a remote code execution vulnerability due to improper processing of packets by the Telnet service. A remote attacker can exploit this issue by sending specially crafted packets to a Windows server. C Tenable Network Security, Inc. include"compat.inc"; if...

HP, Samsung, and Xerox Printer Driver Privilege Escalation (CVE-2021-3438)

The printer driver installed on the remote host is missing a security update. It is, therefore, affected by a privilege escalation vulnerability. An authenticated, local attacker can exploit this to gain privileged or administrator access to the system. %NASLMINLEVEL 70300 C Tenable Network...

HP LaserJet PJL Interface Directory Traversal (HPSBPI02575)

The remote host's PJL interface fails to sanitize input to the 'name' parameter of the 'fsdirlist' command before using it. An attacker can leverage this issue using a directory traversal sequence to view arbitrary files on the affected host within the context of the PJL service. Information...

Apache Tomcat 9.0.40 < 9.0.54

The version of Tomcat installed on the remote host is prior to 9.0.54. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat9.0.54security-9 advisory. - The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 a...

Amazon Linux AMI : log4j-cve-2021-44228-hotpatch (ALAS-2021-1554)

The version of log4j-cve-2021-44228-hotpatch installed on the remote host is prior to 1.1-13. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1554 advisory. The Apache Log4j hotpatch package starting with log4j-cve-2021-44228-hotpatch-1.1-13 will now explicitly mimic...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Sudo vulnerabilities (USN-4705-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4705-1 advisory. It was discovered that Sudo incorrectly handled memory when parsing command lines. A local attacker could possibly use this issue...

Oracle WebLogic Server (April 2024 CPU)

The 12.2.1.4.0 and 14.1.1.0.0 versions of WebLogic Server installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2024 CPU advisory: - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Samples handlebars. Supported...

KB5014699: Windows 10 Version 20H2 / 21H1 / 21H2 Security Update (June 2022)

The remote Windows host is missing security update 5014699. It is, therefore, affected by multiple vulnerabilities: - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges. CVE-2022-30166, CVE-2022-30165, CVE-2022-30160 CVE-2022-30154, CVE-2022-30151,...

Amazon Linux 2 : openssh (ALAS-2022-1748)

The version of openssh installed on the remote host is prior to 7.4p1-22. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1748 advisory. A flaw was found in OpenSSH. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges...

nginx HTTP Server Detection

Nessus was able to detect the nginx HTTP server by looking at the HTTP banner on the remote host. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid106375; scriptversion"1.9"; scriptsetattributeattribute:"pluginmodificationdate", value:"2026/08/10"; scriptxrefname:"IAVT...

Bitvise SSH Server < 7.41 Multiple Vulnerabilities (remote)

According to its banner, the version of Bitvise SSH Server running on the remote host is prior to 7.41. It is, therefore, affected by multiple vulnerabilities. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number. C Tenable...

Webcart Default Install Configuration Disclosure

At least one of these file or directories is world readable : /webcart/orders/ /webcart/orders/import.txt /webcart/carts/ /webcart/config/ /webcart/config/clients.txt /webcart-lite/orders/import.txt /webcart-lite/config/clients.txt This misconfiguration may allow an attacker to gather the credit...

PHP < 7.3.24 Multiple Vulnerabilities

According to its self-reported version number, the version of PHP running on the remote web server is prior to 7.3.24. It is, therefore affected by multiple vulnerabilities %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

FreeBSD : chromium -- multiple security fixes (502c9f72-99b3-11ee-86bb-a8a1599412c6)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 502c9f72-99b3-11ee-86bb-a8a1599412c6 advisory. - Type Confusion in V8. CVE-2023-6702 - Use after free in Blink. CVE-2023-6703 - Use after fre...

PHP 7.3.x < 7.3.13 / 7.4.x < 7.4.1 Multiple Vulnerabilities

According to its banner, the version of PHP running on the remote web server is 7.3.x prior to 7.3.13 or 7.4.x prior to 7.4.1. It is, therefore, affected by multiple vulnerabilities: - An arbitrary file read vulnerability exists in link and DirectoryIterator class due to improper handling of...

MVPower DVR Remote Command Execution

The remote AOST-based network video recorder distributed by MVPower is affected by a remote command execution vulnerability. An unauthenticated remote attacker can use this vulnerability to execute operating system commands as root. This vulnerability has been used by the IoT Reaper botnet. C...