358355 matches found
EulerOS 2.0 SP5 : kernel (EulerOS-SA-2020-1606)
According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image, performing some operations, and unmounting can lead to a use-after-free i...
Amazon Linux AMI : php72, php73 (ALAS-2020-1339)
The version of php72 installed on the remote host is prior to 7.2.26-1.19. The version of php73 installed on the remote host is prior to 7.3.13-1.22. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1339 advisory. In PHP versions 7.2.x below 7.2.26, 7.3.x belo...
Wind River VxWorks Multiple Vulnerabilities (URGENT/11)
According to its self-reported version, the remote device is potentially affected by multiple Wind River VxWorks remote code execution and denial-of-service vulnerabilities in the IPnet TCP/IP stack. An unauthenticated, remote, attacker could leverage these vulnerabilities to gain full access to...
Security Updates for Microsoft .NET Framework (September 2018)
The Microsoft .NET Framework installation on the remote host is missing a security update. It is, therefore, affected by the following vulnerability : - A remote code execution vulnerability exists when Microsoft .NET Framework processes input. An attacker who successfully exploited this...
SSL Certificate Contains Weak RSA Key (Infineon TPM / ROCA)
At least one of the X.509 certificates sent by the remote host has an RSA key that appears to be generated improperly, most likely by a TPM Trusted Platform Module produced by Infineon Technologies. A third party may be able to recover the private key from the certificate's public key. This may...
Ubuntu 14.04 LTS : Linux kernel (Xenial HWE) vulnerabilities (USN-3099-2)
The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3099-2 advisory. USN-3099-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enableme...
MS KB3155527: Update to Cipher Suites for FalseStart
The remote Windows host is affected by a cipher downgrade vulnerability in FalseStart due to allowing TLS clients to send application data before receiving and verifying the server 'Finished' message. A man-in-the-middle attacker can exploit this to force a TLS client to encrypt the first flight ...
Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2015-3035)
The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-3035 advisory. - crypto: aesni - fix memory usage in GCM decryption Stephan Mueller Orabug: 21077385 CVE-2015-3331 - xen/pciback: Don't disable PCICOMMAND on PCI...
CentOS 5 : kernel (CESA-2011:1212)
Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed...
VMware ESXi 7.0 / 8.0 Authenticaton Bypass (CVE-2024-37085)
The version of VMware ESXi installed on the remote host is prior to 8.0 Update 3. It is, therefore, affected by an authentication bypass vulnerability as referenced in the VMSA-2024-0013 advisory. Note that Nessus has not tested for these issues but has instead relied only on the application's...
KB5031354: Windows 11 version 22H2 Security Update (October 2023)
The remote Windows host is missing security update 5031354. It is, therefore, affected by multiple vulnerabilities - The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through...
KB5027222: Windows 10 version 1809 / Windows Server 2019 Security Update (June 2023)
The remote Windows host is missing security update 5027222. It is, therefore, affected by multiple vulnerabilities - Windows Pragmatic General Multicast PGM Remote Code Execution Vulnerability CVE-2023-29363, CVE-2023-32014, CVE-2023-32015 - Windows Collaborative Translation Framework Elevation o...
RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.4.7 Security update (Important) (RHSA-2022:6821)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6821 advisory. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release o...
Debian DSA-4933-1 : nettle - security update
Multiple vulnerabilities were discovered in nettle, a low level cryptographic library, which could result in denial of service remote crash in RSA decryption via specially crafted ciphertext, crash on ECDSA signature verification or incorrect verification of ECDSA signatures. %NASLMINLEVEL 70300 ...
RHEL 7 : kernel-alt (RHSA-2018:0654)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:0654 advisory. The kernel-alt packages provide the Linux kernel version 4.x. The following packages have been upgraded to a later upstream version:...
KB4093110: Security update for Adobe Flash Player (April 2018)
The remote Windows host is missing security update KB4093110. It is, therefore, affected by multiple remote code execution vulnerabilities in Adobe Flash Player. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid108962; scriptversion"1.8";...
Microsoft Windows SMB Versions Supported (remote check)
Nessus was able to obtain the version of SMB running on the remote host by sending an authentication request to port 139 or 445. Note that this plugin is a remote check and does not work on agents. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid100871;...
F5 TLS Session Ticket Implementation Remote Memory Disclosure (Ticketbleed) (uncredentialed check)
Based on its response to a resumed TLS connection, the remote service appears to be affected by an information disclosure vulnerability, known as Ticketbeed, in the TLS Session Ticket implementation. The issue is due to the server incorrectly echoing back 32 bytes of memory, even if the Session I...
