Fortinet OpenSSL Information Disclosure (Heartbleed)

The firmware of the remote Fortinet host is running a version of OpenSSL that is affected by a remote information disclosure, commonly known as the 'Heartbleed' bug. A remote, unauthenticated, attacker could potentially exploit this vulnerability to extract up to 64 kilobytes of memory per reques...

Hydra: telnet

This plugin runs Hydra to find telnet passwords by brute force. To use this plugin, enter the 'Logins file' and the 'Passwords file' under the 'Hydra NASL wrappers options' advanced settings block. TRUSTED...

Intel Chipset Device Software < 10.1.19444.8378 Escalation of Privilege

The version of Intel Chipset Device Software installed on the remote Windows host is prior to 10.1.19444.8378. It is, therefore, affected by multiple vulnerabilities: - Due to an uncontrolled search path element, an authenticated, local attacker can elevate their privileges. CVE-2023-28388,...

KB4534309: Windows 8.1 and Windows Server 2012 R2 January 2020 Security Update

The remote Windows host is missing security update 4534309 or cumulative update 4534297. It is, therefore, affected by multiple vulnerabilities : - An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory. An attacker who successfully...

Microsoft Windows 7 / Server 2008 R2 Unsupported Version Detection

Microsoft Windows 7 or Server 2008 R2 is running on the remote host. Microsoft ended support for Windows 7 and Server 2008 R2 on 1/14/2020. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security...

CUPS 1.7.x < 1.7.5 'get_file' Function Symlink Handling Info Disclosure

According to its banner, the version of CUPS installed on the remote host is 1.7.x prior to 1.7.5. It is, therefore, potentially affected by an information disclosure vulnerability that was incompletely corrected by the fix for CVE-2014-3537. A flaw exists in the 'getfile' function within the fil...

PHP 5.3.x < 5.3.28 Multiple OpenSSL Vulnerabilities

According to its banner, the version of PHP installed on the remote host is 5.3.x prior to 5.3.28. It is, therefore, potentially affected by the following vulnerabilities : - A flaw exists in the PHP OpenSSL extension's hostname identity check when handling certificates that contain hostnames wit...

Microsoft Windows Server 2012 R2 Unsupported Version Detection

Microsoft Windows Server 2012 R2 is running on the remote host. Microsoft ended support for Windows Server 2012 R2 on October 10, 2023. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilitie...

PHP 8.2.x < 8.2.7

The version of PHP installed on the remote host is prior to 8.2.7. It is, therefore, affected by a vulnerability as referenced in the Version 8.2.7 advisory. - In PHP versions 8.0. before 8.0.29, 8.1. before 8.1.20, 8.2. before 8.2.7 when using SOAP HTTP Digest Authentication, random value...

OpenJDK 7 <= 7u301 / 8 <= 8u292 / 11.0.0 <= 11.0.11 / 13.0.0 <= 13.0.7 / 15.0.0 <= 15.0.3 / 16.0.0 <= 16.0.1 Multiple Vulnerabilities (2021-07-20)

The version of OpenJDK installed on the remote host is prior to 7 = 7u301 / 8 = 8u292 / 11.0.0 = 11.0.11 / 13.0.0 = 13.0.7 / 15.0.0 = 15.0.3 / 16.0.0 = 16.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the 2021-07-20 advisory. Note that Nessus has not tested for this...

Oracle WebLogic Server Multiple Vulnerabilities (Jan 2020 CPU)

The version of Oracle WebLogic Server installed on the remote host is affected by multiple vulnerabilities: - An unspecified vulnerability in the Third Party Tools Bouncy Castle Java Library component of Oracle WebLogic Server. An unauthenticated attacker with network access via HTTPS could explo...

KB4338824: Windows 8.1 and Windows Server 2012 R2 July 2018 Security Update

The remote Windows host is missing security update 4338824 or cumulative update 4338815. It is, therefore, affected by multiple vulnerabilities : - An elevation of privilege vulnerability exists in .NET Framework which could allow an attacker to elevate their privilege level. CVE-2018-8202 - A...

ONVIF Device Information

Nessus was able to extract some information about the ONVIF-enabled device by sending a GetDeviceInformation SOAP request to the device server. include"compat.inc"; if description scriptid103865; scriptversion"$Revision: 1.1 $"; scriptcvsdate"$Date: 2017/10/17 15:56:40 $"; scriptnameenglish:"ONVI...

Oracle RDBMS Patchset Out of Date (credentialed check)

The version of Oracle Database server installed on the remote host is an unsupported patchset level. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid72982; scriptversion"1.6";...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2017-3595)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-3595 advisory. - ALSA: timer: Fix missing queue indices reset at SNDRVTIMERIOCTLSELECT Takashi Iwai Orabug: 26403952 CVE-2017-1000380 - ALSA: timer: Fix race...

