347056 matches found
PHP 5.3 < 5.3.7 Multiple Vulnerabilities
According to its banner, the version of PHP 5.3.x running on the remote host is prior to 5.3.7. It is, therefore, affected by the following vulnerabilities : - A use-after-free vulnerability in substrreplace. CVE-2011-1148 - A stack-based buffer overflow in socketconnect. CVE-2011-1938 - A code...
Horde < 3.1 go.php url Parameter File Disclosure
Binary data 3477.prm...
GLSA-200511-08 : PHP: Multiple vulnerabilities
The remote host is affected by the vulnerability described in GLSA-200511-08 PHP: Multiple vulnerabilities Multiple vulnerabilities have been found and fixed in PHP: a possible $GLOBALS variable overwrite problem through file upload handling, extract and importrequestvariables CVE-2005-3390 a loc...
MS04-022: Microsoft Windows Task Scheduler Remote Overflow (841873) (uncredentialed check)
There is a flaw in the Task Scheduler application which could allow a remote attacker to execute code remotely. There are many attack vectors for this flaw. An attacker, exploiting this flaw, would need to either have the ability to connect to the target machine or be able to coerce a local user ...
KB5031407: Windows Server 2012 R2 Security Update (October 2023)
The remote Windows host is missing security update 5031407. It is, therefore, affected by multiple vulnerabilities - Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability CVE-2023-36577 - Windows IIS Server Elevation of Privilege Vulnerability CVE-2023-36434 - Microsof...
Oracle WebLogic Server (July 2023 CPU)
The version of Oracle WebLogic Server installed on the remote host is missing a security patch from the July 2023 Critical Patch Update CPU. It is, therefore, affected by multiple vulnerabilities, including: - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware...
KB5018476: Windows 8.1 and Windows Server 2012 R2 Security Update (October 2022)
The remote Windows host is missing security update 5018476. It is, therefore, affected by multiple vulnerabilities - Server Service Remote Protocol Elevation of Privilege Vulnerability CVE-2022-38045 - Microsoft ODBC Driver Remote Code Execution Vulnerability CVE-2022-38040 - Microsoft WDAC OLE D...
Amazon Corretto Java 11.x < 11.0.6.10.1 Multiple Vulnerabilities
The version of Amazon Corretto installed on the remote host is prior to 11 11.0.6.10.1. It is, therefore, affected by multiple vulnerabilities as referenced in the corretto-11-2020-Jan-15 advisory. - Serialization CVE-2020-2583, CVE-2020-2604 - Security CVE-2020-2590, CVE-2020-2601 - Networking...
AlmaLinux 8 : grafana (ALSA-2021:4226)
The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2021:4226 advisory. - In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest limb during...
Oracle Linux 8 : java-11-openjdk (ELSA-2022-0185)
The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-0185 advisory. 1:11.0.14.0.9-2 - Fix FIPS issues in native code and with initialisation of java.security.Security - Related: rhbz2039366 1:11.0.14.0.9-1 - Update to...
Debian DLA-2753-1 : qemu - LTS security update
The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2753 advisory. - A flaw was found in the USB redirector device usb-redir of QEMU. Small USB packets are combined into a single, large transfer request, to reduce the overhead and...
SUSE SLES15 Security Update : kernel (Live Patch 7 for SLE 15 SP2) (SUSE-SU-2021:2387-1)
The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2387-1 advisory. This update for the Linux Kernel 5.3.18-2437 fixes several issues. The following security issues were fixed: - CVE-2021-0512: Fixed a possible...
EulerOS 2.0 SP9 : openssl (EulerOS-SA-2021-1014)
According to the version of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL...
KB4586823: Windows 8.1 and Windows Server 2012 R2 November 2020 Security Update
The Windows installation on the remote host is missing security update 4586781. It is, therefore, affected by multiple vulnerabilities. Please review the vendor advisory for more details. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from t...
Amazon Linux AMI : kernel (ALAS-2020-1437)
The version of kernel installed on the remote host is prior to 4.14.200-116.320. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1437 advisory. In the Linux kernel 5.0.21 and 5.3.11, mounting a crafted btrfs filesystem image, performing some operations, and...
MariaDB 10.2.0 < 10.2.28 Multiple Vulnerabilities
The version of MariaDB installed on the remote host is prior to 10.2.28. It is, therefore, affected by multiple vulnerabilities as referenced in the 10.2.28 advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Parser. Supported versions that are affected are...
Fedora 30 : xen (2019-cbb732f760)
add missing XSA-299 patches x86: Machine Check Error on Page Size Change DoS XSA-304, CVE-2018-12207 TSX Asynchronous Abort speculative side channel XSA-305, CVE-2019-11135 ---- VCPUOPinitialise DoS XSA-296, CVE-2019-18420 missing descriptor table limit checking in x86 PV emulation XSA-298,...
