Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2018-4195)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-4195 advisory. - ipv4: frags: handle possible skb truesize change Eric Dumazet Orabug: 28481663 CVE-2018-5391 - inet: frag: enforce memory limits earlier Eric Dumazet...

Virtuozzo 7 : readykernel-patch (VZA-2018-045)

According to the version of the vzkernel package and the readykernel-patch installed, the Virtuozzo installation on the remote host is affected by the following vulnerability : - By mmaping a FUSE-backed file onto a process's memory containing command line arguments or environment strings, an...

Security Updates for Microsoft Office Products (October 2017)

The Microsoft Office Products are missing security updates. It is, therefore, affected by multiple vulnerabilities : - Microsoft has released an update for Microsoft Office that provides enhanced security as a defense-in-depth measure. - A remote code execution vulnerability exists in Microsoft...

Mac OS X 10.10.x < 10.10.2 Multiple Vulnerabilities (POODLE)

The remote host is running a version of Mac OS X 10.10.x that is prior to version 10.10.2. This update contains several security-related fixes for the following components : - bash - Bluetooth - CFNetwork Cache - CommerceKit Framework - CoreGraphics - CoreSymbolication - CPU Software - FontParser...

VMware ESXi 7.0 / 8.0 Out-of-Bounds read (CVE-2024-37086)

The version of VMware ESXi installed on the remote host is prior to 7.0 Update 3q or 8.0 prior to 8.0 Update 3. It is, therefore, affected by an out-of-bounds read vulnerability as referenced in the VMSA-2024-0013 advisory: Note that Nessus has not tested for these issues but has instead relied...

KB5004945: Windows 10 2004 / 20H2 / 21H1 OOB Security Update RCE (July 2021)

A remote command execution vulnerability exists in Windows Print Spooler service improperly performs privileged file operations. An authenticated, remote attacker can exploit this to bypass and run arbitrary code with SYSTEM privileges. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

EulerOS 2.0 SP8 : kernel (EulerOS-SA-2021-1148)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In drivers/target/targetcorexcopy.c in the Linux kernel before 5.10.7, insufficient identifier checking in the LIO SCSI target code can be used ...

Ubuntu 16.04 LTS / 18.04 LTS : OpenJDK vulnerabilities (USN-3975-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3975-1 advisory. It was discovered that the BigDecimal implementation in OpenJDK performed excessive computation when given certain values. An attacker could...

Apache Tomcat 7.0.x < 7.0.60 Multiple Vulnerabilities (FREAK)

According to its self-reported version number, the Apache Tomcat service listening on the remote host is 7.0.x prior to 7.0.60. It is, therefore, affected by the following vulnerabilities : - A NULL pointer dereference flaw exists when the SSLv3 option isn't enabled and an SSLv3 ClientHello is...

MS KB2982792: Improperly Issued Digital Certificates Could Allow Spoofing

The remote host is missing KB2982792, KB2677070 automatic updater, or the latest disallowed certificate update using KB2813430 manual updater. If KB2677070 is installed, it is missing the latest auto-updates. Note that this plugin checks that the updaters have actually updated the disallowed CTL...

SSL Null Cipher Suites Supported

The remote host supports the use of SSL ciphers that offer no encryption at all. Note: This is considerably easier to exploit if the attacker is on the same physical network. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid66848; scriptversion"1.4";...

Apache Apereo CAS Log4Shell Direct Check (CVE-2021-44228)

Binary data apacheapereocaslog4shell.nbin...

Microsoft Windows Web Media Extensions Library RCE (May 2021)

The Windows 'Web Media Extensions' app installed on the remote host is affected by a remote code execution vulnerability. An attacker who successfully exploited the vulnerability could execute arbitrary code. Exploitation of the vulnerability requires that a program process a specially crafted...

CentOS 7 : php (RHSA-2020:1112)

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1112 advisory. - An issue was discovered in ext/phar/pharobject.c in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. There is...

SSL/TLS Services Support RC4 (PCI DSS)

At least one of the SSL or TLS services on the remote host supports the use of RC4 for encryption. RC4 does not meet the PCI definition of strong cryptography as defined by NIST Special Publication 800-57 Part 1. The RC4 cipher is flawed in its generation of a pseudo-random stream of bytes so tha...

Check Point Gaia Operating System < R77.20 Multiple NTP Client Vulnerabilities (sk103825)

The remote host is running a version of Gaia Operating System that is prior to R77.20 and thus, is potentially affected by multiple NTP client vulnerabilities. Note that NTP client is disabled by default. Further note that if the vendor's suggested mitigations are in place, this can be considered...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2017-3565)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-3565 advisory. - nfsd: stricter decoding of write-like NFSv2/v3 ops J. Bruce Fields Orabug: 25986971 CVE-2017-7895 Tenable has extracted the preceding description block...

