347225 matches found
RHEL 7 : OpenShift Container Platform 4.1 (RHSA-2019:3265)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3265 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or privat...
Fedora 30 : httpd (2019-cf7695b470)
Resolves: 1695046 CVE-2019-0196 CVE-2019-0197 CVE-2019-0215 CVE-2019-0217 CVE-2019-0220 httpd: various flaws Resolves: 1694510 httpd-2.4.39 is available Resolves: 1694986 - CVE-2019-0211 httpd: privilege escalation from modules scripts Note that Tenable Network Security has extracted the precedin...
openSUSE Security Update : libqt5-qtsvg (openSUSE-2019-1116)
This update for libqt5-qtsvg fixes the following issues : Security issues fixed : - CVE-2018-19869: Fixed Denial of Service when parsing malformed URL reference bsc1118599 This update was imported from the SUSE:SLE-15:Update update project. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...
Oracle Linux 7 : qemu-kvm (ELSA-2018-2462)
The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-2462 advisory. - Resolves: bz1549824 CVE-2018-7550 qemu-kvm: Qemu: i386: multiboot OOB access while loading kernel image rhel-7.5.z - Resolves: bz1586248 CVE-2018-118...
CentOS 6 : kernel (CESA-2018:0512) (Meltdown) (Spectre)
An update for kernel is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...
Palo Alto Networks PAN-OS Management Interface RCE (PAN-SA-2017-0027)
The Palo Alto Networks PAN-OS running on the remote host is affected by a remote code execution vulnerability in the management interface due to improper validation of user-supplied input when handling HTTP requests. An unauthenticated, remote attacker can exploit this, via a series of specially...
Ubuntu 16.04 LTS : Linux kernel (HWE) vulnerability (USN-3333-1)
The remote Ubuntu 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-3333-1 advisory. USN-3326-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.10. This update provides the corresponding updates for the Linux Hardware Enablement HWE kernel...
SUSE SLES12 Security Update : xen (SUSE-SU-2017:0582-1)
This update for xen fixes several issues. These security issues were fixed : - CVE-2017-5973: A infinite loop while doing control transfer in xhcikickepctx allowed privileged user inside the guest to crash the host process resulting in DoS bsc1025188 - CVE-2016-10155: The virtual hardware watchdo...
McAfee ePolicy Orchestrator Agent < 5.0.4.449 Log Viewer DoS
According to its self-reported version, the McAfee ePolicy Orchestrator ePO Agent running on the remote host is 5.0.x prior to 5.0.4.449. It is, therefore, affected by a flaw in its remote log viewer component due to improper validation of input to an unspecified HTTP GET parameter. An...
Ubuntu 12.04 LTS : linux vulnerability (USN-3104-1) (Dirty COW)
It was discovered that a race condition existed in the memory manager of the Linux kernel when handling copy-on-write breakage of private read-only memory mappings. A local attacker could use this to gain administrative privileges. Note that Tenable Network Security has extracted the preceding...
Amazon Linux AMI : java-1.6.0-openjdk (ALAS-2015-616)
Multiple flaws were discovered in the CORBA, Libraries, RMI, Serialization, and 2D components in OpenJDK. An untrusted Java application or applet could use these flaws to completely bypass Java sandbox restrictions. CVE-2015-4835 , CVE-2015-4881 , CVE-2015-4843 , CVE-2015-4883 , CVE-2015-4860 ,...
Oracle Linux 7 : kernel (ELSA-2015-1534)
The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-1534 advisory. - net ipv4: Missing sknullsnodeinit in pingunhash Denys Vlasenko 1218104 1218105 CVE-2015-3636 - net nfconntrack: reserve two bytes for nfctext-len...
Ubuntu 12.04 LTS : linux-lts-trusty vulnerabilities (USN-2419-1)
A flaw was discovered in how the Linux kernel's KVM Kernel Virtual Machine subsystem handles the CR4 control register at VM entry on Intel processors. A local host OS user can exploit this to cause a denial of service kill arbitrary processes, or system disruption by leveraging /dev/kvm access...
Debian DSA-2923-1 : openjdk-7 - security update
Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in the execution of arbitrary code, breakouts of the Java sandbox, information disclosure or denial of service. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive te...
Amazon Linux AMI : openssl Information Disclosure Vulnerability (ALAS-2014-320)
A missing bounds check was found in the way OpenSSL handled TLS heartbeat extension packets. This flaw could be used to reveal up to 64k of memory from a connected client or server. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Amazon...
SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 8325)
This Linux kernel update fixes various security issues and bugs in the SUSE Linux Enterprise 10 SP4 kernel. The following security issues have been fixed : - kernel/taskstats.c in the Linux kernel allowed local users to obtain sensitive I/O statistics by sending taskstats commands to a netlink...
Scientific Linux Security Update : seamonkey on SL4.x i386/x86_64
An integer overflow flaw was found in the way SeaMonkey displayed certain web content. A malicious website could cause SeaMonkey to crash or execute arbitrary code with the permissions of the user running SeaMonkey. CVE-2008-2785 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptiv...
Scientific Linux Security Update : postgresql on SL3.x, SL4.x, SL5.x i386/x86_64
PostgreSQL is an advanced object-relational database management system DBMS. PL/Perl and PL/Tcl allow users to write PostgreSQL functions in the Perl and Tcl languages, and are installed in trusted mode by default. In trusted mode, certain operations, such as operating system level access, are...
RHEL 5 : java-1.4.2-ibm (RHSA-2010:0935)
The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2010:0935 advisory. - krb5: null pointer dereference in GSS-API library leads to DoS MITKRB5-SA-2010-005 CVE-2010-1321 - OpenJDK HttpURLConnection incomplete...
Fedora 14 : firefox-3.6.12-1.fc14 / galeon-2.0.7-35.fc14.1 / gnome-python2-extras-2.25.3-25.fc14.1 / etc (2010-16897)
Update to new upstream Firefox version 3.6.12, fixing multiple security issues detailed in the upstream advisories : - http://www.mozilla.org/security/known-vulnerabilities/fi refox36.htmlfirefox3.6.11 - http://www.mozilla.org/security/known-vulnerabilities/ firefox36.htmlfirefox3.6.12 Update als...
RHEL 4 / 5 : java-1.5.0-sun (RHSA-2009:1199)
Updated java-1.5.0-sun packages that correct several security issues are now available for Red Hat Enterprise Linux 4 Extras and 5 Supplementary. This update has been rated as having critical security impact by the Red Hat Security Response Team. The Sun 1.5.0 Java release includes the Sun Java 5...
Debian DSA-1751-1 : xulrunner - several vulnerabilities
Several remote vulnerabilities have been discovered in Xulrunner, a runtime environment for XUL applications, such as the Iceweasel web browser. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-0771 Martijn Wargers, Jesse Ruderman and Josh Soref...
OpenSSH w/ PAM Multiple Timing Attack Weaknesses
The remote host seems to be running an SSH server that could allow an attacker to determine the existence of a given login by comparing the time the remote sshd daemon takes to refuse a bad password for a nonexistent login compared to the time it takes to refuse a bad password for a valid login. ...
KB5036910: Windows Server version 23H2 Security Update (April 2024)
The remote Windows host is missing security update 5036910. It is, therefore, affected by multiple vulnerabilities - SmartScreen Prompt Security Feature Bypass Vulnerability CVE-2024-29988 - Secure Boot Security Feature Bypass Vulnerability CVE-2024-20669, CVE-2024-26168, CVE-2024-26171,...
Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel (OEM) vulnerability (USN-5545-1)
The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-5545-1 advisory. Arthur Mongodin discovered that the netfilter subsystem in the Linux kernel did not properly perform data validation. A local attacker could use this ...
RHEL 8 : postgresql:12 (RHSA-2021:2372)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2372 advisory. PostgreSQL is an advanced object-relational database management system DBMS. The following packages have been upgraded to a later upstream...
SUSE SLES11 Security Update : java-1_7_1-ibm (SUSE-SU-2020:14588-1)
The remote SUSE Linux SLES11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2020:14588-1 advisory. - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Serialization. Supported versions that are affected are...
Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2021-9215)
The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9215 advisory. - btrfs: fix race when cloning extent buffer during rewind of an old root Filipe Manana Orabug: 32669454 CVE-2021-28964 - xen-blkback: don't leak...
RHEL 8 : libpq (RHSA-2020:5638)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5638 advisory. The libpq package provides the PostgreSQL client library, which allows client programs to connect to PostgreSQL servers. The following...
Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2020-5936)
The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-5936 advisory. - USB: serial: omninet: fix reference leaks at open Johan Hovold Orabug: 30484765 CVE-2017-8925 - x8632, entry: Store badsys error code in %eax Sve...
Microsoft OneDrive Elevation of Privilege (CVE-2020-1465)
The version of Microsoft OneDrive installed on the remote Windows host is prior to 20.084.0426.0007. It is, therefore, affected by an elevation of privilege vulnerability that allows file deletion in arbitrary locations. To exploit the vulnerability, an attacker would first have to log on to the...
