EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1487)

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - It was found that the Linux kernel's implementation of vectored pipe read and write functionality did not take into account the I...

Photon OS 1.0: Linux PHSA-2017-0001

An update of the linux package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2017-0001. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid121664;...

CentOS 6 : firefox (CESA-2018:1414)

An update for firefox is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

Exim < 4.89.1 Use-After-Free BDAT Remote Code Execution

According to its banner and supported extensions, the remote installation of Exim is affected by a code execution flaw. The implementation of the BDAT SMTP verb for sending large binary messages introduced in Exim 4.88 can incorrectly free an in-use region of memory, leading to memory corruption...

Security Update for Microsoft SharePoint Server (June 2017)

The Microsoft SharePoint Server installed on the remote Windows host is missing a security update. It is, therefore, affected by multiple vulnerabilities : - Multiple remote code execution vulnerabilities exist in Microsoft Office due to improper handling of objects in memory. An unauthenticated,...

EulerOS 2.0 SP2 : java-1.8.0-openjdk (EulerOS-SA-2017-1016)

According to the versions of the java-1.8.0-openjdk packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - It was discovered that the RMI registry and DCG implementations in the RMI component of OpenJDK performed deserialization of untrust...

Citrix XenServer Multiple Vulnerabilities (CTX220112)

The version of Citrix XenServer running on the remote host is missing a security hotfix. It is, therefore, affected by the following vulnerabilities : - A man-in-the-middle MitM vulnerability exists in the NTP component due to an improperly implemented threshold limitation for the '-g' option. A...

Fedora 21 : xen-4.4.3-8.fc21 (2015-f150b2a8c8)

x86: CPU lockup during exception delivery XSA-156, CVE-2015-5307, CVE-2015-8104 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without...

Debian DLA-177-1 : openssl security update

Multiple vulnerabilities have been discovered in OpenSSL, a Secure Sockets Layer toolkit. The Common Vulnerabilities and Exposures project identifies the following issues : CVE-2015-0209 It was discovered that a malformed EC private key might result in memory corruption. CVE-2015-0286 Stephen...

CUCM IM and Presence Service GNU Bash Environment Variable Handling Command Injection (CSCur05454) (Shellshock)

According to its self-reported version, the CUCM IM and Presence Service installed on the remote host contains a version of GNU Bash that is affected by a command injection vulnerability known as Shellshock, which is due to the processing of trailing strings after function definitions in the valu...

Oracle Linux 5 / 6 : unbreakable enterprise kernel (ELSA-2014-3054)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-3054 advisory. - filter: prevent nla extensions to peek beyond the end of the message Mathias Krause Orabug: 19315783 CVE-2014-3144 CVE-2014-3145 - futex: Forbid...

Fedora 20 : stunnel-5.01-1.fc20 (2014-5321)

New upstream release Supports OpenSSL DLLs 1.0.1g. Fixes to take care of OpenSSL,s TLS heartbeat read overrun CVE-2014-0160. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean an...

SAP Host Agent SOAP Web Service Information Disclosure (SAP Note 1816536)

The version of SAP Host Agent discloses sensitive system information, such as operating system version, databases version, CPU make and model, and information on network interfaces. A remote, unauthenticated attacker could use this to specialize attacks. %NASLMINLEVEL 70300 C Tenable Network...

Fedora 20 : kernel-3.11.10-301.fc20 (2013-22818)

Fixes for SELinux issues and crashes related to bigkey krb functionality. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...

Alcatel OmniSwitch Default Credentials (ftp)

It is possible to log into the remote Alcatel OmniSwitch by providing the default credentials via FTP. A remote attacker could exploit this to gain administrative control of the remote device. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid70210;...

Solaris 10 (sparc) : 150383-19 (deprecated)

SunOS 5.10: wanboot patch. Date this patch was last updated by Sun : Aug/13/17 This plugin has been deprecated and either replaced with individual 150383 patch-revision plugins, or deemed non-security related. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. @DEPRECATED@ Disabled on 2018/03/1...

Mandriva Linux Security Advisory : php (MDVSA-2011:165)

Multiple vulnerabilities has been identified and fixed in php : Use-after-free vulnerability in the substrreplace function in PHP 5.3.6 and earlier allows context-dependent attackers to cause a denial of service memory corruption or possibly have unspecified other impact by using the same variabl...

