Oracle MySQL 5.6.x < 5.6.29 Multiple Vulnerabilities (April 2016 CPU)

The version of Oracle MySQL installed on the remote host is 5.6.x prior to 5.6.29. It is, therefore, affected by the following vulnerabilities : - A NULL pointer dereference flaw exists in the bundled version of OpenSSL in file rsaameth.c due to improper handling of ASN.1 signatures that are...

Juniper NSM < 2012.2R9 Apache HTTP Server Multiple Vulnerabilities (JSA10685)

The remote host is running a version of NSM Network and Security Manager Server that is prior to 2012.2R9. It is, therefore, affected by multiple vulnerabilities in the bundled version of Apache HTTP Server : - A flaw exists due to improper escaping of filenames in 406 and 300 HTTP responses. A...

CentOS 6 / 7 : java-1.8.0-openjdk (CESA-2015:1228) (Bar Mitzvah) (Logjam)

Updated java-1.8.0-openjdk packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity...

Oracle Linux 6 / 7 : java-1.7.0-openjdk (ELSA-2015-1229)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-1229 advisory. 1:1.7.0.85-2.6.1.2.0.1.el71 - Update DISTRONAME in specfile 1:1.7.0.85-2.6.1.2 - Bump upstream tarball to u25b01 to fix issue with 8075374 backport...

Scientific Linux Security Update : nss, nss-util, and nss-softokn on SL5.x, SL6.x, SL7.x i386/x86_64 (20141202) (POODLE)

This update adds support for the TLS Fallback Signaling Cipher Suite Value TLSFALLBACKSCSV, which can be used to prevent protocol downgrade attacks against applications which re-connect using a lower SSL/TLS protocol version when the initial connection indicating the highest supported protocol...

OracleVM 3.2 : kernel-uek (OVMSA-2013-0003)

The remote OracleVM system is missing necessary patches to address critical security updates : - bonding: fixup typo in rlb mode of bond and bridge fix Guru Anbalagane Orabug: 16069448 - bonding: rlb mode of bond should not alter ARP originating via bridge zheng.li Orabug: 14650975 - compilation...

RHEL 6 : kernel (RHSA-2014:1843)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:1843 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. A race condition flaw was found in the way the Linux...

RHEL 5 / 6 : IBM Java Runtime in Satellite Server (RHSA-2013:1793)

Updated java-1.6.0-ibm packages that fix several security issues are now available for Red Hat Network Satellite Server 5.4, 5.5 and 5.6. The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System CVSS base scores, which give detail...

Ubuntu 12.04 LTS : linux-lts-saucy vulnerabilities (USN-2287-1)

Sasha Levin reported a flaw in the Linux kernel's point-to-point protocol PPP when used with the Layer Two Tunneling Protocol L2TP. A local user could exploit this flaw to gain administrative privileges. CVE-2014-4943 Michael S. Tsirkin discovered an information leak in the Linux kernel's...

MS11-049: Vulnerability in the Microsoft XML Editor Could Allow Information Disclosure (2543893) (uncredentialed check)

An application on the remote host has an information disclosure vulnerability. When parsing a specially crafted Web Service Discovery .disco file, external XML entities are allowed for untrusted user input. A remote attacker could exploit this by tricking a user into opening a specially crafted...

Fedora 19 : kernel-3.9.9-302.fc19 (2013-12901)

This update contains a number of fixes for vhost-net, bridging, and other bits of the tree Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible...

SeaMonkey < 2.8.0 Multiple Vulnerabilities

The installed version of SeaMonkey is earlier than 2.8.0. Such versions are potentially affected by the following security issues : - Multiple memory corruption issues. By tricking a user into visiting a specially crafted page, these issues may allow an attacker to execute arbitrary code in the...

Fedora 15 : kernel-2.6.41.10-3.fc15 (2012-0861)

Update to the 3.1.10 stable release Fedora 2.6.41.10. Also fixes CVEs : - CVE-2012-0056 - CVE-2011-4127 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much a...

MS10-038: Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (2027452) (Mac OS X)

The remote Mac OS X host is running a version of Microsoft Excel that is affected by several vulnerabilities. If an attacker can trick a user on the affected host into opening a specially crafted Excel file, these issues could be leveraged to execute arbitrary code subject to the user's privilege...

Sun Java Web Console helpwindow.jsp / masthead.jsp Multiple XSS

The version of Sun Java Web Console running on the remote host has multiple cross-site scripting vulnerabilities in 'helpwindow.jsp' and 'masthead.jsp'. A remote attacker could exploit these to trick a user into executing arbitrary HTML or script code in the context of the web server. %NASLMINLEV...

