348066 matches found
Oracle Linux 7 : kernel (ELSA-2021-3327)
The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-3327 advisory. - redhat: ppc64: CONFIGRTASFILTER Aristeu Rozanski 1906443 CVE-2020-27777 - powerpc/rtas: Fix typo of ibm,open-errinjct in RTAS filter Aristeu Rozanski...
Photon OS 4.0: Linux PHSA-2021-4.0-0011
An update of the linux package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-4.0-0011. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid148815;...
EulerOS Virtualization for ARM 64 3.0.2.0 : qemu-kvm (EulerOS-SA-2021-1046)
According to the versions of the qemu-kvm packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - In QEMU through 5.0.0, an integer overflow was found in the SM501 display driver implementation. This flaw occurs in...
Mozilla Firefox < 83.0
The version of Firefox installed on the remote macOS or Mac OS X host is prior to 83.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-50 advisory. - Mozilla developers Tyson Smith, Aaron Klotz, David Major and Jason Kratzer reported memory safety bugs presen...
FreeBSD : samba -- Unauthenticated domain takeover via netlogon (24ace516-fad7-11ea-8d8c-005056a311d1)
The Samba Team reports : An unauthenticated attacker on the network can gain administrator access by exploiting a netlogon protocol flaw. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2020...
Adobe Flash Player <= 32.0.0.371 (APSB20-30)
The version of Adobe Flash Player installed on the remote Windows host is equal or prior to version 32.0.0.371. It is, therefore, affected by an use after free vulnerability. An unauthenticated, remote attacker can exploit this, via a specially crafted file, to execute arbitrary code within the...
RHEL 7 : kernel (RHSA-2020:1347)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1347 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: heap overflow in...
Debian DSA-4516-1 : firefox-esr - security update
Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, cross-site scripting, bypass of the same-origin policy, sandbox escape, information disclosure or denial of service. C Tenable Network Security, Inc. The...
Ubuntu 16.04 LTS : Linux kernel (Qualcomm Snapdragon) vulnerability (USN-3106-4)
The remote Ubuntu 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-3106-4 advisory. It was discovered that a race condition existed in the memory manager of the Linux kernel when handling copy-on-write breakage of private read-only memory mapping...
VMware vCenter Converter Multiple Vulnerabilities (VMSA-2014-0006)
The version of VMware vCenter Converter installed on the remote Windows host is version 5.1.x prior to 5.1.1 or 5.5.x prior to 5.5.2. It is, therefore, affected by multiple vulnerabilities in the bundled OpenSSL library : - An error exists in the function 'ssl3readbytes' that could allow data to ...
Scientific Linux Security Update : kernel on SL5.x i386/x86_64 (20140723)
A NULL pointer dereference flaw was found in the rdsiwladdrcheck function in the Linux kernel's implementation of Reliable Datagram Sockets RDS. A local, unprivileged user could use this flaw to crash the system. CVE-2014-2678, Moderate - It was found that the Xen hypervisor implementation did...
HP Smart Update Manager 6.x < 6.4.1 Multiple Vulnerabilities
The version of HP Smart Update manager running on the remote host is prior to 6.4.1. It is, therefore, affected by the following vulnerabilities : - An error exists in the function 'ssl3readbytes' that can allow data to be injected into other sessions or allow denial of service attacks. Note that...
openSUSE Security Update : apache2-mod_php5 (openSUSE-SU-2011:0645-1)
This php5 update fixes : - CVE-2011-0421: CVSS v2 Base Score: 2.6 AV:N/AC:H/Au:N/C:N/I:N/A:P: Input Validation CWE-20 - CVE-2011-1092: CVSS v2 Base Score: 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P: Numeric Errors CWE-189 - CVE-2011-1148: CVSS v2 Base Score: 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P: Resource Managemen...
RHEL 5 : tomcat (RHSA-2009:1164)
The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2009:1164 advisory. Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. It was discovered that the Red Hat Security...
Microsoft Windows/Exchange SMTP DNS Lookup Overflow (885881)
The remote host is running a version of Microsoft SMTP server which fails to validate DNS response data. An attacker can exploit this flaw to execute arbitrary code subject to the priviliges of the SMTP application server process. C Tenable Network Security, Inc. v1.2: 10/19/2004 KK Liu adjust to...
MS03-026 / MS03-039: Buffer Overrun In RPCSS Service Could Allow Code Execution (823980 / 824146)
The remote host is running a version of Windows affected by several vulnerabilities in its RPC interface and RPCSS Service, that could allow an attacker to execute arbitrary code and gain SYSTEM privileges. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid11790;...