Fedora 13 : thunderbird-3.1.7-2.fc13 (2010-18778)

Update to new upstream Thunderbird version 3.1.7, fixing multiple security issues detailed in the upstream advisory : http://www.mozilla.org/security/known-vulnerabilities/thunderbird31.ht mlthunderbird3.1.7 Note that Tenable Network Security has extracted the preceding description block directly...

Debian DSA-2018-1 : php5 - DoS (crash)

Auke van Slooten discovered that PHP 5, an hypertext preprocessor, crashes because of a NULL pointer dereference when processing invalid XML-RPC requests. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Securit...

CentOS 5 : firefox (CESA-2008:0569)

Updated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. Mozilla Firefox is an open source Web browser. Multiple flaws were found in the processi...

openSUSE Security Update : java-1_6_0-openjdk (java-1_6_0-openjdk-1330)

This update of java-160-openjdk fixes the following issues : - CVE-2009-2670: OpenJDK Untrusted applet System properties access - CVE-2009-2671,CVE-2009-2672: OpenJDK Proxy mechanism information leaks - CVE-2009-2673: OpenJDK proxy mechanism allows non-authorized socket connections - CVE-2009-267...

PHP < 5.2.11 Multiple Vulnerabilities

According to its banner, the version of PHP installed on the remote host is older than 5.2.11. Such versions may be affected by several security issues : - An unspecified error occurs in certificate validation inside 'phpopensslapplyverificationpolicy'. - An unspecified input validation...

Slackware 12.0 / 12.1 / 12.2 / current : httpd (SSA:2009-214-01)

New httpd packages are available for Slackware 12.0, 12.1, 12.2, and -current to fix security issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2009-214-01. The text itself is copyrig...

RHEL 8 : kernel (RHSA-2024:3138)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:3138 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: For more details about the security...

CentOS 7 : openssh (RHSA-2023:4382)

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:4382 advisory. - The PKCS11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forward...

Oracle Linux 9 : openssl (ELSA-2022-6224)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-6224 advisory. - CVE-2022-2097: AES OCB fails to encrypt some bytes on 32-bit x86 Resolves: CVE-2022-2097 - CVE-2022-2068: the crehash script allows command injection...

Oracle E-Business Suite (Jul 2022 CPU)

The versions of Oracle E-Business Suite installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2022 CPU advisory. - Vulnerability in the Oracle E-Business Suite Information Discovery product of Oracle E-Business Suite component: Packaging issues Apache...

Microsoft Edge (Chromium) < 103.0.1264.49 Vulnerability

The version of Microsoft Edge installed on the remote Windows host is prior to 103.0.1264.49. It is, therefore, affected by a vulnerability as referenced in the July 6, 2022 advisory. - Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentiall...

Oracle Linux 7 : Unbreakable Enterprise kernel-container (ELSA-2022-9427)

The remote Oracle Linux 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2022-9427 advisory. 4.14.35-2047.513.2.2.el7 - debug: Lock down kgdb Stephen Brennan Orabug: 34152700 CVE-2022-21499 Tenable has extracted the preceding description block directly...

SUSE SLES12: libjavascriptcoregtk-4_0-18 / libwebkit2gtk-4_0-37 / etc (SUSE-SU-2022:0690-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0690-1 advisory. Update to version 2.34.5 bsc1195735: - CVE-2022-22589: A validation issue was addressed with improved input sanitization. -...

AlmaLinux 8 : pcs (ALSA-2021:4142)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:4142 advisory. - jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove HTML tags that contain a...

SSH Host Keys < 2048 Bits Considered Weak

Brute force setting must be enabled to use this plugin. The remote SSH server has a host key size that is smaller than 2048 bits. NIST Special Publication 800-57 Part 3 Recommendation for Key Management recommends RSA keys greater or equal to 2048 bits in length. TRUSTED...

SUSE SLES15 Security Update : nodejs14 (SUSE-SU-2021:3211-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3211-1 advisory. - CVE-2021-3672: Fixed missing input validation on hostnames bsc1188881. - CVE-2021-22931: Fixed improper handling of untypical characters in...

