CGI Generic Path Traversal (write test)

The remote web server hosts CGI scripts that fail to adequately sanitize request strings and are affected by directory traversal or local file inclusion vulnerabilities. By leveraging this issue, an attacker may be able to modify arbitrary files on the web server or execute commands. Due to the w...

CGI Generic SSI Injection (HTTP headers)

The remote web server hosts one or more CGI scripts that fail to adequately sanitize request strings and seem to be vulnerable to an 'SSI injection' attack. By leveraging this issue, an attacker may be able to execute arbitrary commands on the remote host. %NASLMINLEVEL 70300 C Tenable Network...

Security Updates for Microsoft Visual Studio Products (January 2019)

The Microsoft Visual Studio Products are missing a security update. It is, therefore, affected by the following vulnerability : - An information disclosure vulnerability exists when Visual Studio improperly discloses arbitrary file contents if the victim opens a malicious .vscontent file. An...

Allegro RomPager HTTP Cookie Management Remote Code Execution Vulnerability (Misfortune Cookie)

Nessus was able to overwrite the request path by sending a specially crafted cookie to the remote web server. It is, therefore, affected by multiple vulnerabilities : - A flaw in HTTP cookie management in the embedded web server allows a remote attacker to execute arbitrary code with administrati...

PHP < 7.3.24 Multiple Vulnerabilities

According to its self-reported version number, the version of PHP running on the remote web server is prior to 7.3.24. It is, therefore affected by multiple vulnerabilities %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

Oracle Database Multiple Vulnerabilities (July 2017 CPU) (POODLE) (SWEET32)

The remote Oracle Database Server is missing the July 2017 Critical Patch Update CPU. It is, therefore, affected by multiple vulnerabilities : - A man-in-the-middle MitM information disclosure vulnerability, known as POODLE, exists due to the way SSL 3.0 handles padding bytes when decrypting...

Microsoft Visual Studio .git\config Command Execution

The version of Visual Studio installed on the remote host is affected by a command execution vulnerability when processing specially crafted git trees in a case-insensitive or case-normalizing file system. A remote attacker, using a specially crafted git tree, can overwrite a user's '.git/config'...

OpenVPN Heartbeat Information Disclosure (Heartbleed)

Based on its response to a TLS request with a specially crafted heartbeat message RFC 6520, the remote OpenVPN service appears to be affected by an out-of-bounds read flaw. Because the remote OpenVPN service does not employ the 'HMAC Firewall' feature, this vulnerability can be exploited without...

RHEL 7 : openssh (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - openssh: User enumeration via malformed packets in authentication requests CVE-2018-15919 - openssh:...

Apache Tomcat 9.0.40 < 9.0.54

The version of Tomcat installed on the remote host is prior to 9.0.54. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat9.0.54security-9 advisory. - The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 a...

Pulse Connect Secure < 9.1R12 (SA44858)

According to its self-reported version, the version of Pulse Connect Secure running on the remote host is prior to 9.1R12. It is, therefore, affected by multiple vulnerabilities, including: - A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perfo...

MS Security Advisory 4022344: Security Update for Microsoft Malware Protection Engine

The version of Microsoft Malware Protection Engine MMPE installed on the remote Windows host is prior to 1.1.13704.0. It is, therefore, affected by a remote code execution vulnerability in the NScript component in mpengine.dll due to a type confusion error. An unauthenticated, remote attacker can...

CentOS 7 : nss and nspr (RHSA-2020:4076)

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4076 advisory. - When importing a curve25519 private key in PKCS8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Network Securi...

Oracle GlassFish Server 3.1.2.x < 3.1.2.15 Multiple Vulnerabilities (July 2016 CPU)

According to its self-reported version number, the Oracle GlassFish Server running on the remote host is 3.1.2.x prior to 3.1.2.15. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists in the bundled version of libcurl in the smbrequeststate...

Default Password (TANDBERG) for 'root' Account

The account 'root' on the remote host has the password 'TANDBERG'. An attacker may leverage this issue to gain administrative access to the affected system. Note that Cisco TelePresence Conductor virtual appliances are known to use these credentials to provide complete, administrative access to t...

Apache Tomcat 7.0.0 < 7.0.89

The version of Tomcat installed on the remote host is prior to 7.0.89. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat7.0.89security-7 advisory. - The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.R...

MySQL 5.6.x < 5.6.40 Multiple Vulnerabilities (April 2018 CPU)

The version of MySQL running on the remote host is 5.6.x prior to 5.6.40. It is, therefore, affected by multiple vulnerabilities as noted in the April 2018 Critical Patch Update advisory. Please consult the CVRF details for the applicable CVEs for additional information. Note that Nessus has not...

