377311 matches found
MySQL 8.0.x < 8.0.18 Multiple Vulnerabilities (Oct 2019 CPU)
The version of MySQL running on the remote host is 8.0.x prior to 8.0.18. It is, therefore, affected by multiple vulnerabilities, including three of the top vulnerabilities below, as noted in the October 2019 Critical Patch Update advisory: - Vulnerability in the MySQL Server product of Oracle...
Photon OS 2.0 : unzip (PhotonOS-PHSA-2018-2.0-0052) (deprecated)
An update of 'unzip' packages of Photon OS has been released. C Tenable Network Security, Inc. @DEPRECATED@ Disabled on 2/7/2019 The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2018-2.0-0052. The text itself is copyright C VMware, Inc...
MS14-010: Cumulative Security Update for Internet Explorer (2909921)
The remote host is missing Internet Explorer IE Security Update 2909921. The installed version of IE is affected by multiple privilege escalation and memory corruption vulnerabilities that could allow an attacker to execute arbitrary code on the remote host. Additionally, the installed version of...
MS KB2286198: Windows Shell Shortcut Icon Parsing Arbitrary Code Execution (EASYHOOKUP)
Windows Shell does not properly validate the parameters of a shortcut file when loading its icon. Attempting to parse the icon of a specially crafted shortcut file can result in arbitrary code execution. A remote attacker could exploit this by tricking a user into viewing a malicious shortcut fil...
KB5025228: Windows 10 Version 1607 and Windows Server 2016 Security Update (April 2023)
The remote Windows host is missing security update 5025228. It is, therefore, affected by multiple vulnerabilities - Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability CVE-2023-28275 - Windows Pragmatic General Multicast PGM Remote Code Execution Vulnerability...
SUSE SLES15 Security Update : kernel (SUSE-SU-2022:2103-1)
The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2103-1 advisory. - The acpinsevaluate function in drivers/acpi/acpica/nseval.c in the Linux kernel through 4.12.9 does not flush the operand cache a...
OpenSSL 1.0.2 < 1.0.2zd Vulnerability
The version of OpenSSL installed on the remote host is prior to 1.0.2zd. It is, therefore, affected by a vulnerability as referenced in the 1.0.2zd advisory. - The BNmodsqrt function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli...
MariaDB 10.5.0 < 10.5.15 Multiple Vulnerabilities
The version of MariaDB installed on the remote host is prior to 10.5.15. It is, therefore, affected by multiple vulnerabilities as referenced in the 10.5.15 advisory. - MariaDB through 10.5.9 allows an application crash via certain long SELECT DISTINCT statements that improperly interact with...
CentOS 7 : kernel (RHSA-2022:0063)
The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0063 advisory. - A flaw memory leak in the Linux kernel performance monitoring subsystem was found in the way if using PERFEVENTIOCSETFILTER. A local user could use...
Ubuntu 20.04 LTS : Linux kernel (OEM) vulnerabilities (USN-5115-1)
The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5115-1 advisory. It was discovered that a race condition existed in the Atheros Ath9k WiFi driver in the Linux kernel. An attacker could possibly use this to expose...
Apache Tomcat 8.5.0 < 8.5.49 multiple vulnerabilities
The version of Tomcat installed on the remote host is prior to 8.5.49. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat8.5.49security-8 advisory. - When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote...
Photon OS 2.0: Linux PHSA-2018-2.0-0010
An update of the linux package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2018-2.0-0010. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid121906...
SUSE SLES12 Security Update : kernel (SUSE-SU-2019:0095-1)
The SUSE Linux Enterprise 12 SP3 Azure kernel was updated to 4.4.162 to receive various security and bugfixes. The following security bugs were fixed : CVE-2018-18281: The mremap syscall performs TLB flushes after dropping pagetable locks. If a syscall such as ftruncate removes entries from the...
Jenkins < 2.138.4 LTS / 2.150.1 LTS / 2.154 Multiple Vulnerabilities
The version of Jenkins running on the remote web server is prior to 2.154 or is a version of Jenkins LTS prior to 2.138.4 or 2.150.1. It is, therefore, affected by multiple vulnerabilities: - A command execution vulnerability exists in the Stapler web framework used in Jenkins due to certain...