AIX 7.1 TL 4 : ntp (IV87420) (deprecated)
NTPv3 and NTPv4 are vulnerable to : https://vulners.com/cve/CVE-2015-7974 NTP could allow a remote authenticated attacker to conduct spoofing attacks, caused by a missing key check. An attacker could exploit this vulnerability to impersonate a peer. NTP could allow a local attacker to bypass...
RHEL 6 : kernel-rt (RHSA-2015:1976)
The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2015:1976 advisory. The kernel-rt packages contain the Linux kernel, the core of any Linux operating system. A flaw was found in the way the Linux kernel's VFS subsystem...
HP OpenView BBC Service Detection
The remote host appears to be running an HP OpenView product. This specific service is an HTTP server. By sending special requests version, info, status, ping, services, ..., it is possible to obtain information about the remote host. C Tenable Network Security, Inc. include"compat.inc"; if...
Opera < 7.50 onUnload Address Bar Spoofing
The remote host is using Opera - an alternative web browser. This version of Opera is vulnerable to a security weakness that may permit malicious web pages to spoof address bar information. This is reportedly possible through malicious use of the JavaScript 'unOnload' event handler when the brows...
Rocky Linux 8 : kernel-rt (RLSA-2022:5834)
The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:5834 advisory. - net/netfilter/nftablesapi.c in the Linux kernel through 5.18.1 allows a local user able to create user/net namespaces to escalate privileges to root because an...
Oracle JDeveloper Multiple Vulnerabilities (April 2022 CPU)
The version of Oracle JDeveloper installed on the remote host is missing a security patch. It is, therefore, affected by multiple vulnerabilities as referenced in the April 2022 CPU advisory: - Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware component: Oracle JDeveloper...
openSUSE 15 Security Update : rpm (openSUSE-SU-2021:2682-1)
The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:2682-1 advisory. - A flaw was found in RPM's hdrblobInit in lib/header.c. This flaw allows an attacker who can modify the rpmdb to cause an out-of-bounds...
KB4550971: Windows Server 2012 April 2020 Security Update
The remote Windows host is missing security update 4550971 or cumulative update 4550917. It is, therefore, affected by multiple vulnerabilities : - An elevation of privilege vulnerability exists when a Windows scheduled task improperly handles file redirections. An attacker who successfully...
EulerOS Virtualization 3.0.1.0 : ntp (EulerOS-SA-2019-1557)
According to the versions of the ntp packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - It was found that ntpd did not check whether a Message Authentication Code MAC was present in a received packet when ntpd was...
Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2018-4269)
The remote Oracle Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2018-4269 advisory. - scsi: libsas: fix memory leak in sassmpgetphyevents Jason Yan Orabug: 27927686 CVE-2018-7757 Tenable has extracted the preceding description block directl...
F5 Networks BIG-IP : Linux kernel vulnerability (K61429540)
The tcpv6synrecvsock function in net/ipv6/tcpipv6.c in the Linux kernel through 4.11.1 mishandles inheritance, which allows local users to cause a denial of service or possibly have unspecified other impact via crafted system calls, a related issue to CVE-2017-8890. CVE-2017-9077 Impact This...
PHP 7.3.0 [alpha|beta] < 7.3.0 Multiple vulnerabilities
According to its banner, the version of PHP running on the remote web server is 7.3.0 alpha|beta prior to 7.3.0. It is, therefore, affected by multiple vulnerabilities: - An arbitrary command injection vulnerability exists in the imapopen function due to improper filters for mailbox names prior t...
RHEL 6 / 7 : JBoss EAP (RHSA-2017:1658)
An update is now available for Red Hat JBoss Enterprise Application Platform 6.4 for Red Hat Enterprise Linux 6 and Red Hat JBoss Enterprise Application Platform 6.4 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common...
Tenable SecurityCenter PHP < 5.6.30 Multiple Vulnerabilities (TNS-2017-04)
The Tenable SecurityCenter application installed on the remote host is missing a security patch. It is, therefore, affected by multiple vulnerabilities in the bundled version of PHP : - A seg fault when loading hostile phar could be used to crash the PHP interpreter or potentially disclose...
Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-3265-1)
The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3265-1 advisory. It was discovered that a use-after-free flaw existed in the filesystem encryption subsystem in the Linux kernel. A local attacker could use this to cause...
Ubuntu 14.04 LTS : OpenSSL vulnerabilities (USN-2385-1)
The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2385-1 advisory. It was discovered that OpenSSL incorrectly handled memory when parsing DTLS SRTP extension data. A remote attacker could possibly use this issue to cause...