Fedora 32 : python3 (2020-98e0f0f11b)
Python 3.8.3 This is the third maintenance release of Python 3.8. See the changelog for details. Contains the security fix for CVE-2020-8492. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to...
CentOS 7 : thunderbird (RHSA-2020:1489)
The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1489 advisory. - Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after- free. We are aware of targeted attacks in t...
RHEL 6 : kernel (RHSA-2020:0790)
The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0790 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: buffer overflow in...
Debian DSA-4603-1 : thunderbird - security update
Multiple security issues have been found in Thunderbird which could potentially result in the execution of arbitrary code or information disclosure. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-4603. The...
RHEL 7 : qemu-kvm-ma (RHSA-2019:3968)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:3968 advisory. Kernel-based Virtual Machine KVM is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-ma packages provide the...
macOS : Apple Safari < 12.1.2 Multiple Vulnerabilities
The version of Apple Safari installed on the remote macOS or Mac OS X host is prior to 12.1.2 It is, therefore, affected by multiple vulnerabilities in the following components : - Safari - WebKit C Tenable Network Security, Inc. include'compat.inc'; if description scriptid128178;...
Ubuntu 16.04 LTS : Linux kernel (HWE) vulnerabilities (USN-3981-2)
The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3981-2 advisory. USN-3981-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04 LTS. This update provides the corresponding updates for the Linux Hardware Enableme...
Security Updates for Internet Explorer (January 2019)
The Internet Explorer installation on the remote host is missing a security update. It is, therefore, affected by the following vulnerability : - A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input. An attacker could execute arbitrary code in...
Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2018-4270)
The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-4270 advisory. - scsi: sg: mitigate read/write abuse Jann Horn Orabug: 28824731 CVE-2017-13168 - infiniband: fix a possible use-after-free bug Cong Wang Orabug:...
lighttpd < 1.4.28 Insecure Temporary File Creation
According to its banner, the version of lighttpd running on the remote host is prior to 1.4.28. Therefore, it may be, affected by the following vulnerability : - The configuration file for the FastCGI PHP support for lighttpd before 1.4.28 on Debian GNU/Linux creates a socket file with a...
SUSE SLES11 Security Update : kernel (SUSE-SU-2017:3265-1) (KRACK)
The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes. The following security bugs were fixed : - CVE-2017-16649: The usbnetgenericcdcbind function in drivers/net/usb/cdcether.c in the Linux kernel allowed local users to cause a denial of service...
FreeBSD : mozilla -- multiple vulnerabilities (96eca031-1313-4daf-9be2-9d6e1c4f1eb5)
Mozilla Foundation reports : Please reference CVE/URL list for details %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2019 Jacques Vidrine and contributors Redistribution a...
Amazon Linux AMI : mysql51 (ALAS-2017-800)
It was discovered that the MySQL logging functionality allowed writing to MySQL configuration files. An administrative database user, or a database user with FILE privileges, could possibly use this flaw to run arbitrary commands with root privileges on the system running the database server...
Google Chrome < 52.0.2743.82 Multiple Vulnerabilities
The version of Google Chrome installed on the remote Windows host is prior to 52.0.2743.82. It is, therefore, affected by multiple vulnerabilities as referenced in the 201607stable-channel-update advisory. - The PPAPI implementation in Google Chrome before 52.0.2743.82 does not validate the origi...
PHP 5.6.x < 5.6.24 Multiple Vulnerabilities (httpoxy)
According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.24. It is, therefore, affected by multiple vulnerabilities : - A man-in-the-middle vulnerability exists, known as 'httpoxy', due to a failure to properly resolve namespace conflicts in accordance wi...
SUSE SLES11 Security Update : glibc (SUSE-SU-2014:1122-1)
This glibc update fixes a critical privilege escalation vulnerability and the following security and non-security issues : - bnc892073: An off-by-one error leading to a heap-based buffer overflow was found in gconvtranslitfind. An exploit that targets the problem is publicly available...
ManageEngine NetFlow Analyzer Default Credentials
The remote ManageEngine NetFlow Analyzer web administration interface uses a known set of default credentials. An attacker can use these to gain access to the system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...
SuSE 11.3 Security Update : IBM Java (SAT Patch Number 9615)
java-160-ibm has been updated to fix ten security issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from SuSE 11 update information. The text itself is copyright C Novell, Inc. if NASLLEVEL 3000 exit0;...
RHEL 5 : kernel (RHSA-2009:1672)
Updated kernel packages that fix multiple security issues and one bug are now available for Red Hat Enterprise Linux 5.2 Extended Update Support. This update has been rated as having important security impact by the Red Hat Security Response Team. The kernel packages contain the Linux kernel, the...