Fedora 8 : thunderbird-2.0.0.16-1.fc8 (2008-6706)

Updated thunderbird packages that fix several security issues are now available for Fedora 8. Several flaws were found in the processing of malformed HTML content. An HTML mail containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code as the user runnin...

PHP < 5.2.5 Multiple Vulnerabilities

According to its banner, the version of PHP installed on the remote host is older than 5.2.5. Such versions may be affected by various issues, including but not limited to several buffer overflows. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...

phpMyAdmin Detection

The remote host is running phpMyAdmin, a web-based MySQL administration tool written in PHP. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid17219; scriptversion"1.29"; scriptsetattributeattribute:"pluginmodificationdate", value:"2022/06/01";...

Multiple Web Server Encoded Space (%20) Request ASP Source Disclosure

It appears possible to get the source code of the remote ASP scripts by appending a '%20' to the request. ASP source code usually contains sensitive information such as logins and passwords. This has been reported in Simple HTTPD shttpd, Mono XSP for ASP.NET and vWebServer. This type of request m...

Node.js 16.x < 16.20.2 / 18.x < 18.17.1 / 20.x < 20.5.1 Multiple Vulnerabilities (Wednesday August 09 2023 Security Releases).

The version of Node.js installed on the remote host is prior to 16.20.2, 18.17.1, 20.5.1. It is, therefore, affected by multiple vulnerabilities as referenced in the Wednesday August 09 2023 Security Releases advisory: - Permissions policies can be bypassed via Module.load CVE-2023-32002 -...

RHEL 8 : firefox (RHSA-2021:4605)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:4605 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox...

Photon OS 2.0: Openssl PHSA-2021-2.0-0383

An update of the openssl package has been released. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-2.0-0383. The text itself is copyright C VMware, Inc...

openSUSE 15 Security Update : nodejs8 (openSUSE-SU-2021:1113-1)

"The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1113-1 advisory. - This affects the package y18n before 3.2.2, 4.0.1 and 5.0.5. PoC by po6ix: const y18n = require'y18n' %NASLMINLEVEL 70300 C Tenable...

Debian DLA-2608-1 : jquery security update

Two vulnerabilities have been discovered in jquery's handling of untrusted HTML which may result in execution of untrusted code. For Debian 9 stretch, these problems have been fixed in version 3.1.1-2+deb9u2. We recommend that you upgrade your jquery packages. For the detailed security status of...

Amazon Linux AMI : python27, python36, python38 (ALAS-2021-1484)

The version of python27 installed on the remote host is prior to 2.7.18-2.141. The version of python36 installed on the remote host is prior to 3.6.12-1.20. The version of python38 installed on the remote host is prior to 3.8.5-1.5. It is, therefore, affected by a vulnerability as referenced in t...

openSUSE Security Update : python3 (openSUSE-2020-2333)

This update for python3 fixes the following issues : - Fixed CVE-2020-27619 bsc1178009, where Lib/test/multibytecodecsupport calls eval on content retrieved via HTTP. - Change setuptools and pip version numbers according to new wheels - Handful of changes to make python36 compatible with SLE15 an...

openSUSE Security Update : MozillaThunderbird (openSUSE-2020-2317)

This update for MozillaThunderbird fixes the following issues : - Mozilla Thunderbird 78.6 - new: MailExtensions: Added browser.windows.openDefaultBrowser bmo1664708 - changed: Thunderbird now only shows quota exceeded indications on the main window bmo1671748 - changed: MailExtensions: menus API...

Oracle Linux 7 : Unbreakable Enterprise kernel-container (ELSA-2020-5924)

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-5924 advisory. - powercap: restrict energy meter to root access Kanth Ghatraju Orabug: 32040805 CVE-2020-8694 CVE-2020-8695 - hdlcppp: add range checks in pppcpparsec...

EulerOS Virtualization for ARM 64 3.0.2.0 : binutils (EulerOS-SA-2020-1548)

According to the versions of the binutils package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using...

Photon OS 3.0: Openjdk11 PHSA-2020-3.0-0084

An update of the openjdk11 package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-3.0-0084. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid136100;...

Apple iOS < 13.2 Multiple Vulnerabilities

Binary data appleios132check.nbin...

Oracle Linux 8 : java-1.8.0-openjdk (ELSA-2019-1816)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-1816 advisory. 1:1.8.0.222.b10-0 - Update to aarch64-shenandoah-jdk8u222-b10. - Resolves: rhbz1724452 1:1.8.0.222.b09-0 - Update to aarch64-shenandoah-jdk8u222-b09. -...