RHEL 6 / 7 : samba and samba4 (RHSA-2016:0612) (Badlock)
An update for samba4 and samba is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7, respectively. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severi...
openSUSE Security Update : tor (openSUSE-SU-2014:0719-1) (Heartbleed)
tor 0.2.4.22 bnc878486 Tor was updated to the recommended version of the 0.2.4.x series. - major features in 0.2.4.x : - improved client resilience - support better link encryption with forward secrecy - new NTor circuit handshake - change relay queue for circuit create requests from size-based...
Ubuntu 6.06 LTS / 8.04 LTS / 9.04 / 9.10 / 10.04 LTS / 10.10 : linux, linux-ec2, linux-source-2.6.15 vulnerabilities (USN-1000-1)
Dan Rosenberg discovered that the RDS network protocol did not correctly check certain parameters. A local attacker could exploit this gain root privileges. CVE-2010-3904 Al Viro discovered a race condition in the TTY driver. A local attacker could exploit this to crash the system, leading to a...
Web Server Malicious JavaScript Link Detection
The remote web server seems to link to malicious JavaScript files hosted on a third-party website. This typically means that the remote web server has been compromised, and it may infect its visitors as well. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...
Netref cat_for_gen.php Arbitrary PHP Command Injection
The remote host is running the Netref directory script, written in PHP. There is a vulnerability in the installed version of Netref that enables a remote attacker to pass arbitrary PHP script code through the 'ad', 'addirect', and 'mforracine' parameters of the 'catforgen.php' script. This code...
H2 Database JNDI Lookup RCE (CVE-2021-42392)
Binary data h2databasecve-2021-42392.nbin...
Amazon Linux AMI : tomcat8 (ALAS-2020-1353)
The version of tomcat8 installed on the remote host is prior to 8.5.51-1.83. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1353 advisory. In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach ...
Fedora 30 : xen (2019-cbb732f760)
add missing XSA-299 patches x86: Machine Check Error on Page Size Change DoS XSA-304, CVE-2018-12207 TSX Asynchronous Abort speculative side channel XSA-305, CVE-2019-11135 ---- VCPUOPinitialise DoS XSA-296, CVE-2019-18420 missing descriptor table limit checking in x86 PV emulation XSA-298,...
Security Updates for Internet Explorer (June 2018)
The Internet Explorer installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory. The vulnerability could corrupt memory in such a...
Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2018-4004)
The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-4004 advisory. - kABI: Revert kABI: Make the bootcpudata look normal Konrad Rzeszutek Wilk CVE-2017-5715 - userns: prevent speculative execution Elena Reshetova...
RHEL 7 : Red Hat JBoss Web Server 2.1.1 security update on RHEL 7 (Important) (RHSA-2016:1648)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:1648 advisory. Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the...
SSL Certificate Chain Contains Weak RSA Keys
At least one of the X.509 certificates sent by the remote host has a key that is shorter than 1024 bits. Such keys are considered weak due to advances in available computing power decreasing the time required to factor cryptographic keys. Some SSL implementations, notably Microsoft's, may conside...
Link-Local Multicast Name Resolution (LLMNR) Detection
The remote device answered to a Link-local Multicast Name Resolution LLMNR request. This protocol provides a name lookup service similar to NetBIOS or DNS. It is enabled by default on modern Windows versions. TRUSTED...
Oracle MySQL Server 8.x < 8.4.4 (January 2025 CPU)
The versions of MySQL Server installed on the remote host are affected by a vulnerability as referenced in the January 2024 CPU advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Parser. Supported versions that are affected are 8.0.40 and prior, 8.4.3 and pri...
RHEL 7 : kernel (RHSA-2022:5937)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5937 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: Incomplete cleanup of multi-core share...
CentOS 8 : mariadb-connector-c (CESA-2020:5503)
The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:5503 advisory. - mariadb-connector-c: Improper validation of content in a OK packet received from server CVE-2020-13249 - mysql: C API unspecified vulnerability CPU J...
CentOS 7 : python (RHSA-2020:3911)
The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:3911 advisory. - The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the servertitle field. This occurs in...
RHEL 8 : httpd:2.4 (RHSA-2019:2893)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:2893 advisory. The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: HTTP/2: request for large respon...
Virtuozzo 7 : readykernel-patch (VZA-2018-046)
According to the version of the vzkernel package and the readykernel-patch installed, the Virtuozzo installation on the remote host is affected by the following vulnerability : - By mmaping a FUSE-backed file onto a process's memory containing command line arguments or environment strings, an...
