347056 matches found
ESXi 5.0 / 5.1 / 5.5 / 6.0 Multiple Vulnerabilities (VMSA-2016-0010) (remote check)
The remote VMware ESXi host is version 5.0, 5.1, 5.5, or 6.0 and is missing a security patch. It is, therefore, affected by multiple vulnerabilities : - An arbitrary code execution vulnerability exists in the Shared Folders HGFS feature due to improper loading of Dynamic-link library DLL files fr...
McAfee Application Control swin.sys Memory Corruption (SB10145)
The version of McAfee Application Control is 6.1.0 prior to build 706, 6.1.1 prior to build 404, 6.1.2 prior to build 449, 6.1.3 prior to build 441, or 6.2.0 prior to build 505. It is, therefore, affected by a kernel memory corruption issue in the swin.sys driver when handling a 786 syscall, whic...
Qmail Remote Command Execution via Shellshock
The remote host appears to be running Qmail. A remote attacker can exploit Qmail to execute commands via a specially crafted MAIL FROM header if the remote host has a vulnerable version of Bash. This is due to the fact that Qmail does not properly sanitize input before setting environmental...
EMC Legato Networker Multiple Vulnerabilities
The remote host is running one of the following products : - Legato Networker - Sun StorEdge Enterprise Backup Software - Sun Solstice Backup Software - Informix Storage Manager The installed version of this software is vulnerable to denial of service, unauthorized access and remote command...
Oracle WebLogic Server (April 2026 CPU)
The 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 versions of WebLogic Server installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2026 CPU advisory. - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Web...
Security Updates for Microsoft SQL Server ODBC Driver (April 2024)
The Microsoft SQL Server driver installation on the remote host is missing a security update. It is, therefore, affected by the following vulnerability: - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands...
Node.js Module vm2 < 3.9.16 Sandbox Breakout
There exists a vulnerability in source code transformer exception sanitization logic of vm2 for versions up to 3.9.15, allowing attackers to bypass handleException and leak unsanitized host exceptions which can be used to escape the sandbox and run arbitrary code in host context. A threat actor c...
WordPress 4.9.x < 4.9.23 Multiple Vulnerabilities
According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A directory traversal via wplang. CVE-2023-2745 - A Cross-Site Request Forgery CSRF via wpajaxsetattachmentthumbnail. - An authenticated stored Cross-Site Scripting XSS vi...
AlmaLinux 8 : gcc-toolset-11-gcc (ALSA-2021:4586)
The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2021:4586 advisory. - An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It permits the visual reordering of characters via control...
openSUSE Security Update : MozillaFirefox (openSUSE-2021-621)
This update for MozillaFirefox fixes the following issues : - Firefox was updated to 78.10.0 ESR bsc1184960 - CVE-2021-23994: Out of bound write due to lazy initialization - CVE-2021-23995: Use-after-free in Responsive Design Mode - CVE-2021-23998: Secure Lock icon could have been spoofed -...
EulerOS 2.0 SP3 : bind (EulerOS-SA-2019-2557)
According to the versions of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - 'managed-keys' is a feature which allows a BIND resolver to automatically maintain the keys used by trust anchors which operators configure for us...
KB4512497: Windows 10 August 2019 Security Update
The remote Windows host is missing security update 4512497. It is, therefore, affected by multiple vulnerabilities : - An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call ALPC. An attacker who successfully exploited this...
Mozilla Firefox < 67.0
The version of Firefox installed on the remote Windows host is prior to 67.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-13 advisory. - A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use. This results ...
SSH Commands Ran With Privilege Escalation
The remote host required a privilege escalation in order to run one or more SSH commands, or a privilege escalation was forced by a plugin for one or more SSH commands. Note that this plugin only reports if 'Attempt least privilege' is enabled in the scan policy. TRUSTED...
OpenSSH < 7.5
According to its banner, the version of OpenSSH running on the remote host is prior to 7.5. It is, therefore, affected by an information disclosure vulnerability : - An unspecified timing flaw exists in the CBC padding oracle countermeasures, within the ssh and sshd functions, that allows an...
SUSE SLES12 Security Update : java-1_8_0-ibm (SUSE-SU-2016:3078-1)
This update for java-180-ibm fixes the following issues : - CVE-2016-5568: Unspecified vulnerability allowed remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT - CVE-2016-5556: Unspecified vulnerability allowed remote attackers to affect...