Hydra: IMAP

This plugin runs Hydra to find IMAP accounts and passwords by brute force. To use this plugin, enter the 'Logins file' and the 'Passwords file' under the 'Hydra NASL wrappers options' advanced settings block. TRUSTED...

Microsoft Teams < 1.3.0.13000 Remote Code Execution

The version of Microsoft Teams installed on the remote Windows host is a version prior to 1.3.0.13000. It is, therefore, affected by remote code execution vulnerability. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number....

phpMyAdmin 4.x < 4.8.5 Multiple Vulnerabilities (PMASA-2019-1) (PMASA-2019-2)

According to its self-reported version number, the phpMyAdmin application hosted on the remote web server is 4.x prior to 4.8.5. It is, therefore, affected by at least one of the following vulnerabilities: - A SQL injection SQLi vulnerability exists in phpMyAdmin due to improper validation of...

JQuery Detection

Nessus was able to detect JQuery on the remote host. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid106658; scriptversion"1.8"; scriptsetattributeattribute:"pluginmodificationdate", value:"2024/02/08"; scriptnameenglish:"JQuery Detection"; scriptsummaryenglish:"Detec...

PHP 5.6.x < 5.6.4 'process_nested_data' RCE

According to its banner, the version of PHP 5.6.x installed on the remote host is prior to 5.6.4. It is, therefore, affected by a use-after-free error in the 'processnesteddata' function within 'ext/standard/varunserializer.re' due to improper handling of duplicate keys within the serialized...

SSL Certificate 'commonName' Mismatch

The service running on the remote host presents an SSL certificate for which the 'commonName' CN attribute does not match the hostname on which the service listens. TRUSTED...

MS08-067: Microsoft Windows Server Service Crafted RPC Request Handling Remote Code Execution (958644) (ECLIPSEDWING) (uncredentialed check)

The remote Windows host is affected by a remote code execution vulnerability in the 'Server' service due to improper handling of RPC requests. An unauthenticated, remote attacker can exploit this, via a specially crafted RPC request, to execute arbitrary code with 'System' privileges. ECLIPSEDWIN...

OS Identification : SinFP

This script attempts to identify the operating system type and version by using the same technique as SinFP. C Tenable, Inc. SinFP is a fingerprinting tool written by GomoR and available at http://www.gomor.org/cgi-bin/sinfp.pl This plugin is a white-room reimplementation of the SinFP methodology...

Security Updates for Microsoft SQL Server OLE DB Driver (April 2024)

The Microsoft SQL Server OLE DB Driver installed on the remote host is missing a security update. It is, therefore, affected by multiple vulnerabilities: - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands...

Bootstrap 4.x < 4.3.1 Cross-Site Scripting

According to its self-reported version number, Bootstrap is 3.x prior 3.4.1 or 4.x prior to 4.3.1. Therefore, it may be affected by a Cross-Site Scripting XSS vulnerability via data-template attribute for tooltip and popover plugins. Note that the scanner has not tested for these issues but has...

SuperMicro IPMI PSBlock File Plaintext Password Disclosure

The remote SuperMicro IPMI device is affected by an information disclosure vulnerability because it exposes all usernames and passwords in plaintext via the PSBlock file. A remote, unauthenticated attacker can exploit this vulnerability to download all usernames and passwords and gain a shell on...

Mambo / Joomla! Component / Module 'mosConfig_absolute_path' Multiple Parameter Remote File Include Vulnerabilities

A third-party component for Mambo, Module, or Joomla! is running on the remote host. At least one of these components is a version that is affected by a remote file include vulnerability due to improper sanitization of user-supplied input to the 'mosConfigabsolutepath' parameter before using it t...

Woltlab Burning Board Detection

The remote host is running Burning Board or Burning Board Lite, message forum software packages that use PHP and MySQL. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid18250; scriptversion"1.20"; scriptsetattributeattribute:"pluginmodificationdate", value:"2023/05/24"...

Ubuntu 24.04 LTS. : Apache HTTP Server vulnerabilities (USN-6729-3)

The remote Ubuntu 24.04 LTS. host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6729-3 advisory. USN-6729-1 fixed vulnerabilities in Apache HTTP Server. This update provides the corresponding updates for Ubuntu 24.04 LTS. Tenable has extracted the...

MySQL 5.6.x < 5.6.47 Multiple Vulnerabilities (Jan 2020 CPU)

The version of MySQL running on the remote host is 5.6.x prior to 5.6.47. It is, therefore, affected by multiple vulnerabilities, including three of the top vulnerabilities below, as noted in the January 2020 Critical Patch Update advisory: - Unspecified vulnerability in the optimizer component o...

OpenSSL 1.1.1 < 1.1.1n Vulnerability

The version of OpenSSL installed on the remote host is prior to 1.1.1n. It is, therefore, affected by a vulnerability as referenced in the 1.1.1n advisory. - The BNmodsqrt function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli...

