Jenkins Accessible without Credentials

The remote web server hosts Jenkins, a job scheduling / management system and a drop-in replacement for Hudson. By allowing unauthenticated access to the application, anyone may be able to configure Jenkins and jobs, and perform builds. Additionally, this script checks for unauthenticated access ...

Scientific Linux Security Update : kernel on SL5.x i386/x86_64 (20130122)

This update fixes the following security issues : - It was found that the Xen hypervisor implementation did not perform range checking on the guest provided values in multiple hypercalls. A privileged guest user could use this flaw to trigger long loops, leading to a denial of service Xen...

SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 8325)

This Linux kernel update fixes various security issues and bugs in the SUSE Linux Enterprise 10 SP4 kernel. The following security issues have been fixed : - kernel/taskstats.c in the Linux kernel allowed local users to obtain sensitive I/O statistics by sending taskstats commands to a netlink...

Debian DSA-2553-1 : iceweasel - several vulnerabilities

Several vulnerabilities have been discovered in Iceweasel, a web browser based on Firefox. The included XULRunner library provides rendering services for several other applications included in Debian. The reported vulnerabilities could lead to the execution of arbitrary code or the bypass of...

Scientific Linux Security Update : postgresql on SL3.x, SL4.x, SL5.x i386/x86_64

PostgreSQL is an advanced object-relational database management system DBMS. PL/Perl and PL/Tcl allow users to write PostgreSQL functions in the Perl and Tcl languages, and are installed in trusted mode by default. In trusted mode, certain operations, such as operating system level access, are...

Scientific Linux Security Update : seamonkey on SL4.x i386/x86_64

An integer overflow flaw was found in the way SeaMonkey displayed certain web content. A malicious website could cause SeaMonkey to crash or execute arbitrary code with the permissions of the user running SeaMonkey. CVE-2008-2785 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptiv...

RHEL 5 : java-1.4.2-ibm (RHSA-2010:0935)

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2010:0935 advisory. - krb5: null pointer dereference in GSS-API library leads to DoS MITKRB5-SA-2010-005 CVE-2010-1321 - OpenJDK HttpURLConnection incomplete...

MS10-026: Vulnerability in Microsoft MPEG Layer-3 Codecs Could Allow Remote Code Execution (977816)

The Microsoft MPEG Layer-3 MP3 codecs have a buffer overflow vulnerability that is triggered by opening a specially crafted AVI file with an MP3 audio stream. A remote attacker could exploit this by tricking a user into opening a malicious AVI file, which would lead to arbitrary code execution. C...

RHEL 4 / 5 : java-1.5.0-sun (RHSA-2009:1199)

Updated java-1.5.0-sun packages that correct several security issues are now available for Red Hat Enterprise Linux 4 Extras and 5 Supplementary. This update has been rated as having critical security impact by the Red Hat Security Response Team. The Sun 1.5.0 Java release includes the Sun Java 5...

Debian DSA-1751-1 : xulrunner - several vulnerabilities

Several remote vulnerabilities have been discovered in Xulrunner, a runtime environment for XUL applications, such as the Iceweasel web browser. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-0771 Martijn Wargers, Jesse Ruderman and Josh Soref...

PHP 8.0.x < 8.0.25 Multiple Vulnerabilities

The version of PHP installed on the remote host is prior to 8.0.25. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.0.25 advisory. - The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allow...

Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel (OEM) vulnerability (USN-5545-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-5545-1 advisory. Arthur Mongodin discovered that the netfilter subsystem in the Linux kernel did not properly perform data validation. A local attacker could use this ...

Oracle Linux 8 : java-17-openjdk (ELSA-2022-5726)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-5726 advisory. 1:17.0.4.0.8-0.2.ea - Add rpminspect.yaml to turn off Java bytecode inspections - java-17-openjdk deliberately produces Java 17 bytecode, not the defau...

RHEL 7 : java-1.8.0-openjdk (RHSA-2022:1487)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:1487 advisory. The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security...

VMware vCenter Log4Shell Direct Check (CVE-2021-44228) (VMSA-2021-0028)

Binary data vmwarevcenterlog4shell.nbin...

