346627 matches found
Oracle WebLogic Server Deserialization RCE (CVE-2018-2893)
The remote Oracle WebLogic server is affected by a remote code execution vulnerability in the Core Components subcomponent due to unsafe deserialization of Java objects. An unauthenticated, remote attacker can exploit this, via a crafted Java object, to execute arbitrary Java code in the context ...
Apache Tomcat 8.5.0 < 8.5.40 multiple vulnerabilities
The version of Tomcat installed on the remote host is prior to 8.5.40. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat8.5.40security-8 advisory. - When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1...
BigTree CMS index.php SQL Injection
The BigTree CMS install hosted on the remote web server fails to sanitize user-supplied input to the application's 'site/index.php' script before using it in a database query. An unauthenticated attacker may be able to exploit this issue to manipulate database queries, leading to disclosure of...
JQuery UI < 1.13.2 XSS
The version of JQuery UI library hosted on the remote web server is prior to 1.13.2. It is, therefore, affected by a cross-site scripting vulnerability in the JQuery UI that allows remote attackers to inject arbitrary web script or HTML via processing the value of a compromised checkboxradio...
PHP 7.4.x < 7.4.26
The version of PHP installed on the remote host is prior to 7.4.26. It is, therefore, affected by a vulnerability as referenced in the Version 7.4.26 advisory. - In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexmlloadfile,...
Microsoft .NET Core SEoL
According to its version, the Microsoft .NET Core installed on the remote host is no longer maintained by its vendor or provider. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it may contain security vulnerabilities. %NASLMINLEVE...
Microsoft IIS 6.0 PHP NTFS Stream Authentication Bypass
The version of Microsoft IIS installed on the remote host is affected by an authentication bypass vulnerability. It is possible to access PHP files in protected web directories without authentication by appending '::$INDEXALLOCATION' to the directory name. %NASLMINLEVEL 70300 C Tenable Network...
Apache 2.2.x < 2.2.34 Multiple Vulnerabilities
According to its banner, the version of Apache running on the remote host is 2.2.x prior to 2.2.34. It is, therefore, affected by the following vulnerabilities : - An authentication bypass vulnerability exists in httpd due to third-party modules using the apgetbasicauthpw function outside of the...
MS15-011: Vulnerability in Group Policy Could Allow Remote Code Execution (3000483)
The remote Windows host is affected by a remote code execution vulnerability due to how the Group Policy service manages policy data when a domain-joined system connects to a domain controller. An attacker, using a controlled network, can exploit this to gain complete control of the host. Note th...
PHP mb_send_mail() Function Parameter Security Bypass
According to its banner, the version of PHP installed on the remote host is affected by a flaw that allows an attacker to gain unauthorized privileges. When used with sendmail and when accepting remote input for the additionalparameters argument to the mbsendmail function, it is possible for...
OPIE w/ OpenSSH Account Enumeration
When using OPIE for PAM and OpenSSH, it is possible for remote attackers to determine the existence of certain user accounts. Note that Nessus has not tried to exploit the issue, but rather only checked if OpenSSH is running on the remote host. As a result, it does not detect if the remote host...
SSH Protocol Authentication Bypass (Remote Exploit Check)
The remote ssh server is vulnerable to an authentication bypass. An attacker can bypass authentication by presenting SSH2MSGUSERAUTHSUCCESS message in place of the SSH2MSGUSERAUTHREQUEST method that normally would initiate authentication. Note: This vulnerability was disclosed in a libssh advisor...
AXIS gSOAP Message Handling RCE (ACV-116267) (Devil's Ivy)
The remote AXIS device is running a firmware version that is missing a security patch. It is, therefore, affected by a remote code execution vulnerability, known as Devil's Ivy, due to an overflow condition that exists in a third party SOAP library gSOAP. An unauthenticated, remote attacker can...
JBoss Enterprise Application Platform '/jmx-console' Authentication Bypass
The version of JBoss Enterprise Application Platform EAP running on the remote host allows unauthenticated access to documents under the /jmx-console directory. This is due to a misconfiguration in web.xml which only requires authentication for GET and POST requests. Specifying a different verb...
Multiple BSD ipfw / ip6fw ECE Bit Filtering Evasion
The remote host seems vulnerable to a bug wherein a remote attacker can circumvent the firewall by setting the ECE bit within the TCP flags field. At least one firewall ipfw is known to exhibit this sort of behavior. Known vulnerable systems include all FreeBSD 3.x ,4.x, 3.5-STABLE, and 4.2-STABL...
Apache Tomcat Manager Common Administrative Credentials
Nessus was able to gain access to the Manager web application for the remote Tomcat server using a known set of credentials. A remote attacker can exploit this issue to install a malicious application on the affected server and run arbitrary code with Tomcat's privileges usually SYSTEM on Windows...
TCP/IP Predictable ISN (Initial Sequence Number) Generation Weakness
The remote host has predictable TCP sequence numbers. An attacker may use this flaw to establish spoofed TCP connections to this host. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid10443; scriptversion"1.31"; scriptcvsdate"Date: 2019/03/06 18:38:55"; scriptcveid...