Security Updates for Microsoft SQL Server (May 2026)
The Microsoft SQL Server installation on the remote host is missing a security update. It is, therefore, affected by the following vulnerability: - External control of file name or path in SQL Server allows an authorized attacker to execute code over a network. CVE-2026-40370 Note that Nessus has...
Amazon Linux 2023 : gnupg2, gnupg2-minimal, gnupg2-smime (ALAS2023-2023-087)
It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-087 advisory. A vulnerability was found in GnuPG. This issue occurs due to an escape detection loop at the writestatustextandbuffer function in g10/cpr.c. This flaw allows a malicious actor to bypass access control...
EulerOS Virtualization 3.0.6.0 : openssl (EulerOS-SA-2022-1088)
According to the versions of the openssl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - In order to decrypt SM2 encrypted data an application is expected to call the API function EVPPKEYdecrypt. Typically an...
Photon OS 4.0: Linux PHSA-2021-4.0-0126
An update of the linux package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-4.0-0126. The text itself is copyright C VMware, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if descripti...
RHEL 7 : kernel (RHSA-2021:3801)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3801 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: Improper handling of...
KB5004947: Windows 10 1809 and Windows Server 2019 OOB Security Update RCE (July 2021)
A remote command execution vulnerability exists in Windows Print Spooler service improperly performs privileged file operations. An authenticated, remote attacker can exploit this to bypass and run arbitrary code with SYSTEM privileges. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...
EulerOS Virtualization for ARM 64 3.0.2.0 : glibc (EulerOS-SA-2021-2076)
According to the versions of the glibc packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - The iconv function in the GNU C Library aka glibc or libc6 2.32 and earlier, when processing invalid multi-byte input...
SUSE SLED15: qemu / qemu-arm / qemu-audio-alsa / qemu-audio-pa / etc (SUSE-SU-2021:1942-1)
The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:1942-1 advisory. - Switch method of splitting off hw-s390x-virtio-gpu-ccw.so as a module to what was accepted upstream bsc1181103 - Fix OOB access in...
Photon OS 1.0: Nodejs10 PHSA-2021-1.0-0373
An update of the nodejs10 package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-1.0-0373. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
RHEL 7 : kernel (RHSA-2020:3598)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:3598 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: kernel: DAX hugepages not considered...
Photon OS 1.0: Python2 PHSA-2019-1.0-0252
An update of the python2 package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2019-1.0-0252. The text itself is copyright C VMware, Inc. include"compat.inc"; if description...
KB4487026: Windows 10 Version 1607 and Windows Server 2016 February 2019 Security Update
The remote Windows host is missing security update 4487026. It is, therefore, affected by multiple vulnerabilities : - An information vulnerability exists when Windows improperly discloses file information. Successful exploitation of the vulnerability could allow the attacker to read the contents...
FreeBSD : Apache -- vulnerability (eb888ce5-1f19-11e9-be05-4c72b94353b5)
The Apache httpd Project reports : SECURITY: CVE-2018-17199 modsession: modsessioncookie does not respect expiry time allowing sessions to be reused. SECURITY: CVE-2019-0190 modssl: Fix infinite loop triggered by a client-initiated renegotiation in TLSv1.2 or earlier with OpenSSL 1.1.1 and later...
Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : OpenSSH vulnerabilities (USN-3809-1)
The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3809-1 advisory. Robert Swiecki discovered that OpenSSH incorrectly handled certain messages. An attacker could possibly use this issue to cause a...
RHEL 7 : kernel (RHSA-2018:3083)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3083 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: A flaw named FragmentSmack was found i...
Oracle Linux 6 : kernel (ELSA-2018-2164)
The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-2164 advisory. - x86 entry/64: Don't use IST entry for BP stack Waiman Long 1596113 CVE-2018-10872 - mm mempolicy: fix use after free when calling getmempolicy August...
Virtuozzo 7 : java-1.7.0-openjdk / etc (VZLSA-2017-3392)
An update for java-1.7.0-openjdk is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, ...
RHEL 6 : kernel (RHSA-2017:2681)
The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2017:2681 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: A stack buffer overflow flaw was found in the w...
SUSE SLED12 / SLES12 Security Update : expat (SUSE-SU-2017:0424-1)
This update for expat fixes the following security issues : - CVE-2012-6702: Expat, when used in a parser that has not called XMLSetHashSalt or passed it a seed of 0, made it easier for context-dependent attackers to defeat cryptographic protection mechanisms via vectors involving use of the sran...