KB5007255: Windows 8.1 and Windows Server 2012 R2 Security Update (November 2021)

The remote Windows host is missing security update 5007255 or cumulative update 5007247. It is, therefore, affected by multiple vulnerabilities: - A denial of service DoS vulnerability. An attacker can exploit this issue to cause the affected component to deny system or application services...

openSUSE 15 Security Update : kernel (openSUSE-SU-2021:2415-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:2415-1 advisory. - A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/xtables.c. This allows an attacker to gain...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2021-9215)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9215 advisory. - btrfs: fix race when cloning extent buffer during rewind of an old root Filipe Manana Orabug: 32669454 CVE-2021-28964 - xen-blkback: don't leak...

CentOS 7 : java-1.8.0-openjdk (RHSA-2021:1298)

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:1298 advisory. - Vulnerability in the Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. Supported versions that are...

Oracle Linux 8 : python3 (ELSA-2021-9100)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-9100 advisory. 3.6.8-31.0.3 - Fix buffer overflow in PyCArgrepr Orabug: 32551171CVE-2021-3177 Tenable has extracted the preceding description block directly from the Oracle...

RHEL 6 : Red Hat JBoss Enterprise Application Platform 7.3.5 (RHSA-2021:0246)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0246 advisory. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release o...

Ubuntu 20.04 LTS : Linux kernel (OEM) vulnerability (USN-4683-1)

The remote Ubuntu 20.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4683-1 advisory. Minh Yuan discovered that the framebuffer console driver in the Linux kernel did not properly handle fonts in some conditions. A local attacker could use this to...

RHEL 7 : grub2 (RHSA-2020:3276)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3276 advisory. The grub2 packages provide version 2 of the Grand Unified Boot Loader GRUB, a highly configurable and customizable boot loader with modular...

Fedora 32 : python3 (2020-98e0f0f11b)

Python 3.8.3 This is the third maintenance release of Python 3.8. See the changelog for details. Contains the security fix for CVE-2020-8492. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to...

Slackware 14.2 / current : mozilla-firefox (SSA:2020-094-01)

New mozilla-firefox packages are available for Slackware 14.2 and -current to fix security issues. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2020-094-01. The text itself is copyright C Slackware Linux,...

KB4532693: Windows 10 Version 1903 and Windows 10 Version 1909 February 2020 Security Update

The remote Windows host is missing security update 4532693. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server. An attacker who successfully exploited this...

RHEL 7 : qemu-kvm-ma (RHSA-2019:3968)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:3968 advisory. Kernel-based Virtual Machine KVM is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-ma packages provide the...

Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2018-4270)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-4270 advisory. - scsi: sg: mitigate read/write abuse Jann Horn Orabug: 28824731 CVE-2017-13168 - infiniband: fix a possible use-after-free bug Cong Wang Orabug:...

SUSE SLES11 Security Update : kernel (SUSE-SU-2017:3265-1) (KRACK)

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes. The following security bugs were fixed : - CVE-2017-16649: The usbnetgenericcdcbind function in drivers/net/usb/cdcether.c in the Linux kernel allowed local users to cause a denial of service...

FreeBSD : mozilla -- multiple vulnerabilities (96eca031-1313-4daf-9be2-9d6e1c4f1eb5)

Mozilla Foundation reports : Please reference CVE/URL list for details %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2019 Jacques Vidrine and contributors Redistribution a...

openSUSE Security Update : the Linux Kernel (openSUSE-2016-1076)

The openSUSE Leap 42.1 kernel was updated to 4.1.31 to receive various security and bugfixes. The following security bugs were fixed : - CVE-2016-2847: fs/pipe.c in the Linux kernel did not limit the amount of unread data in pipes, which allowed local users to cause a denial of service memory...

Amazon Linux AMI : java-1.6.0-openjdk (ALAS-2015-616)

Multiple flaws were discovered in the CORBA, Libraries, RMI, Serialization, and 2D components in OpenJDK. An untrusted Java application or applet could use these flaws to completely bypass Java sandbox restrictions. CVE-2015-4835 , CVE-2015-4881 , CVE-2015-4843 , CVE-2015-4883 , CVE-2015-4860 ,...