SUSE SLES12 Security Update : java-1_7_1-ibm (SUSE-SU-2019:1345-1)

This update for java-171-ibm fixes the following issues : Update to Java 7.1 Service Refresh 4 Fix Pack 45. Security issues fixed : CVE-2019-10245: Fixed Java bytecode verifier issue causing crashes bsc1134718. CVE-2019-2698: Fixed out of bounds access flaw in the 2D component bsc1132729...

Oracle Linux 6 : java-1.8.0-openjdk (ELSA-2019-0416)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-0416 advisory. - Re-generate patches mostly due to upstream build changes - JDK-8073139/PR1758/RH1191652 - JDK-8197429/PR3546/RH1536622 due to JDK-8189170 - JDK-8199936/PR3533...

Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2018-4214)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-4214 advisory. - x86/speculation/l1tf: Fix overflow in l1tfpfnlimit on 32bit Vlastimil Babka Orabug: 28505519 CVE-2018-3620 - x86/speculation/l1tf: Exempt zeroed...

Debian DLA-1446-1 : intel-microcode security update (Spectre)

Security researchers identified two software analysis methods that, if used for malicious purposes, have the potential to improperly gather sensitive data from multiple types of computing devices with different vendors processors and operating systems. This update requires an update to the...

Oracle Linux 7 : kernel (ELSA-2018-1965)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-1965 advisory. - x86 always enable eager FPU by default on non-AMD processors Paolo Bonzini 1589051 1589048 CVE-2018-3665 - x86 bugs: Switch the selection of mitigati...

SUSE SLES11 Security Update : kernel (SUSE-SU-2018:0171-1) (Meltdown) (Spectre)

The SUSE Linux Enterprise 11 SP3 LTSS kernel was updated to receive various security and bugfixes. This update is only provided as a fix update for IBM Z platform. - CVE-2017-5753 / 'Spectre Attack': IBM Z fixes were included but not enabled in the previous update. This update enables those fixes...

EulerOS 2.0 SP2 : tomcat (EulerOS-SA-2017-1192)

According to the versions of the tomcat packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The Realm implementations did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to...

Security and Quality Rollup for .NET Framework (April 2017)

The version of Microsoft .NET Framework installed on the remote Windows host is missing a security update. It is, therefore, affected by an arbitrary code execution vulnerability due to a failure to properly validate input before loading libraries. A local attacker can exploit this to execute...

CentOS 6 : kernel (CESA-2017:0293)

An update for kernel is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

Fedora 25 : kernel (2017-0054c7b1f0)

The 4.9.10 stable kernel update contains a number of important fixes across the tree. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible...

F5 Networks BIG-IP : OpenSSL vulnerability (K22334603)

The fmtstr function in crypto/bio/bprint.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g improperly calculates string lengths, which allows remote attackers to cause a denial of service overflow and out-of-bounds read or possibly have unspecified other impact via a long string, as...

Ubuntu 14.04 LTS : NTP vulnerabilities (USN-2783-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2783-1 advisory. Aleksis Kauppinen discovered that NTP incorrectly handled certain remote config packets. In a non-default configuration, a remote authenticated attacker...

MS15-067: Vulnerability in RDP Could Allow Remote Code Execution (3073094)

The remote Windows host is affected by a remote code execution vulnerability due to improper handling of packets by the Remote Desktop Protocol RDP service. A remote attacker can exploit this, by sending a specially crafted sequence of packets to the remote RDP server, to execute arbitrary code. ...

Oracle Solaris Third-Party Patch Update : apache (multiple_denial_of_service_dos5)

The remote Solaris system is missing necessary patches to address security updates : - The cacheinvalidate function in modules/cache/cachestorage.c in the modcache module in the Apache HTTP Server 2.4.6, when a caching forward proxy is enabled, allows remote HTTP servers to cause a denial of...

openSUSE Security Update : seamonkey (seamonkey-4462)

Mozilla SeaMonkey was updated to the 2.0.14 security release. MFSA 2011-12: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstance...

Firefox ESR 24.x < 24.3 Multiple Vulnerabilities

The installed version of Firefox ESR 24.x is earlier than 24.3, and is, therefore, potentially affected by the following vulnerabilities : - Memory issues exist in the browser engine that could result in a denial of service or arbitrary code execution. CVE-2014-1477 - An error exists related to...

Fedora 20 : libjpeg-turbo-1.3.0-2.fc20 (2013-23749)

Apply fixes CVE-2013-6629, CVE-2013-6630 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL...

Oracle Linux 5 : postgresql84 (ELSA-2011-1378)

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2011-1378 advisory. 8.4.9-1.el57.1 - Update to PostgreSQL 8.4.9, for various fixes described at http://www.postgresql.org/docs/8.4/static/release-8-4-9.html...