MS KB3097966: Inadvertently Disclosed Digital Certificates Could Allow Spoofing
The remote host is missing KB3097966, KB2677070 automatic updater, or the latest disallowed certificate update using KB2813430 manual updater. If KB2677070 has been installed, it has not yet obtained the latest auto-updates. Note that this plugin checks that the updaters have actually updated the...
Nginx 1.25.x < 1.25.4 Multiple Vulnerabilities
According to its Server response header, the installed version of nginx is 1.25.x prior to 1.25.4. It is, therefore, affected by the following issues : - A NULL pointer dereference in HTTP/3. CVE-2024-24989 - A Use-after-free in HTTP/3. CVE-2024-24990 Note that the scanner has not tested for thes...
Microsoft Windows SMB LsaQueryInformationPolicy Function SID Enumeration Without Credentials
By emulating the call to LsaQueryInformationPolicy, it was possible to obtain the host SID Security Identifier, without credentials. The host SID can then be used to get the list of local users. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid56210; scriptversion"1.5"...
Apache 2.4.x < 2.4.48 Vulnerability
The version of Apache httpd installed on the remote host is prior to 2.4.48. It is, therefore, affected by a vulnerability as referenced in the 2.4.48 changelog. - modhttp2: Fix a potential NULL pointer dereference CVE-2021-31618 Note that Nessus has not tested for this issue but has instead reli...
Apache 2.4.x < 2.4.10 Multiple Vulnerabilities
According to its banner, the version of Apache 2.4.x running on the remote host is prior to 2.4.10. It is, therefore, affected by the following vulnerabilities : - A flaw exists in the 'modproxy' module that may allow an attacker to send a specially crafted request to a server configured as a...
VNC Server Unauthenticated Access
The VNC server installed on the remote host allows an attacker to connect to the remote host as no authentication is required to access this service. The VNC server sometimes sends the connected user to the XDM login screen. Unfortunately, Nessus cannot identify this situation. In such a case, it...
Google Chrome < 72.0.3626.81 Multiple Vulnerabilities
The version of Google Chrome installed on the remote Windows host is prior to 72.0.3626.81. It is, therefore, affected by multiple vulnerabilities as referenced in the 201901stable-channel-update-for-desktop advisory. - Missing URI encoding of untrusted input in DevTools in Google Chrome prior to...
Backup Files Disclosure
By appending various suffixes ie: .old, .bak, , etc... to the names of various files on the remote host, it seems possible to retrieve their contents, which may result in disclosure of sensitive information. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. This plugin uses the data collected ...
Security Updates for Microsoft Visual Studio Products (April 2018)
The Microsoft Visual Studio Products are missing a security update. It is, therefore, affected by the following vulnerability : - An information disclosure vulnerability exists when Visual Studio improperly discloses limited contents of uninitialized memory while compiling program database PDB...
Security Updates for Internet Explorer (June 2017)
The Internet Explorer installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory. This vulnerability could corrupt memory in such ...
ProFTPD mod_copy Information Disclosure
The remote host is running a version of ProFTPD that is affected by an information disclosure vulnerability in the modcopy module due to the SITE CPFR and SITE CPTO commands being available to unauthenticated clients. An unauthenticated, remote attacker can exploit this flaw to read and write to...
Microsoft Windows 'CWDIllegalInDllSearch' Registry Setting
Windows Hosts can be hardened against DLL hijacking attacks by setting the The 'CWDIllegalInDllSearch' registry entry in to one of the following settings: - 0xFFFFFFFF Removes the current working directory from the default DLL search order - 1 Blocks a DLL Load from the current working directory ...
GoAhead System.ini Leak
The remote server uses a version of GoAhead that allows a remote unauthenticated attacker to download the system.ini file. This file contains credentials to the web interface, ftp interface, and others. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid102174;...
Oracle Java SE 1.7.0_291 / 1.8.0_281 / 1.11.0_10 / 1.15.0_2 Information Disclosure (Jan 2021 CPU)
The version of Oracle formerly Sun Java SE or Java for Business installed on the remote host is prior to 7 Update 291, 8 Update 281, 11 Update 10, or 15 Update 2. It is, therefore, affected by an information disclosure vulnerability as referenced in the January 2021 CPU advisory. Specifically, an...
Oracle Java SE 1.7.0_261 / 1.8.0_251 / 1.11.0_7 / 1.14.0_1 Multiple Vulnerabilities (Apr 2020 CPU) (Unix)
The version of Oracle formerly Sun Java SE or Java for Business installed on the remote host is prior to 7 Update 261, 8 Update 251, 11 Update 7, or 14 Update 1. It is, therefore, affected by multiple vulnerabilities related to the following components : - Oracle Java SE and Java SE Embedded are...