EulerOS 2.0 SP2 : kernel (EulerOS-SA-2017-1342)
According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The towerprobe function in drivers/usb/misc/legousbtower.c in the Linux kernel before 4.8.1 allows local users who are physically proximate for...
Oracle Database Multiple Vulnerabilities (October 2017 CPU)
The remote Oracle Database Server is missing the October 2017 Critical Patch Update CPU. It is, therefore, affected by multiple vulnerabilities as noted in the October 2017 Critical Patch Update advisory. Please consult the CVRF details for the applicable CVEs for additional information. Note tha...
McAfee Application Control swin.sys Memory Corruption (SB10145)
The version of McAfee Application Control is 6.1.0 prior to build 706, 6.1.1 prior to build 404, 6.1.2 prior to build 449, 6.1.3 prior to build 441, or 6.2.0 prior to build 505. It is, therefore, affected by a kernel memory corruption issue in the swin.sys driver when handling a 786 syscall, whic...
MS15-128: Security Update for Microsoft Graphics Component to Address Remote Code Execution (3104503)
The remote Windows host is affected by multiple remote code execution vulnerabilities due to improper handling of embedded fonts by the Windows font library. A remote attacker can exploit these by convincing a user to open a file or visit a website containing a specially crafted embedded font,...
Fedora 20 : bash-4.2.47-4.fc20 (2014-11360)
Disclosure - http://www.openwall.com/lists/oss-security/2014/09/24/10 Behaviour prior to patch : $ env x=' :;; echo OOPS' bash -c /usr/sbin/nologin OOPS This account is currently not available. Note that Tenable Network Security has extracted the preceding description block directly from the Fedo...
Liferay Portal 6.1.0 User Enumeration
The version of Liferay Portal hosted on the remote web server contains a flaw in the 'SearchPermissionCheckerImpl' class's 'doGetPermissionQuery' method that allows a remote, unauthenticated attacker to enumerate all user accounts. It may be possible to determine the email address of each of the...
Common Platform Enumeration (CPE)
Binary data cpe.nbin...
Wireless Access Point Detection
Nessus has determined that the remote host is a wireless access point AP. Ensure that proper physical and logical controls are in place for its use. A misconfigured access point may allow an attacker to gain access to an internal network without being physically present on the premises. If the...
OpenSSL 3.0.0 < 3.0.10 Multiple Vulnerabilities
The version of OpenSSL installed on the remote host is prior to 3.0.10. It is, therefore, affected by multiple vulnerabilities as referenced in the 3.0.10 advisory. - Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functio...
Dell Wyse Management Suite < 3.6.1 Multiple Vulnerabilities (DSA-2022-098)
The version of Dell Wyse Management Suite installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the DSA-2022-098 advisory. - The BNmodsqrt function, which computes a modular square root, contains a bug that can cause it to...
CentOS 7 : samba (RHSA-2021:5192)
The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:5192 advisory. - A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve the plaintext password sent over the...
Ubuntu 20.04 LTS : Linux kernel (Azure) vulnerabilities (USN-5120-1)
The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5120-1 advisory. It was discovered that the f2fs file system in the Linux kernel did not properly validate metadata in some situations. An attacker could use this to...
openSUSE 15 Security Update : kernel (openSUSE-SU-2021:2415-1)
The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:2415-1 advisory. - A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/xtables.c. This allows an attacker to gain...
RHEL 7 : qemu-kvm-ma (RHSA-2020:1209)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1209 advisory. Kernel-based Virtual Machine KVM is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-ma packages provide the...
RHEL 8 : php:7.3 (RHSA-2019:3736)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:3736 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: underflow in envpathinfo in fpmmain.c...
OpenSSL 1.1.1 < 1.1.1c Vulnerability
The version of OpenSSL installed on the remote host is prior to 1.1.1c. It is, therefore, affected by a vulnerability as referenced in the 1.1.1c advisory. - ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce...
VMSA-2019-0008 : MDS Vulnerabilities (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)
a. Hypervisor Specific and Hypervisor-Assisted Guest Mitigations for MDS vulnerabilities vCenter Server, ESXi, Workstation, and Fusion updates support Hypervisor-Specific and Hypervisor-Assisted Guest Mitigations for MDS speculative execution vulnerabilities. These updates expose new CPU control...