F5 Networks BIG-IP : Apache Range header vulnerability (K13114)

The byte-range filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial-of-service memory and CPU consumption using a Range header that expresses multiple overlapping ranges. When this vulnerability is exploited, the httpd...

Oracle Enterprise Manager Cloud Control (Jan 2022 CPU)

The 13.4.0.0 and 13.5.0.0 versions of Enterprise Manager Base Platform installed on the remote host are affected by a vulnerability as referenced in the January 2022 CPU advisory. - Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Policy...

RHEL 7 : GNOME (RHSA-2018:3140)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3140 advisory. GNOME is the default desktop environment of Red Hat Enterprise Linux. Security Fixes: libsoup: Crash in soupcookiejar.c:getcookies on empty...

RHEL 6 : kernel (RHSA-2018:0169)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:0169 advisory. - kernel: Integer overflow in ip6find1stfragopt causes infinite loop CVE-2017-7542 - kernel: net: IPv6 fragmentation implementation of nexth...

Mozilla Firefox < 49.0 Multiple Vulnerabilities (Mac OS X)

The version of Mozilla Firefox installed on the remote Mac OS X host is prior to 49.0. It is, therefore, affected by multiple vulnerabilities : - An out-of-bounds read error exists within file dom/security/nsCSPParser.cpp when handling content security policies CSP containing empty referrer...

Juniper Junos Unsupported Version Detection

According to its self-reported version number, the installation of the Juniper Junos operating system running on the remote host is no longer supported. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain securi...

KB5094128: Windows Server 2022 / Azure Stack HCI 22H2 Security Update (June 2026)

The remote Windows host is missing security update 5094128. It is, therefore, affected by multiple vulnerabilities - Integer overflow or wraparound in Windows HTTP.sys allows an unauthorized attacker to execute code over a network. CVE-2026-47291 - Heap-based buffer overflow in Remote Desktop...

WordPress 6.0.x < 6.0.9 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A Cross-Site Scripting XSS vulnerability affecting the HTML API. - A Cross-Site Scripting XSS vulnerability affecting the Template Part block. - A path traversal issue...

Apache Tomcat 9.0.40 < 9.0.69

The version of Tomcat installed on the remote host is prior to 9.0.69. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat9.0.69security-9 advisory. - The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the...

RHEL 6 / 7 : Red Hat JBoss Core Services Apache HTTP Server 2.4.29 (RHSA-2019:0367)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:0367 advisory. Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This software, such as Apache HTTP...

OS Identification : SNMP

Nessus was able to identify the operating system type and version by examining the SNMP data returned by the remote server. C Tenable, Inc. Nessus was able to identify the operating system type and version by examining the SNMP data returned by the remote server. include"compat.inc"; if descripti...

Apache Tomcat 9.0.0.M1 < 9.0.86 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 9.0.86. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat9.0.86security-9 advisory. - Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket...

NewStart CGSL CORE 5.04 / MAIN 5.04 : openssl Vulnerability (NS-SA-2021-0020)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has openssl packages installed that are affected by a vulnerability: - The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a...

openSUSE Security Update : the Linux Kernel (openSUSE-2021-75)

The openSUSE Leap 15.1 kernel was updated to receive various security and bugfixes. The following security bugs were fixed : - CVE-2020-29568: An issue was discovered in Xen through 4.14.x. Some OSes such as Linux, FreeBSD, and NetBSD are processing watch events using a single thread. If the even...

Debian DSA-3560-1 : php5 - security update

Several vulnerabilities were found in PHP, a general-purpose scripting language commonly used for web application development. The vulnerabilities are addressed by upgrading PHP to the new upstream version 5.6.20, which includes additional bug fixes. Please refer to the upstream changelog for mor...

CentOS 7 : openssh (CESA-2016:0043)

Updated openssh packages that fix two security issues are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are available for...

MS15-041: Vulnerability in .NET Framework Could Allow Information Disclosure (3048010)

The remote Windows host has a version of the Microsoft .NET Framework installed that is affected by an information disclosure vulnerability due to improper handling of requests on web servers that have custom error messages disabled. A remote, unauthenticated attacker can exploit this issue, via ...

Oracle WebLogic Server (Apr 2022 CPU)

The version of Oracle WebLogic Server installed on the remote host is missing a security patch from the April 2020 Critical Patch Update CPU. It is, therefore, affected by multiple vulnerabilities: - A temp directory creation vulnerability in the bundled Guava component that allows a low privileg...

Apache Tomcat 8.5.38 < 8.5.79

The version of Tomcat installed on the remote host is prior to 8.5.79. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat8.5.79security-8 advisory. - The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 t...