Apache Tomcat 7.0.x < 7.0.57 Multiple Vulnerabilities (POODLE)

According to its self-reported version number, the Apache Tomcat service listening on the remote host is 7.0.x prior to 7.0.57. It is, therefore, affected by the following vulnerabilities : - A memory double-free error exists in 'd1both.c' related to handling DTLS packets that allows denial of...

Visual Studio Tools for Applications Elevation of Privilege (CVE-2025-29803)

In VSTA 2019 prior 16.0.35907.0 and VSTA 2022 prior to 17.0.35906.0, the software contains a vulnerability CVE-2025-29803 that could allow remote or local attackers to execute arbitrary code or escalate privileges within the host application, potentially compromising systems that rely on VSTA for...

Rocky Linux 8 : openssl (RLSA-2022:1065)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:1065 advisory. - The BNmodsqrt function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function i...

Oracle Integrated Lights Out Manager (ILOM) < 3.2.6 Multiple Vulnerabilities (uncredentialed check)

According to its self-reported version number, the version of Oracle Integrated Lights Out Manager ILOM is affected by multiple vulnerabilities as described in the advisory. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid104047; scriptversion"1.9";...

Apache Tomcat 8.5.60 < 8.5.72

The version of Tomcat installed on the remote host is prior to 8.5.72. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat8.5.72security-8 advisory. - The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 a...

Dell dbutil Driver Insufficient Access Control (DSA-2021-088)

Binary data dellCVE-2021-21551.nbin...

AXIS HTTP GET Heap Overflow

The remote AXIS device is affected by a heap overflow vulnerability in its web administration interface due to a flaw in handling of special characters. An unauthenticated remote attacker can exploit this vulnerability for denial of service and possibly remote code execution. C Tenable Network...

PHP 8.1.x < 8.1.28 Multiple Vulnerabilities

According to its self-reported version number, the version of PHP installed on the remote host is 8.1.x prior to 8.1.28, 8.2.x prior to 8.2.18, or 8.3.x prior to 8.3.6. It is, therefore, affected by multiple vulnerabilities: - A command injection via array-ish $command parameter of procopen...

Check Point Gaia Operating System Multiple Vulnerabilities (sk106499)

The remote host is running a version of Gaia OS which is affected by multiple vulnerabilities: - An out of bounds read denial of service vulnerability in OpenSSL CVE-2015-1789 - An information disclosure weakness in the RC4 algorithm as used in SSL/TLS CVE-2015-2808 C Tenable Network Security, In...

FLEXnet Connect Update Service ActiveX Control Multiple Code Execution Vulnerabilities

Macrovision FLEXnet Connect, formerly known as InstallShield Update Service, is installed on the remote host. It is a software management solution for internally-developed and third-party applications, and may have been installed as part of the FLEXnet Connect SDK, other InstallShield software, o...

Curl 7.69 < 8.4.0 Heap Buffer Overflow

The version of curl installed on the remote host is affected by a heap based buffer overflow in the SOCKS5 proxy handshake. When curl is asked to pass along the hostname to the SOCKS5 proxy to allow that to resolve the address instead of it getting done by curl itself, the maximum length that...

Oracle Java SE 1.7.0_221 / 1.8.0_211 / 1.11.0_3 / 1.12.0_1 Multiple Vulnerabilities (Apr 2019 CPU) (Unix)

The version of Oracle formerly Sun Java SE or Java for Business installed on the remote host is prior to 7 Update 221, 8 Update 211, 11 Update 3, or 12 Update 1. It is, therefore, affected by multiple vulnerabilities related to the following components : - 2D - Libraries - RMI - Windows DLL Nessu...

IlohaMail Email Header XSS

The remote host is running at least one instance of IlohaMail version 0.8.12 or earlier. Such versions do not properly sanitize message headers, leaving users vulnerable to XSS attacks. For example, a remote attacker could inject JavaScript code that steals the user's session cookie and thereby...

Web Server Reverse Proxy Detection

The remote web server seems to allow any anonymous user to use it as a reverse proxy. This may expose internal services to potential mapping and, henceforth, compromise. C Tenable Network Security, Inc. include 'compat.inc' ; ifdescription scriptid12225; scriptversion "$Revision: 1.16 $";...

Apache Tomcat 8.0.0.RC1 < 8.0.43

The version of Tomcat installed on the remote host is prior to 8.0.43. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat8.0.43security-8 advisory. - A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12,...

OS Identification : HTTP

Nessus was able to identify the remote operating system type and version by examining the data returned by the remote HTTP server. %NASLMINLEVEL 70300 C Tenable, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid25247; scriptversion"1.202";...

Security Updates for Microsoft SQL Server (April 2023)

The Microsoft SQL Server installation on the remote host is missing a security update. It is, therefore, affected by the following vulnerability: - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands...