Splunk Non-root Configuration Local Privilege Escalation

The Splunk install detected on the remote host is vulnerable to a non-root configuration local privilege escalation vulnerability. Please refer the vendor advisory for remediation actions. TRUSTED...

IBM WebSphere Application Server 7.0 < 7.0.0.39 (FP39) / 8.0 < 8.0.0.11 (FP11) / 8.5 < 8.5.5.6 (FP6) Multiple Vulnerabilities (Bar Mitzvah) (FREAK)

The IBM WebSphere Application Server running on the remote host is version 7.0 prior to 7.0.0.39, 8.0 prior to 8.0.0.11, or 8.5 prior to 8.5.5.6. It is, therefore, potentially affected by multiple vulnerabilities : - A security feature bypass vulnerability, known as FREAK Factoring attack on...

HP Version Control Agent (VCA) < 7.3.3 Multiple SSL Vulnerabilities

The RPM installation of HP Version Control Agent VCA on the remote Linux host is a version prior to 7.3.3. It is, therefore, affected by multiple vulnerabilities in the bundled version of SSL : - An error exists in the 'ssl3readbytes' function that permits data to be injected into other sessions ...

CentOS 7 : kernel (RHSA-2024:1249)

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1249 advisory. - There are use-after-free vulnerabilities in the Linux kernel's net/bluetooth/l2capcore.c's l2capconnect and l2capleconnectreq functions which may all...

MariaDB 10.3.0 < 10.3.29 Multiple Vulnerabilities

The version of MariaDB installed on the remote host is prior to 10.3.29. It is, therefore, affected by multiple vulnerabilities as referenced in the 10.3.29 advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: DML. Supported versions that are affected are 5.7.3...

Samba smbmnt Local Privilege Escalation

According to its banner, the version of Samba running on the remote host is in the 2.x or 3.x branch. Such versions are shipped with a utility called 'smbmnt'. When smbmnt has the setuid 'root' bit set, a local user with access to the victim can mount a Samba share and then execute a setuid or...

Compaq WBEM HTTP Server Remote Overflow

The remote host is running a Compaq Web Management server. The remote version of this software is vulnerable to an unspecified buffer overflow that may allow an attacker to execute arbitrary code on the remote host with the privileges of the web server process. C Tenable Network Security, Inc...

Oracle Linux 9 : nodejs / and / nodejs-nodemon (ELSA-2022-6595)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-6595 advisory. - Rebase to version 16.16.0 Resolves: RHBZ2106290 Resolves: CVE-2022-32212 CVE-2022-32213 CVE-2022-32214 CVE-2022-32215 Tenable has extracted the...

Security Updates for Microsoft SQL Server (January 2021)

The Microsoft SQL Server installation on the remote host is missing a security update. It is, therefore, affected by an elevation of privilege vulnerability. An authenticated, remote attacker can exploit this issue, to gain elevated privileges. Note that Nessus has not tested for this issue but h...

CentOS 7 : systemd (CESA-2019:0049)

An update for systemd is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

WordPress < 4.9.9 / 5.x < 5.0.1 Multiple Vulnerabilities

According to its self-reported version number, the WordPress application running on the remote web server is prior to 4.9.9, or 5.x prior to 5.0.1. It is, therefore, affected by multiple vulnerabilities, including cross-site scripting XSS vulnerabilities due to improper validation of user-supplie...

NVIDIA Windows GPU Display Driver 384.x / 385.x / 386.x < 386.07 / 390.x < 390.65 Multiple Vulnerabilities (Meltdown)(Spectre)

The NVIDIA GPU display driver software on the remote host is missing a security update. It is, therefore, affected by multiple vulnerabilities. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid105777; scriptversion"1.14";...

sethc.exe Possible Backdoor

The copy of 'sethc.exe' in the Windows 'System32' directory on the remote host appears to have been modified, perhaps for use as a backdoor. Either or both of the 'InternalName' or 'OriginalFilename' file attributes no longer match the original file. This file is part of the Windows 'Sticky Keys'...

Target Credential Status by Authentication Protocol - Valid Credentials Provided

Nessus was able to determine that valid credentials were provided for an authentication protocol available on the remote target because it was able to successfully authenticate directly to the remote target using that authentication protocol at least once. Authentication was successful because th...

F5 Networks BIG-IP : Sockstress DoS tool vulnerability (SOL10509)

Sockstress DoS tool CVE-2008-4609. The TCP implementation in 1 Linux, 2 platforms based on BSD Unix, 3 Microsoft Windows, 4 Cisco products, and probably other operating systems allows remote attackers to cause a denial of service connection queue exhaustion via multiple vectors that manipulate...