Red Hat curl local file overwrite (CVE-2020-8177) (deprecated)

This plugin has been deprecated by the RedHat distribution specific plugins 142705 and 142414. C Tenable Network Security, Inc. @DEPRECATED@ Disabled on 2020/11/16. Deprecated by redhat-RHSA-2020-4599.nasl and redhat-RHSA-2020-5002.nasl. include'compat.inc'; if description scriptid138374;...

MariaDB 10.4.0 < 10.4.13 Multiple Vulnerabilities

The version of MariaDB installed on the remote host is prior to 10.4.13. It is, therefore, affected by multiple vulnerabilities as referenced in the 10.4.13 advisory. - libmariadb/mariadblib.c in MariaDB Connector/C before 3.1.8 does not properly validate the content of an OK packet received from...

Debian DLA-63-1 : bash security update

Tavis Ormandy discovered that the patch applied to fix CVE-2014-6271 released in DSA-3032-1 for bash, the GNU Bourne-Again Shell, was incomplete and could still allow some characters to be injected into another environment CVE-2014-7169. With this update prefix and suffix for environment variable...

Oracle Solaris Critical Patch Update : oct2020_SRU11_4_24_75_2

This Solaris system is missing necessary patches to address critical security updates : - Vulnerability in the Oracle Solaris product of Oracle Systems component: Filesystem. The supported version that is affected is 11. Easily exploitable vulnerability allows low privileged attacker with logon t...

RancherOS < 1.1.3 Information Disclosure

The remote host is running a version of RancherOS that is prior to v1.1.3, hence is vulnerable to local privilege-escalation vulnerability. An attacker can exploit this issue to cause a denial-of-service condition. Systems with microprocessors utilizing speculative execution and indirect branch...

Microsoft Office ActiveX Controls Enabled Without Restrictions Or Prompting

A Microsoft Office application installed on the remote host has ActiveX controls enabled without restrictions and without prompting. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the Microsoft Security Updates API. The text itself is...

CentOS 7 : kernel (CESA-2017:2930)

An update for kernel is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

HP Operations Manager / Operations Agent < 11.13 XSS (HPSBMU03126)

According to its self-reported version, the version of the HP Operations Agent service running on the remote host is affected by a cross-site scripting vulnerability. Operations Agent is often an included component of Operations Manager. C Tenable Network Security, Inc. include"compat.inc"; if...

Linanto Control Web Panel (CWP) 7 < 0.9.8.1147 Command Injection (CVE-2022-44877)

The version of Linanto Control Web Panel CWP 7, a web based control panel application, installed on the remote host is prior to 0.9.8.1147. It is, therefore, affected by a command injection vulnerability in the login parameter of the login/index.php page. Note that Nessus has not tested for this...

Oracle Enterprise Manager Cloud Control (Apr 2022 CPU)

The 13.4.0.0 and 13.5.0.0 versions of Enterprise Manager Base Platform installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2022 CPU advisory. - Vulnerability in the Oracle Management Service component Apache Log4j of the Enterprise Manager Base Platfor...

MySQL 5.7.x < 5.7.36 Multiple Vulnerabilities (Oct 2021 CPU)

The version of MySQL running on the remote host is 5.7.x prior to 5.7.36. It is, therefore, affected by multiple vulnerabilities, including the following, as noted in the October 2021 Critical Patch Update advisory: - A vulnerability in the OpenSSL component that can result in a takeover of the...

MS16-136: Security Update for SQL Server (3199641) (uncredentialed check)

The remote Microsoft SQL Server is missing a security update. It is, therefore, affected by multiple vulnerabilities : - Multiple elevation of privilege vulnerabilities exist in the SQL RDBMS Engine due to improper handling of pointer casting. An authenticated, remote attacker can exploit these t...

Amazon Linux AMI : kernel (ALAS-2018-1058) (Foreshadow)

Fixes for L1Terminal Fault security issues : L1 Terminal Fault-OS/ SMM : Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access via a terminal page...

Zyxel D1000 CWMP Get Default Password

Nessus was able to acquire the password from the Zyxel D1000 device by using CWMP commands over the TR-064 protocol. This protocol is typically open on port 7547. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid96448; scriptversion"1.5";...

.svn/entries Disclosed via Web Server

The web server on the remote host allows read access to '.svn/entries' files. This exposes all file names in your svn module on your website. This flaw can also be used to download the source code of the scripts PHP, JSP, etc... hosted on the remote server. %NASLMINLEVEL 70300 Changes by Tenable ...

PHP < 5.2.4 Multiple Vulnerabilities

According to its banner, the version of PHP installed on the remote host is older than 5.2.4. Such versions may be affected by various issues, including but not limited to several overflows. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'...