Amazon Linux AMI : kernel (ALAS-2017-828)

Infinite recursion in ahash.c by triggering EBUSY on a full queue : A vulnerability was found in crypto/ahash.c in the Linux kernel which allows attackers to cause a denial of service API operation calling its own callback, and infinite recursion by triggering EBUSY on a full queue.CVE-2017-7618...

AIX Java Advisory : java_april2016_advisory.asc (April 2016 CPU)

The version of Java SDK installed on the remote AIX host is affected by multiple vulnerabilities in the following components : - 2D - Deployment - Hotspot - JCE - JMX - JVM - ORB - SDK - Serialization %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...

SuSE 11.1 Security Update : IBM Java (SAT Patch Number 4875)

IBM Java 1.6.0 SR9-FP2 fixes several of bugs and thew following security issues : - An unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 6 Update 25 and earlier, 5.0 Update 29 and earlier, and 1.4.231 and earlier allows remote untrusted Java Web Start...

XMB < 1.9.1 Multiple XSS

The remote host is running XMB Forum, a web forum written in PHP. The version of XMB installed on the remote host is affected by several cross-site scripting issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

Jenkins plugins Multiple Vulnerabilities (2022-06-22)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - Multiple cross-site scripting XSS vulnerabilities in Jenkins 2.355 and earlier, LTS 2.332.3 and earlier allow attackers to inject HTML and...

openSUSE Security Update : webkit2gtk3 (openSUSE-2021-637)

This update for webkit2gtk3 fixes the following issues : - Update to version 2.32.0 bsc1184155 : - Fix the authentication request port when URL omits the port. - Fix iframe scrolling when main frame is scrolled in async - scrolling mode. - Stop using gmemdup. - Show a warning message when...

CentOS 7 : sudo (RHSA-2021:0221)

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:0221 advisory. - Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via sudoedit -s an...

Ubuntu 16.04 LTS : Linux kernel (HWE) vulnerabilities (USN-3762-2)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3762-2 advisory. USN-3762-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04 LTS. This update provides the corresponding updates for the Linux Hardware Enableme...

KB4056899: Windows Server 2012 January 2018 Security Update

The remote Windows host is missing security update 4056899 or cumulative update 4056896. It is, therefore, affected by multiple vulnerabilities : - An elevation of privilege vulnerability exists in Windows Adobe Type Manager Font Driver ATMFD.dll when it fails to properly handle objects in memory...

RHEL 7 : kernel-rt (RHSA-2017:1616) (Stack Clash)

An update for kernel-rt is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

MiCasaVerde VeraLite UPnP RCE

The remote MiCasaVerde VeraLite Smart Home Controller is affected by a remote code execution vulnerability. An unauthenticated, remote attacker can exploit this, via the UPnP RunLua action, to execute arbitrary shell commands as root. Note that MiCasaVerde VeraLite is reportedly affected by...

F5 Networks BIG-IP : SSL/TLS RC4 vulnerability (K16864) (Bar Mitzvah)

The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic...

SuSE 11.3 Security Update : pure-ftpd (SAT Patch Number 10004)

pure-ftpd was updated to fix one security issue and two non-security bugs : - SSLv2 and SSLv3 have been disabled to avoid the attack named POODLE. CVE-2014-3566, bnc902229 - Added the disableascii option. bnc828469 - Fixed wait on TLS handshake. bnc856424 %NASLMINLEVEL 70300 C Tenable Network...

Oracle Linux 4 : bash (ELSA-2014-3078)

Description of changes: 3.0-27.0.2 - Preliminary fix for CVE-2014-7169 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Oracle Linux Security Advisory ELSA-2014-3078. include'deprecatednasllevel.inc';...

rsh NULL Login Remote Privilege Escalation

It is possible to execute arbitrary command on this host using rsh by supplying a NULL username. C Tenable Network Security, Inc. include"compat.inc"; include"dataprotection.inc"; ifdescription scriptid10096; scriptversion "1.17"; scriptcvsdate"Date: 2018/08/13 14:32:36";...

RHEL 7 : curl (CVE-2022-43552)

The remote Red Hat Enterprise Linux 7 host has a curl package installed that is affected by a vulnerability: - A use after free vulnerability exists in curl 7.87.0. Curl can be asked to tunnel virtually all protocols it supports through an HTTP proxy. HTTP proxies can and often do deny such tunne...

WordPress 6.1.x < 6.1.3 Shortcode Execution

According to its self-reported version number, the detected WordPress application is affected by a shortcode execution in user generated content. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No source data...

RHEL 8 : java-1.8.0-openjdk (RHSA-2022:5700)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5700 advisory. The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security...

KB5014001: Windows 8.1 and Windows Server 2012 R2 Security Update (May 2022)

The remote Windows host is missing security update 5014001. It is, therefore, affected by multiple vulnerabilities - Windows LDAP Remote Code Execution Vulnerability CVE-2022-22012, CVE-2022-22013, CVE-2022-22014, CVE-2022-29128, CVE-2022-29129, CVE-2022-29130, CVE-2022-29137, CVE-2022-29139,...