Radmin (Remote Administrator) Port 10002 - Possible GDI Compromise

The remote host is running radmin - a remote administration tool - on port 10002. This indicates that an attacker may have exploited one of the flaws described in MS04-028 with a widely available exploit. As a result, anyone may connect to the remote host and gain control by logging into the remo...

smtpscan SMTP Fingerprinting

smtpscan is a SMTP fingerprinting tool written by Julien Bordet. It identifies the remote mail server even if the banners were changed. C Tenable Network Security, Inc. This NASL script is a quick and dirty conversion of smtpscan by Julien Bordet Note that smtpcan has more features than this simp...

MS01-026 / MS01-044: Microsoft IIS Remote Command Execution (uncredentialed check)

When IIS receives a user request to run a script, it renders the request in a decoded canonical form, and then performs security checks on the decoded request. A vulnerability results because a second, superfluous decoding pass is performed after the initial security checks are completed. Thus, a...

KB4530689: Windows 10 Version 1607 and Windows Server 2016 December 2019 Security Update

The remote Windows host is missing security update 4530689. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists when Microsoft Windows OLE fails to properly validate user input. An attacker could exploit the vulnerability to execute malicious...

IBM WebSphere Application Server 8.5 < Fix Pack 8.5.5.4 Multiple Vulnerabilities (POODLE)

The IBM WebSphere Application Server running on the remote host is version 8.5 prior to Fix Pack 8.5.5.4. It is, therefore, affected by the following vulnerabilities : - Multiple errors exist related to the included IBM HTTP server that can allow remote code execution or denial of service...

F5 Networks BIG-IP : OpenSSL vulnerability (K15159) (Heartbleed)

The 1 TLS and 2 DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys,...

MySQL Unpassworded Account Check

It is possible to connect to the remote MySQL database server using an unpassworded account. This may allow an attacker to launch further attacks against the database. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid10481; scriptversion"1.62"; scriptcvsdate"Date:...

FreeBSD : www/awstats -- Partial absolute pathname (bba3f684-9b1d-11ed-9a3f-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the bba3f684-9b1d-11ed-9a3f-b42e991fc52e advisory. - In AWStats through 7.8, cgi-bin/awstats.pl?config= accepts a partial absolute pathname omitting the...

Symantec Endpoint Protection Client < 14.3 RU1 MP1 DoS (SYMSA18255)

The version of Symantec Endpoint Protection SEP Client installed on the remote host is prior to 14.3 RU1 MP1. It is, therefore, affected by a denial of service vulnerability due to an unhandled exception in a common driver. Note that Nessus has not tested for this issue but has instead relied onl...

Microsoft Windows Installed Software Enumeration (credentialed check)

This plugin lists software potentially installed on the remote host by crawling the registry entries in : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall HKLM\SOFTWARE\Microsoft\Updates Note that these entries do not necessarily mean the applications are actually installed on the remote...

3Com 3CServer/3CDaemon FTP Server Multiple Vulnerabilities (OF, FS, PD, DoS)

The remote host is running the 3Com 3CServer or 3CDaemon FTP server. According to its banner, the version of the 3CServer / 3CDaemon FTP server on the remote host is reportedly affected by multiple buffer overflow and format string vulnerabilities as well as an information leak issue. An attacker...

Rocky Linux 9 : compat-openssl11 (RLSA-2022:4899)

The remote Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:4899 advisory. - The BNmodsqrt function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function i...

CentOS 7 : openssh (CESA-2018:0980)

An update for openssh is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

ICCP/COTP (ISO 8073) Protocol Detection

Binary data scadaiccpcotpdetect.nbin...

Apache Tomcat 8.0.0.RC1 < 8.0.30

The version of Tomcat installed on the remote host is prior to 8.0.30. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat8.0.30security-8 advisory. - The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before...

Apache Tomcat 8.0.0.RC1 < 8.0.53 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 8.0.53. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat8.0.53security-8 advisory. - The host name verification when using TLS with the WebSocket client was missing. It is now enabled by...

nginx 1.3.0 < 1.28.2 / 1.29.x < 1.29.5 SSL Upstream Injection

The installed version of nginx is 1.3.0 prior to 1.28.2, or 1.29.x prior to 1.29.5. It is, therefore, affected by the following issue: - A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security TLS servers. An attacker with a man-in-the-midd...

Security Updates for Microsoft SQL Server Elevation of Privilege (September 2024)

The Microsoft SQL Server installation on the remote host is missing a security update. It is affected by the following vulnerabilities: - An elevation of privilege vulnerability. An authenticated, remote attacker can exploit this issue, to gain elevated privileges. CVE-2024-37341, CVE-2024-37965,...

Apache Tomcat 9.0.0.M1 < 9.0.83

The version of Tomcat installed on the remote host is prior to 9.0.83. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat9.0.83security-9 advisory. - Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-...

Attachmate Reflection Secure IT Windows Client Information Disclosure (Heartbleed)

The Attachmate Reflection Secure IT Windows Client install on the remote host contains a component, Reflection FTP Client, which is affected by an out-of-bounds read error, known as the 'Heartbleed Bug' in the included OpenSSL version. This error is related to handling TLS heartbeat extensions th...

AIX 7.1 TL 5 : bind (IJ25924)

https://vulners.com/cve/CVE-2020-8616 https://vulners.com/cve/CVE-2020-8616 ISC BIND is vulnerable to a denial of service, caused by the failure to limit the number of fetches performed when processing referrals. By using specially crafted referrals, a remote attacker could exploit this...

Default Password (123456) for 'nexthink' Account

The account 'nexthink' on the remote host has the password '123456'. An attacker can leverage this issue to gain administrative access to the affected system. Note that Nexthink is known to use these credentials to provide administrative access to the host. %NASLMINLEVEL 70300 C Tenable Network...

Apache 2.2.x < 2.2.28 Multiple Vulnerabilities

According to its banner, the version of Apache 2.2.x running on the remote host is prior to 2.2.28. It is, therefore, affected by the following vulnerabilities : - A flaw exists within the 'modheaders' module which allows a remote attacker to inject arbitrary headers. This is done by placing a...

Microsoft Malicious Software Removal Tool Installed

The Microsoft Malicious Software Removal Tool is installed on the remote host. This tool is an application that attempts to detect and remove known malware from Windows systems. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid66424; scriptversion"1.60";...

Microsoft Edge (Chromium) < 120.0.2336.0 Multiple Vulnerabilities

The version of Microsoft Edge installed on the remote Windows host is prior to 120.0.2336.0. It is, therefore, affected by multiple vulnerabilities as referenced in the January 11, 2024 advisory. - Insufficient data validation in Extensions in Google Chrome prior to 120.0.6099.216 allowed an...

Security Updates for Outlook (March 2023)

The Microsoft Outlook application installed on the remote host is missing a security update. It is, therefore, affected by an elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description...

Cisco IOS Software DHCP Remote Code Execution Vulnerability

According to its self-reported version, the IOS is affected by one or more vulnerabilities. Please see the included Cisco BIDs and the Cisco Security Advisory for more information. TRUSTED...

RHEL 6 / 7 : libxml2 (RHSA-2016:1292)

An update for libxml2 is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availabl...

Adobe Flash Player Unsupported Version Detection

There is at least one unsupported version of Adobe Flash Player installed on the remote host. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilities. C Tenable, Inc...

SSL Certificate Information

This plugin connects to every SSL-related port and attempts to extract and dump the X.509 certificate. TRUSTED...

/doc Directory Browsable (deprecated)

The /doc directory is browsable. /doc shows the contents of the /usr/doc directory, which reveals not only which programs are installed but also their versions. This plugin has been deprecated. Webmirror3 plugin ID 10662 will identify a browsable directory. %NASLMINLEVEL 999999 Copyright 2000 by...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2022-033)

The version of kernel installed on the remote host is prior to 5.4.204-113.362. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2022-033 advisory. Linux disk/nic frontends data leaks This CNA information record relates to multiple CVEs; the text explain...

Hydra: SNMP

This plugin runs Hydra to find SNMP passwords by brute force. To use this plugin, enter the 'Logins file' and the 'Passwords file' under the 'Hydra NASL wrappers options' advanced settings block. TRUSTED...

Oracle Java SE 1.7.x < 1.7.0_211 / 1.8.x < 1.8.0_201 / 1.11.x < 1.11.0_2 Multiple Vulnerabilities (January 2019 CPU)

The version of Oracle formerly Sun Java SE or Java for Business installed on the remote host is prior to 7 Update 211, 8 Update 201, 11 Update 2. It is, therefore, affected by multiple vulnerabilities related to the following components : - An issue in libjpeg 9a, a divide-by-zero error, could...

OpenSSL 1.0.2 < 1.0.2n Multiple Vulnerabilities

The version of OpenSSL installed on the remote host is prior to 1.0.2n. It is, therefore, affected by multiple vulnerabilities as referenced in the 1.0.2n advisory. - There is an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli. No EC...