Alcatel OmniSwitch Default Credentials (ftp)

It is possible to log into the remote Alcatel OmniSwitch by providing the default credentials via FTP. A remote attacker could exploit this to gain administrative control of the remote device. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid70210;...

Oracle Linux 6 : thunderbird (ELSA-2012-1089)

The remote Oracle Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2012-1089 advisory. 10.0.6-1.0.1.el63 - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js - Replace clean.gif in tarball 10.0.6-1 -...

RHEL 5 / 6 : firefox (RHSA-2012:1210)

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:1210 advisory. - Mozilla: Miscellaneous memory safety hazards rv:15.0/ rv:10.0.7 MFSA 2012-57 CVE-2012-1970 - Mozilla: Multiple Use-after-free issues...

Scientific Linux Security Update : firefox on SL4.x, SL5.x i386/x86_64

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code as the user running Firefox. CVE-2008-0017, CVE-2008-5014, CVE-2008-5016, CVE-2008-5017, CVE-2008-5018, CVE-2008-5019,...

Mozilla Thunderbird 10.0.x < 10.0.6 Multiple Vulnerabilities

The installed version of Thunderbird 10.0.x is potentially affected by the following security issues : - Several memory safety issues exist, some of which could potentially allow arbitrary code execution. CVE-2012-1948 - Several memory safety issues exist related to the Gecko layout engine...

RHEL 6 : java-1.7.0-oracle (RHSA-2012:1019)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:1019 advisory. The Oracle Java 7 release includes the Oracle Java 7 Runtime Environment and the Oracle Java 7 Software Development Kit. This update fixes...

Thunderbird < 13.0 Multiple Vulnerabilities (Mac OS X)

The installed version of Thunderbird is earlier than 13.0 and thus, is potentially affected by the following security issues : - An error exists in the ASN.1 decoder when handling zero length items that can lead to application crashes. CVE-2012-0441 - Multiple memory corruption errors exist...

SuSE 10 Security Update : IBM Java 1.6.0 (ZYPP Patch Number 8100)

IBM Java 1.5.0 has been updated to SR13-FP1, fixing various security issues. More information can be found on : http://www.ibm.com/developerworks/java/jdk/alerts/ %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. if NASLLEVEL 3000 exit0;...

USN-1164-1 : linux-fsl-imx51 vulnerabilities

Thomas Pollet discovered that the RDS network protocol did not check certain iovec buffers. A local attacker could exploit this to crash the system or possibly execute arbitrary code as the root user. CVE-2010-3865 Dan Rosenberg discovered that the CAN protocol on 64bit systems did not correctly...

CGI Generic Command Execution (time-based, intrusive)

The remote web server hosts CGI scripts that seem to fail to adequately sanitize request strings. By leveraging this issue, an attacker may be able to execute arbitrary commands on the remote host. Note that : - This script uses a time-based detection method that is less reliable than the basic...

Sun Java Web Console helpwindow.jsp / masthead.jsp Multiple XSS

The version of Sun Java Web Console running on the remote host has multiple cross-site scripting vulnerabilities in 'helpwindow.jsp' and 'masthead.jsp'. A remote attacker could exploit these to trick a user into executing arbitrary HTML or script code in the context of the web server. %NASLMINLEV...

Aborior Encore WebForum display.cgi file Parameter Command Execution

The remote host is running the Aborior Web Forum. There is a flaw in this version that could allow an attacker to execute arbitrary commands on this server with the privileges of the affected web server. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...

KB5040434: Windows 10 Version 1607 / Windows Server 2016 Security Update (July 2024)

The remote Windows host is missing security update 5040434. It is, therefore, affected by multiple vulnerabilities - RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response Access-Accept, Access-Reject, or Access-Challenge to any othe...

RHEL 6 : openssh (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - openssh: loading of untrusted PKCS11 modules in ssh-agent CVE-2016-10009 - openssh: scp allows command...

Oracle MySQL Server 8.0.x < 8.0.37 (January 2025 CPU)

The versions of MySQL Server installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2025 CPU advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Packaging OpenSSL. Supported versions that are affected are 8.0.36 and...

Slackware Linux 15.0 / current mariadb Multiple Vulnerabilities (SSA:2022-228-01)

The version of mariadb installed on the remote host is prior to 10.5.17 / 10.6.9. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2022-228-01 advisory. - zlib before 1.2.12 allows memory corruption when deflating i.e., when compressing if the input has many distant...

Debian DSA-5207-1 : linux - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5207 advisory. Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. CVE-2022-2585 A...