RHEL 6 : kernel-rt (RHSA-2015:0694)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:0694 advisory. The kernel-rt packages contain the Linux kernel, the core of any Linux operating system. A flaw was found in the way the Linux kernel's XFS...

Oracle Linux 4 : glibc (ELSA-2015-0101) (GHOST)

From Red Hat Security Advisory 2015:0101 : Updated glibc packages that fix one security issue are now available for Red Hat Enterprise Linux 4 Extended Life Cycle Support. Red Hat Product Security has rated this update as having Critical security impact. A Common Vulnerability Scoring System CVSS...

Ubuntu 10.04 LTS : linux vulnerabilities (USN-2441-1)

An information leak in the Linux kernel was discovered that could leak the high 16 bits of the kernel stack address on 32-bit Kernel Virtual Machine KVM paravirt guests. A user in the guest OS could exploit this leak to obtain information that could potentially be used to aid in attacking the...

Scientific Linux Security Update : php53 on SL5.x i386/x86_64 (20120627)

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was discovered that the PHP XSL extension did not restrict the file writing capability of libxslt. A remote attacker could use this flaw to create or overwrite an arbitrary file that is writable by the user...

PCI DSS Compliance : Database Reachable from the Internet

The remote host is running a database server that is reachable from the Internet. This violates PCI DSS, section 1.3.7. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid57581; scriptversion"1.13"; scriptsetattributeattribute:"pluginmodificationdate", value:"2020/04/27"...

Fedora 14 : firefox-3.6.12-1.fc14 / galeon-2.0.7-35.fc14.1 / gnome-python2-extras-2.25.3-25.fc14.1 / etc (2010-16897)

Update to new upstream Firefox version 3.6.12, fixing multiple security issues detailed in the upstream advisories : - http://www.mozilla.org/security/known-vulnerabilities/fi refox36.htmlfirefox3.6.11 - http://www.mozilla.org/security/known-vulnerabilities/ firefox36.htmlfirefox3.6.12 Update als...

RHEL 8 : httpd:2.4 (RHSA-2024:4720)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:4720 advisory. The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: Encoding problem...

Canonical Ubuntu Linux SEoL (18.04.x)

According to its version, Canonical Ubuntu Linux is 18.04.x. It is, therefore, no longer maintained by its vendor or provider. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it may contain security vulnerabilities. %NASLMINLEVEL...

RHEL 7 / 8 : Red Hat JBoss Web Server 5.6.2 Security Update (Important) (RHSA-2022:1519)

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:1519 advisory. Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache...

openSUSE 15 Security Update : kernel (openSUSE-SU-2022:1037-1)

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:1037-1 advisory. The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: -...

RHEL 6 : polkit (RHSA-2022:0269)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:0269 advisory. The polkit packages provide a component for controlling system-wide privileges. This component provides a uniform and organized way for non-privilege...

VMware Horizon Log4Shell Direct Check (CVE-2021-44228) (VMSA-2021-0028)

Binary data vmwarehorizonlog4shell.nbin...

CentOS 8 : kernel-rt (CESA-2021:4646)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4646 advisory. - kernel: timer tree corruption leads to missing wakeup and system freeze CVE-2021-20317 - kernel: Insufficient validation of user-supplied sizes for t...

RHEL 8 : postgresql:12 (RHSA-2021:2372)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2372 advisory. PostgreSQL is an advanced object-relational database management system DBMS. The following packages have been upgraded to a later upstream...

OracleVM 3.4 : kernel-uek (OVMSA-2021-0005)

The remote OracleVM system is missing necessary patches to address security updates: - An issue was found in Linux kernel before 5.5.4. The mwifiexcmdappendvsietlv function in drivers/net/wireless/marvell/mwifiex/scan.c allows local users to gain privileges or cause a denial of service because of...

RHEL 8 : libpq (RHSA-2020:5638)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5638 advisory. The libpq package provides the PostgreSQL client library, which allows client programs to connect to PostgreSQL servers. The following...

Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2020-5936)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-5936 advisory. - USB: serial: omninet: fix reference leaks at open Johan Hovold Orabug: 30484765 CVE-2017-8925 - x8632, entry: Store badsys error code in %eax Sve...

RHEL 7 : java-1.8.0-openjdk (RHSA-2020:2968)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2968 advisory. The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security...