Scientific Linux Security Update : java-1.8.0-openjdk on SL6.x i386/x86_64 (20160120) (SLOTH)
An out-of-bounds write flaw was found in the JPEG image format decoder in the AWT component in OpenJDK. A specially crafted JPEG image could cause a Java application to crash or, possibly execute arbitrary code. An untrusted Java application or applet could use this flaw to bypass Java sandbox...
Oracle Solaris Third-Party Patch Update : libxslt (multiple_vulnerabilities_in_libxslt)
The remote Solaris system is missing necessary patches to address security updates : - The xsltGenerateIdFunction function in functions.c in libxslt 1.1.26 and earlier, as used in Google Chrome before 10.0.648.127 and other products, allows remote attackers to obtain potentially sensitive...
SSL Certificate Chain Contains Weak RSA Keys
At least one of the X.509 certificates sent by the remote host has a key that is shorter than 1024 bits. Such keys are considered weak due to advances in available computing power decreasing the time required to factor cryptographic keys. Some SSL implementations, notably Microsoft's, may conside...
OpenSSL 1.0.2 < 1.0.2zd Vulnerability
The version of OpenSSL installed on the remote host is prior to 1.0.2zd. It is, therefore, affected by a vulnerability as referenced in the 1.0.2zd advisory. - The BNmodsqrt function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli...
CentOS 7 : kernel (RHSA-2022:0063)
The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0063 advisory. - A flaw memory leak in the Linux kernel performance monitoring subsystem was found in the way if using PERFEVENTIOCSETFILTER. A local user could use...
F5 Networks BIG-IP : Linux kernel vulnerability (K51674118)
The version of F5 Networks BIG-IP installed on the remote host is prior to 13.1.4.1 / 14.1.4.3 / 15.1.4 / 16.0.1.2 / 16.1.0. It is, therefore, affected by a vulnerability as referenced in the K51674118 advisory. The coredump implementation in the Linux kernel before 5.0.10 does not use locking or...
Fedora 31 : python38 (2020-6a88dad4a0)
Python 3.8.3 This is the third maintenance release of Python 3.8. See the changelog for details. Contains the security fix for CVE-2020-8492. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to...
RHEL 6 : kernel-rt (RHSA-2020:1353)
The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1353 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirement...
CentOS 7 : tomcat (RHSA-2020:0855)
The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:0855 advisory. - When using the Apache JServ Protocol AJP, care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having high...
CentOS 6 : java-1.8.0-openjdk (CESA-2019:3136)
An update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
GLSA-201904-25 : QEMU: Multiple vulnerabilities
The remote host is affected by the vulnerability described in GLSA-201904-25 QEMU: Multiple vulnerabilities Multiple vulnerabilities have been discovered in QEMU. Please review the CVE identifiers referenced below for details. Impact : Please review the referenced CVE identifiers for details...
Oracle Java SE Multiple Vulnerabilities (June 2013 CPU) (Unix)
The version of Oracle formerly Sun Java SE or Java for Business installed on the remote host is earlier than or equal to 7 Update 21, 6 Update 45 or 5 Update 45. It is, therefore, potentially affected by security issues in the following components : - 2D - AWT - CORBA - Deployment - Hotspot -...
Link-Local Multicast Name Resolution (LLMNR) Detection
The remote device answered to a Link-local Multicast Name Resolution LLMNR request. This protocol provides a name lookup service similar to NetBIOS or DNS. It is enabled by default on modern Windows versions. TRUSTED...
osTicket Detection
osTicket was detected on the remote host. TRUSTED...
Microsoft Windows SMB Registry : Winreg Registry Key Detection
The registry key HKLM\SYSTEM\CurrentControlSet\Control\SecurePipeServers\Winreg is missing. This key allows you to define what can be viewed in the registry by non administrators. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid10431; scriptversion"$Revision: 1.31 $";...
Dell Wyse Management Suite < 3.6.1 Multiple Vulnerabilities (DSA-2022-098)
The version of Dell Wyse Management Suite installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the DSA-2022-098 advisory. - The BNmodsqrt function, which computes a modular square root, contains a bug that can cause it to...
Ubuntu 18.04 LTS / 20.04 LTS : Linux kernel vulnerabilities (USN-5442-1)
The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5442-1 advisory. Kyle Zeng discovered that the Network Queuing and Scheduling subsystem of the Linux kernel did not properly perform reference counting in som...
PHP 7.3.x < 7.3.33 Local File Inclusion
According to its self-reported version number, the version of PHP running on the remote web server is 7.3.x prior to 7.3.33, 7.4.x prior to 7.4.26 or 8.0.x prior to 8.0.13. It is, therefore, affected by a local file inclusion vulnerability due to NULL byte special character breaking the path in x...