RHEL 7 : kernel (RHSA-2022:5802)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:5802 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: a use-after-free write in the netfilter...

RHEL 7 : kernel (RHSA-2022:5157)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5157 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: cgroups v1 releaseagent featur...

nginx R8 < R18-P1 Multiple Vulnerabilities

According to its self reported version, the installed version of Nginx Plus is R8 built on Open Source version 1.9.9 prior to R18-P1 built on Open Source version 1.15.10. It is, therefore, affected by multiple denial of service vulnerabilities : - A denial of service vulnerability exists in the...

IBM Java 7.0 < 7.0.11.5 / 7.1 < 7.1.5.5 / 8.0 < 8.0.7.5 Multiple Vulnerabilities

The version of IBM Java installed on the remote host is prior to 7.0 7.0.11.5 / 7.1 7.1.5.5 / 8.0 8.0.7.5. It is, therefore, affected by multiple vulnerabilities as referenced in the Oracle January 18 2022 CPU advisory. - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition...

IBM Java 6.0 < 6.0.16.55 / 6.1 < 6.1.8.55 / 7.0 < 7.0.15.5 / 7.1 < 7.1.5.5 / 8.0 < 8.0.5.5 Multiple Vulnerabilities

The version of IBM Java installed on the remote host is prior to 6.0 6.0.16.55 / 6.1 6.1.8.55 / 7.0 7.0.15.5 / 7.1 7.1.5.5 / 8.0 8.0.5.5. It is, therefore, affected by multiple vulnerabilities as referenced in the Oracle October 17 2017 CPU advisory. - inffast.c in zlib 1.2.8 might allow...

EulerOS 2.0 SP8 : httpd (EulerOS-SA-2022-1569)

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP...

CentOS 7 : httpd (RHSA-2022:1045)

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:1045 advisory. - Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP...

Amazon Linux 2 : cyrus-sasl (ALAS-2022-1758)

The version of cyrus-sasl installed on the remote host is prior to 2.1.26-24. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1758 advisory. A flaw was found in the SQL plugin shipped with Cyrus SASL. Failure to properly escape the SQL input allows a remote attacker ...

AlmaLinux 8 : libxml2 (ALSA-2021:2569)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:2569 advisory. - There's a flaw in libxml2's xmllint in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by xmllint could trigger...

Oracle Linux 7 : bootstrap (ELSA-2021-9400)

The remote Oracle Linux 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2021-9400 advisory. 3.0.0-7.0.1 - Backport jQuery CVE-2020-11023 fixes from jQuery v3.5.0 to bundled v1.10.2 Orabug: 33181852 Tenable has extracted the preceding description block...

IBM HTTP Server 7.0.0.0 < 7.0.0.45 / 8.0.0.0 < 8.0.0.14 / 8.5.0.0 < 8.5.5.12 / 9.0.0.0 < 9.0.0.5 Multiple Vulnerabilities (563615)

The version of IBM HTTP Server running on the remote host is affected by multiple vulnerabilities related to Apache HTTP Server, as follows: - In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, modmime can read one byte past the end of a buffer when sending a malicious Content-Type...

RHEL 8 : java-1.8.0-openjdk (RHSA-2020:4347)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4347 advisory. The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security...

Debian DLA-2221-1 : sqlite3

An integer overflow vulnerability was found in the sqlite3strvappendf function of the src/printf.c file of sqlite3 from version 3.8.3. For Debian 8 'Jessie', this problem has been fixed in version 3.8.7.1-1+deb8u6. We recommend that you upgrade your sqlite3 packages. NOTE: Tenable Network Securit...

Amazon Linux AMI : php72 (ALAS-2020-1367)

The version of php72 installed on the remote host is prior to 7.2.30-1.22. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1367 advisory. In PHP versions 7.2.x below 7.2.9, 7.3.x below 7.3.16 and 7.4.x below 7.4.34, while parsing EXIF data with exifreaddata...

EulerOS 2.0 SP8 : kernel (EulerOS-SA-2020-1508)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In f2fsxattrgenericlist of xattr.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information...

RHEL 7 : kernel-alt (RHSA-2020:0740)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0740 advisory. The kernel-alt packages provide the Linux kernel version 4.x. Security Fixes: kernel: rtlp2pnoaie in drivers/net/wireless/realtek/rtlwifi/ps...

EulerOS 2.0 SP5 : libtiff (EulerOS-SA-2019-2209)

According to the versions of the libtiff packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The TIFFFax3fillruns function in libtiff before 4.0.6 allows remote attackers to cause a denial of service divide-by-zero error and application...

openSUSE Security Update : python (openSUSE-2019-1989)

This update for python fixes the following issues : - CVE-2018-20852: Fixed an information leak where cookies could be send to the wrong server because of incorrect domain validation bsc1141853. This update was imported from the SUSE:SLE-15:Update update project. C Tenable Network Security, Inc...