MySQL 5.7.x < 5.7.29 Multiple Vulnerabilities (Jan 2020 CPU)
The version of MySQL running on the remote host is 5.7.x prior to 5.7.29. It is, therefore, affected by multiple vulnerabilities, including three of the top vulnerabilities below, as noted in the January 2020 Critical Patch Update advisory: - Vulnerability in the MySQL Server product of Oracle...
Dropbear SSH Server < 2016.72 xauth Command Injection
According to its self-reported version in the banner, the version of Dropbear SSH running on the remote host is prior to 2016.72. It is, therefore, affected by a command injection vulnerability when X11 Forwarding is enabled, due to improper sanitization of X11 authentication credentials. An...
ADV180002: Microsoft SQL Server January 2018 Security Update (Meltdown) (Spectre)
The remote Microsoft SQL Server is missing a security update. It is, therefore, affected by a vulnerability exists within microprocessors utilizing speculative execution and indirect branch prediction, which may allow an attacker with local user access to disclose information via a side-channel...
MTA Open Mail Relaying Allowed
Nessus has detected that the remote SMTP server allows mail relaying. This issue allows any spammer to use your mail server to send their mail to the world, thus flooding your network bandwidth and possibly getting your mail server blacklisted. C Tenable Network Security, Inc. include'compat.inc'...
XMPP Cleartext Authentication
The remote Extensible Messaging and Presence Protocol XMPP service supports one or more authentication mechanisms that allow credentials to be sent in the clear. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid87736; scriptversion"$Revision: 1.1 $"; scriptcvsdate"$Date...
Microsoft SQL Server Detection (credentialed check)
Nessus has detected one or more installs of Microsoft SQL server by examining the registry and file systems on the remote host. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include"compat.inc"; if description scriptid11217; scriptversion"1.158";...
Default Password 'Zte521' for 'root' Account
The account 'root' on the remote host has the default password 'Zte521'. A remote attacker can exploit this issue to gain administrative access to the affected system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. account = "root"; password = "Zte521"; include'deprecatednasllevel.inc';...
JBoss Java Object Deserialization RCE
The remote JBoss server is affected by multiple remote code execution vulnerabilities : - A flaw exists due to the JMXInvokerHAServlet and EJBInvokerHAServlet invoker servlets not properly restricting access to profiles. A remote attacker can exploit this issue to bypass authentication and invoke...
Apache Log4j SEoL (<= 1.x)
According to its version, Apache Log4j is less than or equal to 1.x. It is, therefore, no longer maintained by its vendor or provider. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it may contain security vulnerabilities...
Citrix ADC and Citrix NetScaler Gateway Arbitrary Code Execution (CTX267027)
The remote Citrix ADC or Citrix NetScaler Gateway device is affected by an arbitrary code execution vulnerability. An unauthenticated, remote attacker may be able to leverage this vulnerability to perform arbitrary code execution on an affected host. Please refer to advisory CTX267027 for more...
SSH Commands Require Privilege Escalation
This plugin reports the SSH commands that failed with a response indicating that privilege escalation is required to run them. Either privilege escalation credentials were not provided, or the command failed to run with the provided privilege escalation credentials. NOTE: Due to limitations...
MS15-124: Cumulative Security Update for Internet Explorer (3116180)
The version of Internet Explorer installed on the remote host is missing Cumulative Security Update 3116180. It is, therefore, affected by multiple vulnerabilities, the majority of which are remote code execution vulnerabilities. An unauthenticated, remote attacker can exploit these issues by...
phpMyAdmin grab_globals.lib.php subform Parameter Traversal Local File Inclusion
The version of phpMyAdmin installed on the remote host allows attackers to read and possibly execute code from arbitrary files on the local host because of its failure to sanitize the parameter 'subform' before using it in the 'libraries/grabglobals.lib.php' script. %NASLMINLEVEL 70300 C Tenable...
SSH Server Type and Version Information
It is possible to obtain information about the remote SSH server by sending an empty authentication request. TRUSTED...
IBM Domino ZMerge Database Security Bypass
The version of IBM Domino formerly IBM Lotus Domino running on the remote host is affected by a security bypass vulnerability due to insufficient access control list ACL settings on the administration databases for ZMerge. An unauthenticated, remote attacker can exploit this issue to disclose...
Apache 2.4.x < 2.4.28 HTTP Vulnerability (OptionsBleed)
According to its banner, the version of Apache running on the remote host is 2.4.x prior to 2.4.28. It is, therefore, affected by an HTTP vulnerability related to the directive in an .htaccess file. Note that Nessus has not tested for these issues but has instead relied only on the application's...
DokuWiki Detection
The remote host is running DokuWiki, an open source wiki application written in PHP. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid24711; scriptversion"1.16"; scriptsetattributeattribute:"pluginmodificationdate", value:"2023/05/24"; scriptnameenglish:"DokuWiki...
Apache Tomcat 9.0.0.M1 < 9.0.18
The version of Tomcat installed on the remote host is prior to 9.0.18. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat9.0.18security-9 advisory. - When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.1...