Photon OS 2.0: Openssl / Procps-ng / Perl PHSA-2018-2.0-0084 (deprecated)
An update of 'procps-ng', 'openssl', 'perl' packages of Photon OS has been released. C Tenable Network Security, Inc. @DEPRECATED@ Disabled on 2/7/2019 The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2018-2.0-0084. The text itself is...
Photon OS 1.0: Linux / Openssh PHSA-2016-0014 (deprecated)
An update of openssh , linux packages for PhotonOS has been released. File data PhotonOSPHSA-2016-0014.nasl...
AIX Java Advisory : java_apr2017_advisory.asc (April 2017 CPU)
The version of Java SDK installed on the remote AIX host is affected by multiple vulnerabilities in the following subcomponents : - Multiple vulnerabilities exist in the zlib subcomponent that allow an unauthenticated, remote attacker to trigger denial of service conditions. CVE-2016-9840,...
SUSE SLED12 / SLES12 Security Update : bash (SUSE-SU-2016:2872-1) (Shellshock)
This update for bash fixes the following issues : - CVE-2016-7543: Local attackers could have executed arbitrary commands via specially crafted SHELLOPTS+PS4 variables bsc1001299 - CVE-2016-0634: Malicious hostnames could have allowed arbitrary command execution when $HOSTNAME was expanded in the...
Scientific Linux Security Update : java (jdk 1.6.0) on SL4.x, SL5.x i386/x86_64
CVE-2009-2409 deprecate MD2 in SSL cert validation Kaminsky CVE-2009-3873 OpenJDK JPEG Image Writer quantization problem 6862968 CVE-2009-3875 OpenJDK MessageDigest.isEqual introduces timing attack vulnerabilities 6863503 CVE-2009-3876 OpenJDK ASN.1/DER input stream parser denial of service 68649...
Apache Tomcat < 4.1.40 / 5.5.28 / 6.0.20 Multiple Vulnerabilities
According to its self-reported version number, the Apache Tomcat server listening on the remote host is prior to 4.1.40, 5.5.28, or 6.0.20. It is, therefore, affected by the following vulnerabilities : - The remote server is affected by a directory traversal vulnerability if a RequestDispatcher...
Common Platform Enumeration (CPE)
Binary data cpe.nbin...
CentOS 3 / 4 : python (CESA-2007:1076)
Updated python packages that fix several security issues are now available for Red Hat Enterprise Linux 3 and 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Python is an interpreted, interactive, object-oriented programming language. An...
Spring Framework 5.3.x < 5.3.49 / 6.1.x < 6.1.28 / 6.2.x < 6.2.18.1 / 7.0.x < 7.0.7.1 Multiple Vulnerabilities
The version of Spring Framework installed on the remote host is 5.3.x prior to 5.3.49, 6.1.x prior to 6.1.28, 6.2.x prior to 6.2.18.1, or 7.0.x prior to 7.0.7.1. It is, therefore, affected by multiple vulnerabilities: - IDs for WebSocket sessions in the spring-websocket module are not...
WordPress 5.4.x < 5.4.16 Multiple Vulnerabilities
According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A Cross-Site Scripting XSS vulnerability affecting the HTML API. - A Cross-Site Scripting XSS vulnerability affecting the Template Part block. - A path traversal issue...
RHEL 6 : git (Unpatched Vulnerability)
The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - git: cvsserver command injection CVE-2017-14867 - git: Heap overflow in git archive, git log --format...
KB5025228: Windows 10 Version 1607 and Windows Server 2016 Security Update (April 2023)
The remote Windows host is missing security update 5025228. It is, therefore, affected by multiple vulnerabilities - Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability CVE-2023-28275 - Windows Pragmatic General Multicast PGM Remote Code Execution Vulnerability...
Oracle Linux 7 : Unbreakable Enterprise kernel-container (ELSA-2022-9699)
The remote Oracle Linux 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2022-9699 advisory. - netsched: clsroute: remove from list when handle is 0 Thadeu Lima de Souza Cascardo Orabug: 34460938 CVE-2022-2588 - KVM: x86: Avoid theoretical NULL pointer...
NVIDIA Linux GPU Display Driver (Aug 2022)
The NVIDIA GPU display driver software on the remote host is missing a security update. It is, therefore, affected by multiple vulnerabilities: - NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer nvidia.ko, where a local user with basic capabilities can cause...
Spring Framework < 5.2.20 / 5.3.x < 5.3.18 Remote Code Execution (Spring4Shell)
Spring MVC and Spring WebFlux applications, when packaged as a traditional WAR file, running on JDK version 9 and higher in an Apache Tomcat servlet container and exposing one or more endpoints with DataBinder enabled, suffer from a Remote Code Execution RCE vulnerability. By crafting a specific...
SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2019:1744-1)
The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes. This update adds support for the Hygon Dhyana CPU fate327735. The following security bugs were fixed : CVE-2019-12614: An issue was discovered in dlparparseccproperty in...
openSUSE Security Update : the Linux Kernel (openSUSE-2018-656) (Spectre)
The openSUSE Leap 42.3 was updated to 4.4.138 to receive various security and bugfixes. The following security bugs were fixed : - CVE-2018-3639: Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes...
RHEL 7 : Red Hat JBoss Core Services (RHSA-2017:2709)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:2709 advisory. Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This software, such as Apache HTTP...
RHEL 6 / 7 : rhev-hypervisor (RHSA-2017:1209)
An update for rhev-hypervisor7 is now available for RHEV 3.X Hypervisor and Agents for RHEL-6 and RHEV 3.X Hypervisor and Agents for RHEL-7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives ...
CiscoWorks Common Services HTTP Response Splitting
The version of CiscoWorks Common Services on the remote host has an HTTP response splitting vulnerability. Common Services is a framework included with several Cisco products. Input to the 'URL' parameter of Autologin.jsp is not properly sanitized. A remote attacker could exploit this by tricking...
Oracle Java JDK / JRE 7 < Update 17 Remote Code Execution
Binary data 6711.prm...
Ubuntu 11.04 / 11.10 : firefox vulnerabilities (USN-1277-1)
Yosuke Hasegawa discovered that the Mozilla browser engine mishandled invalid sequences in the Shift-JIS encoding. It may be possible to trigger this crash without the use of debugging APIs, which might allow malicious websites to exploit this vulnerability. An attacker could possibly use this fl...
WordPress Trackback 'wp-trackback.php' 'tb_id' Parameter SQL Injection
The version of WordPress on the remote host fails to properly sanitize input to the 'tbid' parameter of the 'wp-trackback.php' script before using it in database queries. An unauthenticated, remote attacker can leverage this issue to launch SQL injection attacks against the affected application,...
Windows Snip & Sketch/ Snipping Tool CVE-2023-28303 (Acropalypse)
An information disclosure vulnerability exists in Windows Snip & Sketch Windows 10 and Snipping Tool Windows 11 where parts of a cropped image that were to be removed are not completely deleted and can be restored if saved to the cropped image file. Note that Nessus has not tested for this issue...
NewStart CGSL CORE 5.05 / MAIN 5.05 : kernel Multiple Vulnerabilities (NS-SA-2022-0040)
The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has kernel packages installed that are affected by multiple vulnerabilities: - An issue was discovered in the Linux kernel before 4.14.11. A double free may be caused by the function allocatetracebuffer in the file...
McAfee Agent < 5.7.6 Multiple Vulnerabilities (SB10382)
The version of McAfee Agent, formerly McAfee ePolicy Orchestrator ePO Agent, installed on the remote host is prior to 5.7.6. It is, therefore, affected by the following vulnerabilities: - A local privilege escalation vulnerability in MA for Windows prior to 5.7.6 allows a local low privileged use...
RHEL 8 : java-1.8.0-openjdk (RHSA-2021:3893)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3893 advisory. The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security...
F5 BIG-IP RCE (CVE-2021-22986)
Binary data f5cve-2021-22986.nbin...
SUSE SLES12 Security Update : MozillaFirefox (SUSE-SU-2020:3548-1)
This update for MozillaFirefox fixes the following issues : Firefox Extended Support Release 78.5.0 ESR bsc1178824 - CVE-2020-26951: Parsing mismatches could confuse and bypass security sanitizer for chrome privileged code - CVE-2020-16012: Variable time processing of cross-origin images during...
RHEL 7 : slirp4netns (RHSA-2020:0889)
The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:0889 advisory. The slirp4netns package contains user-mode networking for unprivileged network namespaces. It is required to enable networking for rootless...
ISC BIND 9.11.0 / 9.11.x < 9.11.13 / 9.11.x < 9.11.13-S1 / 9.12.x < 9.12.5-P2 / 9.14.x < 9.14.8 / 9.15 / 9.15.x < 9.15.6 Vulnerability
A denial of service DoS vulnerability exists in ISC BIND 9 due to TCP Client issues. An unauthenticated, remote attacker can exploit this issue, via DNS Request, to cause the device to stop responding. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid131735;...
MySQL 8.0.x < 8.0.18 Multiple Vulnerabilities (Oct 2019 CPU)
The version of MySQL running on the remote host is 8.0.x prior to 8.0.18. It is, therefore, affected by multiple vulnerabilities, including three of the top vulnerabilities below, as noted in the October 2019 Critical Patch Update advisory: - Vulnerability in the MySQL Server product of Oracle...
EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1516)
According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - The hi3660stubclkprobe function in drivers/clk/hisilicon/clk-hi3660-stub.c in the Linux kernel before 4.16 allows loca...