Security Updates for Microsoft Office Web Apps (January 2022)

The Microsoft Office Web Apps installation on the remote host is missing a security update. It is, therefore, affected by a remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary code. CVE-2022-21840 %NASLMINLEVEL 70300 C...

Ubuntu 18.04 LTS : Linux kernel vulnerabilities (USN-3762-1)

The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3762-1 advisory. It was discovered that the VirtIO subsystem in the Linux kernel did not properly initialize memory in some situations. A local attacker could use this to...

IBM WebSphere Application Server 8.0 < Fix Pack 10 Multiple Vulnerabilities (POODLE)

The remote host is running IBM WebSphere Application Server version 8.0 prior to Fix Pack 10. It is, therefore, affected by the following vulnerabilities : - Multiple errors exist related to the included IBM HTTP server that can allow remote code execution or denial of service. CVE-2013-5704,...

MS14-059: Vulnerability in ASP.NET MVC Could Allow Security Feature Bypass (2990942)

The version of ASP.NET MVC Model View Controller installed on the remote host is affected by an unspecified cross-site scripting vulnerability. A remote unauthenticated attacker could exploit this flaw to execute arbitrary script code in a user's browser subject to the privileges of the user...

Amazon Linux AMI : kernel (ALAS-2021-1503)

The version of kernel installed on the remote host is prior to 4.14.232-123.381. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1503 advisory. kernel: refcount leak in llcpsockbind CVE-2020-25670 kernel: refcount leak in llcpsockconnect CVE-2020-25671 kernel...

Security Updates for Exchange (February 2019)

The Microsoft Exchange Server installed on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities : - Multiple Vulnerabilites with the included libraries from Oracle Outside. CVE-2018-18223, CVE-2018-18224, CVE-2018-3147, CVE-2018-3217, CVE-2018-3218,...

VMSA-2014-0004 : VMware product updates address OpenSSL security vulnerabilities

a. Information Disclosure vulnerability in OpenSSL third-party library The OpenSSL library is updated to version openssl-1.0.1g to resolve multiple security issues. The Common Vulnerabilities and Exposures project cve.mitre.org has assigned the names CVE-2014-0076 and CVE-2014-0160 to these issue...

HP System Management Homepage < 6.1.0.102 / 6.1.0-103 Multiple Vulnerabilities

According to the web server banner, the version of HP System Management Homepage SMH running on the remote host is potentially affected by the following vulnerabilities : - Session renegotiations are not handled properly, which could be exploited to insert arbitrary plaintext by a...

Apache Log4j < 2.15.0 Remote Code Execution (Windows)

The version of Apache Log4j on the remote host is 2.x 2.15.0. It is, therefore, affected by a remote code execution vulnerability in the JNDI parser due to improper log validation. An unauthenticated, remote attacker can exploit this to bypass authentication and execute arbitrary commands. Log4j...

Drupal 7.x < 7.56 / 8.x < 8.3.4 Multiple Vulnerabilities (SA-CORE-2017-003)

According to its self-reported version, the instance of Drupal running on the remote web server is 7.x prior to 7.56 or 8.x prior to 8.3.4. It is, therefore, affected by multiple vulnerabilities : - A flaw exists in the PECL YAML parser due to unsafe handling of PHP objects during certain...

PHP 5.6.x < 5.6.13 Multiple Vulnerabilities

According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.13. It is, therefore, affected by multiple vulnerabilities : - A directory traversal vulnerability in the ZipArchive::extractTo function in ext/zip/phpzip.c could allow a remote attacker to create...

MS15-058: Vulnerabilities in SQL Server Could Allow Remote Code Execution (3065718)

The remote Microsoft SQL Server installation is affected by multiple vulnerabilities : - A privilege escalation vulnerability exists due to the casting of pointers to an incorrect class. An authenticated, remote attacker can exploit this, via a specially crafted SQL query, to gain elevated...

Ubuntu 8.04 LTS / 10.04 LTS / 11.04 / 11.10 : samba vulnerability (USN-1423-1)

Brian Gorenc discovered that Samba incorrectly calculated array bounds when handling remote procedure calls RPC over the network. A remote, unauthenticated attacker could exploit this to execute arbitrary code as the root user. CVE-2012-1182. Note that Tenable Network Security has extracted the...

MS10-046: Vulnerability in Windows Shell Could Allow Remote Code Execution (2286198) (EASYHOOKUP)

The remote windows host contains a version of the Windows Shell that contains a vulnerability in the way it handles shortcut icons. An attacker, exploiting this flaw, can execute arbitrary commands on the remote host subject to the privileges of the user opening the shortcut. EASYHOOKUP is one of...