Apache 2.4.49 < 2.4.50 Multiple Vulnerabilities
The version of Apache httpd installed on the remote host is 2.4.49. It is, therefore, affected by multiple vulnerabilities as referenced in the 2.4.50 advisory. - While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external...
Amazon Linux AMI : git (ALAS-2020-1413)
The version of git installed on the remote host is prior to 2.18.4-2.71. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1413 advisory. Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host...
Oracle Java SE 1.7.0_251 / 1.8.0_241 / 1.11.0_6 / 1.13.0_2 Multiple Vulnerabilities (Jan 2020 CPU) (Unix)
The version of Oracle formerly Sun Java SE or Java for Business installed on the remote host is prior to 7 Update 251, 8 Update 241, 11 Update 6, or 13 Update 2. It is, therefore, affected by multiple vulnerabilities: - Oracle Java SE and Java SE Embedded are prone to a severe division by zero,...
MariaDB 10.4.0 < 10.4.9 Multiple Vulnerabilities
The version of MariaDB installed on the remote host is prior to 10.4.9. It is, therefore, affected by multiple vulnerabilities as referenced in the 10.4.9 advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Parser. Supported versions that are affected are 5.7....
LibreOffice < 6.2.7 / 6.3.x < 6.3.1 Multiple Vulnerabilities (Windows)
The version of LibreOffice installed on the remote Windows host is prior to 6.2.7 or 6.3.x prior to 6.3.1. It is, therefore, affected by the following vulnerabilities: - A directory traversal vulnerability resulting from a feature in LibreOffice which allows documents to specify pre-installed...
SUSE SLED15 / SLES15 Security Update : go1.12 (SUSE-SU-2019:2214-1) (Ping Flood) (Reset Flood)
This update for go1.12 fixes the following issues : Security issues fixed : CVE-2019-9512: Fixed HTTP/2 flood using PING frames that results in unbounded memory growth bsc1146111. CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of...
Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2018-4062)
The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-4062 advisory. - fork: fix incorrect fput of -exefile causing use-after-free Eric Biggers Orabug: 27290198 CVE-2017-17052 - KVM: x86: fix singlestepping over...
RHEL 6 : kernel (RHSA-2018:0022)
The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:0022 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: An industry-wide issue was found in th...
Oracle Database Multiple Vulnerabilities (October 2017 CPU)
The remote Oracle Database Server is missing the October 2017 Critical Patch Update CPU. It is, therefore, affected by multiple vulnerabilities as noted in the October 2017 Critical Patch Update advisory. Please consult the CVRF details for the applicable CVEs for additional information. Note tha...
CentOS 6 / 7 : samba (CESA-2017:1270) (SambaCry)
An update for samba is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...
RHEL 7 : httpd (RHSA-2017:0906)
An update for httpd is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...
SUSE SLES12 Security Update : kernel (SUSE-SU-2016:3197-1)
This update for the Linux Kernel 3.12.60-5254 fixes several issues. The following security bugs were fixed : - CVE-2016-8655: A race condition in the afpacket packetsetring function could be used by local attackers to crash the kernel or gain privileges bsc1012759. - CVE-2016-9555: The sctpsfootb...
PHP 5.6.x < 5.6.28 Multiple Vulnerabilities
According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.28. It is, therefore, affected by multiple vulnerabilities : - A flaw exists in the parseurl function due to returning the incorrect host. An unauthenticated, remote attacker can exploit this to hav...
Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2016-3596)
The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-3596 advisory. - KEYS: potential uninitialized variable Dan Carpenter Orabug: 24402831 CVE-2016-4470 - vfs: add vfsselectinode helper Miklos Szeredi Orabug:...
MS KB3050995: Improperly Issued Digital Certificates Could Allow Spoofing (deprecated)
The remote host is missing KB3050995, KB2677070 automatic updater, or the latest disallowed certificate update using KB2813430 manual updater. If KB2677070 has been installed, it has not yet obtained the latest auto-updates. Note that this plugin checks that the updaters have actually updated the...
Scientific Linux Security Update : poppler on SL5.x i386/x86_64
Multiple integer overflow flaws were found in poppler. An attacker could create a malicious PDF file that would cause applications that use poppler such as Evince to crash or, potentially, execute arbitrary code when opened. CVE-2009-0147, CVE-2009-1179, CVE-2009-1187, CVE-2009-1188 Multiple buff...