Debian DLA-499-1 : php5 security update
CVE-2015-8865 The filecheckmem function in funcs.c in file before 5.23, as used in the Fileinfo component in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5, mishandles continuation-level jumps, which allows context-dependent attackers to cause a denial of service buffer overflow and...
RHEL 7 : kernel-rt (RHSA-2016:0212)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:0212 advisory. The kernel-rt packages contain the Linux kernel, the core of any Linux operating system. It was found that the Linux kernel's keys subsystem...
Ubuntu 14.10 : linux vulnerability (USN-2600-1)
A race condition between chown and execve was discovered in the Linux kernel. A local attacker could exploit this race by using chown on a setuid-user-binary to gain administrative privileges. Note that Tenable Network Security has extracted the preceding description block directly from the Ubunt...
RHEL 6 : Red Hat JBoss Enterprise Application Platform 6.3.0 update (Important) (RHSA-2014:1020)
The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:1020 advisory. Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. A race condition...
SuSE 11.3 Security Update : PHP 5.3 (SAT Patch Number 9537)
PHP 5.3 has been updated to fix several security problems : - The SPL component in PHP incorrectly anticipated that certain data structures will have the array data type after unserialization, which allowed remote attackers to execute arbitrary code via a crafted string that triggers use of a...
CoSoSys Endpoint Protector 4 Predictable Password
The remote CoSoSys Endpoint Protector 4 is affected by a password disclosure flaw. Specifically, the 'epproot' account is set to the default password 'eroot!00$SUMRO', where $SUM is the sum of the 9 digits in the appliance serial number. C Tenable Network Security, Inc. include"compat.inc";...
Mozilla Thunderbird 10.0.x < 10.0.5 Multiple Vulnerabilities
The installed version of Thunderbird 10.0.x is potentially affected by the following security issues : - An error exists in the ASN.1 decoder when handling zero length items that can lead to application crashes. CVE-2012-0441 - Multiple memory corruption errors exist. CVE-2012-1937, CVE-2012-1939...
Ubuntu 10.04 LTS / 10.10 / 11.04 / 11.10 : openjdk-6, openjdk-6b18 regression (USN-1263-2) (BEAST)
USN-1263-1 fixed vulnerabilities in OpenJDK 6. The upstream patch for the chosen plaintext attack on the block-wise AES encryption algorithm CVE-2011-3389 introduced a regression that caused TLS/SSL connections to fail when using certain algorithms. This update fixes the problem. We apologize for...
RHEL 9 : openssl (Unpatched Vulnerability)
The remote Redhat Enterprise Linux 9 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - openssl: the crehash script allows command injection CVE-2022-2068 - The crehash script does not properly...
Rocky Linux 8 : openssh (RLSA-2022:2013)
The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:2013 advisory. - sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not...
VMware Workspace One Access / VMware Identity Manager Multiple Vulnerabilities (VMSA-2022-0011)
The VMware Workspace One Access formerly VMware Identity Manager application running on the remote host is affected by the following vulnerabilities: - Server-side Template Injection Remote Code Execution Vulnerability CVE-2022-22954 - OAuth2 ACS Authentication Bypass Vulnerabilities...
OpenSSH < 7.8
According to its banner, the version of OpenSSH running on the remote host is prior to 7.8. It is, therefore, affected by an information disclosure vulnerability in the auth2-gss.c, auth2-hostbased.c, and auth2-pubkey due to not delaying for an invalid authenticating user. An unauthenticated,...
SUSE SLED15: xen / xen-devel / xen-libs / xen-tools / xen-tools-domU / etc (SUSE-SU-2022:0940-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0940-1 advisory. Update Xen to version 4.14.4 bsc1027519 Transient execution side-channel attacks attacking the Branch History...
Oracle Linux 7 : Unbreakable Enterprise kernel-container (ELSA-2021-9008)
The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2021-9008 advisory. - target: fix XCOPY NAA identifier lookup David Disseldorp Orabug: 32248040 CVE-2020-28374 - xenbus/xenbusbackend: Disallow pending watch messages...
Ubuntu 18.04 LTS / 20.04 LTS : Linux kernel vulnerabilities (USN-4576-1)
The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4576-1 advisory. Hadar Manor discovered that the DCCP protocol implementation in the Linux kernel improperly handled socket reuse, leading to a use-after-free...