MySQL < 5.0.25 / 5.1.12 Privilege Escalation
The version of MySQL installed on the remote host is earlier than 5.0.25 / 5.1.12 and thus reportedly allows a remote, authenticated user to gain privileges through a stored routine. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid17808; scriptversion"1.8";...
RHEL 6 : java-1.6.0-openjdk (RHSA-2010:0865)
The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2010:0865 advisory. These packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Software Development Kit. defaultReadObject of the...
MS09-062: Vulnerabilities in GDI+ Could Allow Remote Code Execution (957488)
The remote host is running a version of Windows that is affected by multiple buffer overflow vulnerabilities when viewing TIFF, PNG, BMP, and Office files that could allow an attacker to execute arbitrary code on the remote host. Additionally, there is a GDI+ .NET API vulnerability that allows a...
WordPress 6.3.x < 6.3.5 Multiple Vulnerabilities
According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A Cross-Site Scripting XSS vulnerability affecting the HTML API. - A Cross-Site Scripting XSS vulnerability affecting the Template Part block. - A path traversal issue...
CentOS 9 : openssh-8.7p1-38.el9
The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the openssh-8.7p1-38.el9 build changelog. - The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass...
SUSE SLES12 / SLES15 Security Update : kernel (Live Patch 15 for SLE 15 SP2) (SUSE-SU-2022:1955-1)
The remote SUSE Linux SLES12 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1955-1 advisory. - A use-after-free flaw was found in the Linux kernel's sound subsystem in the way a user triggers concurrent calls of PCM...
PHP 7.4.x < 7.4.24 Arbitrary File Write
The version of PHP installed on the remote host is 7.4.x prior to 7.4.25. It is, therefore, affected by a vulnerability as referenced in the version 7.4.24 advisory. In the Microsoft Windows environment, ZipArchive::extractTo may be tricked into writing a file outside target directory when...
Ubuntu 20.04 LTS : Linux kernel (Azure) vulnerabilities (USN-5120-1)
The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5120-1 advisory. It was discovered that the f2fs file system in the Linux kernel did not properly validate metadata in some situations. An attacker could use this to...
SUSE SLES12 Security Update : spectre-meltdown-checker (SUSE-SU-2021:2862-1)
The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2021:2862-1 advisory. spectre-meltdown-checker was updated to version 0.44 bsc1189477 - feat: add support for SRBDS related vulnerabilities - feat: add zstd kerne...
RHEL 7 : nss-softokn (RHSA-2020:1267)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1267 advisory. The nss-softokn package provides the Network Security Services Softoken Cryptographic Module. Security Fixes: nss: Out-of-bounds write when...
KB4022715: Windows 10 Version 1607 and Windows Server 2016 June 2017 (CVE-2017-8529) (deprecated)
This plugin was depredated as it was referencing a CVE which wasn't properly fixed until September 2017. The replacement plugin addresses all Windows 10 / Server 2016 registry requirements for CVE-2017-8 deprecais plugin was depredated as it was referencing a CVE which wasn't properly fixed until...
openSUSE Security Update : java-11-openjdk (openSUSE-2019-1916)
This update for java-11-openjdk to version jdk-11.0.4+11 fixes the following issues : Security issues fixed : - CVE-2019-2745: Improved ECC Implementation bsc1141784. - CVE-2019-2762: Exceptional throw cases bsc1141782. - CVE-2019-2766: Improve file protocol handling bsc1141789. - CVE-2019-2769:...
LibreOffice < 6.2.5 Multiple Vulnerabilities (Windows)
The version of LibreOffice installed on the remote Windows host is prior to 6.2.5. It is, therefore, affected by multiple vulnerabilities : - An arbitrary script execution vulnerability exists due to a flaw allowing event-based execution of python scripts within a document. Note, LibreLogo must b...
Photon OS 1.0: Linux PHSA-2018-1.0-0132
An update of the linux package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2018-1.0-0132. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid121837...
Apache Struts CVE-2018-11776 Results With No Namespace Remote Code Execution (S2-057) (remote)
The version of Apache Struts running on the remote host is affected by a remote code execution vulnerability in the handling of results with no namespace set. An unauthenticated, remote attacker can exploit this, via a specially crafted HTTP request, to potentially execute arbitrary code, subject...
KB4038782: Windows 10 Version 1607 and Windows Server 2016 September 2017 Cumulative Update
The remote Windows host is missing security update 4038782. It is, therefore, affected by multiple vulnerabilities : - A race condition that could lead to a remote code execution vulnerability exists in NetBT Session Services when NetBT fails to maintain certain sequencing requirements...