Oracle Linux 8 : qt5-qtbase / and / qt5-qtwebsockets (ELSA-2020-4690)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4690 advisory. qt5-qtbase 5.12.5-6 - OpenSSL: handle SSLshutdowns errors properly Resolves: bz1851538 5.12.5-5 - Fix: Files placed by attacker can influence the worki...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Intel Microcode vulnerabilities (USN-4628-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4628-1 advisory. Moritz Lipp, Michael Schwarz, Andreas Kogler, David Oswald, Catherine Easdon, Claudio Canella, and Daniel Gruss discovered that t...

RHEL 8 : bind (RHSA-2020:2338)

"The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2338 advisory. The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named C...

Fedora 32 : 1:java-1.8.0-openjdk (2020-e418151dc3)

July 2020 OpenJDK security update for OpenJDK 8. Full release notes: https://bitly.com/oj8u262 New features - JDK-8223147: JFR Backport Security fixes - JDK-8028431, CVE-2020-14579: NullPointerException in DerValue.equalsDerValue - JDK-8028591, CVE-2020-14578: NegativeArraySizeException in...

RHEL 7 : python (RHSA-2020:1268)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1268 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...

Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-4186-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4186-1 advisory. Stephan van Schaik, Alyssa Milburn, Sebastian sterlund, Pietro Frigo, Kaveh Razavi, Herbert Bos, Cristiano Giuffrida, Giorgi Maisuradze, Moritz Lipp,...

Apple iOS < 13.2 Multiple Vulnerabilities

Binary data appleios132check.nbin...

Security Updates for Microsoft Office Products (August 2019)

The Microsoft Office Products are missing security updates. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory. An attacker who successfully exploited the...

Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-3849-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3849-1 advisory. It was discovered that a NULL pointer dereference existed in the keyring subsystem of the Linux kernel. A local attacker could use this to cause a denial...

Ubuntu 14.04 LTS / 16.04 LTS : QEMU vulnerabilities (USN-3575-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3575-1 advisory. It was discovered that QEMU incorrectly handled guest ram. A privileged attacker inside the guest could use this issue to cause QEMU to crash...

MySQL 5.5.x < 5.5.58 Multiple Vulnerabilities (RPM Check) (October 2017 CPU)

The version of MySQL running on the remote host is 5.5.x prior to 5.5.58. It is, therefore, affected by multiple vulnerabilities as noted in the October 2017 Critical Patch Update advisory. Please consult the CVRF details for the applicable CVEs for additional information. Note that Nessus has no...

Scientific Linux Security Update : mariadb on SL7.x x86_64 (20170801)

The following packages have been upgraded to a later upstream version: mariadb 5.5.56. Security Fixes : - It was discovered that the mysql and mysqldump tools did not correctly handle database and table names containing newline characters. A database user with privileges to create databases or...

SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2017:1853-1) (Stack Clash)

The SUSE Linux Enterprise 12 SP2 kernel was updated to 4.4.74 to receive various security and bugfixes. The following security bugs were fixed : - CVE-2017-1000365: The Linux Kernel imposes a size restriction on the arguments and environmental strings passed through RLIMITSTACK/RLIMINFINITY 1/4 o...

Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-3055-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3055-1 advisory. Ben Hawkes discovered an integer overflow in the Linux netfilter implementation. On systems running 32 bit kernels, a local unprivileged attacker could u...

openSUSE Security Update : openssl (openSUSE-2016-289) (DROWN)

This update for openssl fixes various security issues : Security issues fixed : - CVE-2016-0800 aka the 'DROWN' attack bsc968046: OpenSSL was vulnerable to a cross-protocol attack that could lead to decryption of TLS sessions by using a server supporting SSLv2 and EXPORT cipher suites as a...

RHEL 6 : kernel (RHSA-2015:1221)

Updated kernel packages that fix multiple security issues, several bugs, and add one enhancement are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give...

RHEL 5 / 6 : java-1.7.0-oracle (RHSA-2014:0413)

Updated java-1.7.0-oracle packages that fix several security issues are now available for Oracle Java for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having Critical security impact. Common Vulnerability Scoring System CVSS base scores, which give...