Debian DLA-1829-1 : firefox-esr security update

Samuel Gross discovered a type confusion bug in the JavaScript engine of the Mozilla Firefox web browser, which could result in the execution of arbitrary code when browsing a malicious website. For Debian 8 'Jessie', this problem has been fixed in version 60.7.1esr-1deb8u1. We recommend that you...

openSUSE Security Update : webkit2gtk3 (openSUSE-2019-1374)

This update for webkit2gtk3 to version 2.24.1 fixes the following issues : Security issues fixed : - CVE-2019-6201, CVE-2019-6251, CVE-2019-7285, CVE-2019-7292, CVE-2019-8503, CVE-2019-8506, CVE-2019-8515, CVE-2019-8518, CVE-2019-8523, CVE-2019-8524, CVE-2019-8535, CVE-2019-8536, CVE-2019-8544,...

RHEL 6 : ntp (RHSA-2018:3854)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:3854 advisory. - ntp: Stack-based buffer overflow in ntpq and ntpdc allows denial of service or code execution CVE-2018-12327 Note that Nessus has not tested for th...

Scientific Linux Security Update : thunderbird on SL7.x x86_64 (20181105)

This update upgrades Thunderbird to version 60.2.1. Security Fixes : - Mozilla: Memory safety bugs fixed in Firefox 62 and Firefox ESR 60.2 CVE-2018-12376 - Mozilla: Use-after-free in driver timers CVE-2018-12377 - Mozilla: Use-after-free in IndexedDB CVE-2018-12378 - Mozilla: Proxy bypass using...

RHEL 7 : kernel (RHSA-2018:3590)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3590 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: A flaw named FragmentSmack was found i...

F5 Networks BIG-IP : Oracle Java SE vulnerability (K15217245)

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE subcomponent: Serialization. Supported versions that are affected are Java SE: 6u181, 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attack...

EulerOS Virtualization 2.5.0 : kernel (EulerOS-SA-2018-1232)

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The Salsa20 encryption algorithm in the Linux kernel before 4.14.8 does not correctly handle zero-length inputs, allowing a local...

Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-3631-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3631-1 advisory. It was discovered that a buffer overread vulnerability existed in the keyring subsystem of the Linux kernel. A local attacker could possibly use this to...

EulerOS 2.0 SP1 : kernel (EulerOS-SA-2018-1054)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In the Linux kernel 4.12, 3.10, 2.6 and possibly earlier versions a race condition vulnerability exists in the sound system, this can lead to a...

Fedora 27 : webkitgtk4 (2018-0590e4af13) (Spectre)

This update includes improvements to mitigate the effects of Spectre CVE-2017-5753 and CVE-2017-5715 : - Disable SharedArrayBuffers from Web API. - Reduce the precision of high resolution time to 1ms. Additional fixes : - Fix API documentation generation with newer gtk-doc. Note that Tenable...

Debian DSA-4037-1 : jackson-databind - security update

It was discovered that jackson-databind, a Java library used to parse JSON and other data formats, improperly validated user input prior to deserializing: following DSA-4004-1 for CVE-2017-7525, an additional set of classes was identified as unsafe for deserialization. %NASLMINLEVEL 70300 C Tenab...

SUSE SLES12 Security Update : kernel (SUSE-SU-2017:2437-1)

This update for the Linux Kernel 3.12.69-606429 fixes several issues. The following security bugs were fixed : - CVE-2017-1000112: Prevent a race condition in net-packet code that could have been exploited by unprivileged users to gain root access bsc1052368. Note that Tenable Network Security ha...

EulerOS 2.0 SP1 : graphite2 (EulerOS-SA-2017-1152)

According to the versions of the graphite2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Various vulnerabilities have been discovered in Graphite2. An attacker able to trick an unsuspecting user into opening specially crafted font...

IBM MQ Unsupported Version Detection (credentialed check)

According to its self-reported version number, the installation of IBM MQ formerly IBM WebSphere MQ on the remote Windows host is no longer supported. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security...

Ubuntu 16.10 : linux, linux-raspi2 vulnerability (USN-3251-1)

It was discovered that the xfrm framework for transforming packets in the Linux kernel did not properly validate data received from user space. A local attacker could use this to cause a denial of service system crash or execute arbitrary code with administrative privileges. Note that Tenable...