Oracle MySQL 5.6.x < 5.6.29 Multiple Vulnerabilities (April 2016 CPU)

The version of Oracle MySQL installed on the remote host is 5.6.x prior to 5.6.29. It is, therefore, affected by the following vulnerabilities : - A NULL pointer dereference flaw exists in the bundled version of OpenSSL in file rsaameth.c due to improper handling of ASN.1 signatures that are...

Oracle Linux 6 / 7 : java-1.7.0-openjdk (ELSA-2015-1229)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-1229 advisory. 1:1.7.0.85-2.6.1.2.0.1.el71 - Update DISTRONAME in specfile 1:1.7.0.85-2.6.1.2 - Bump upstream tarball to u25b01 to fix issue with 8075374 backport...

PHP 5.5.x < 5.5.22 Multiple Vulnerabilities (GHOST)

According to its banner, the version of PHP 5.5.x installed on the remote host is prior to 5.5.22. It is, therefore, affected by multiple vulnerabilities : - A heap-based buffer overflow flaw in the enchantbrokerrequestdict function in ext/enchant/enchant.c could allow a remote attacker to cause ...

ManageEngine Password Manager Pro Default Credentials

The remote ManageEngine Password Manager Pro web administration interface uses a known set of default credentials. An attacker can use these to gain access to the remote host. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if descriptio...

Scientific Linux Security Update : nss, nss-util, and nss-softokn on SL5.x, SL6.x, SL7.x i386/x86_64 (20141202) (POODLE)

This update adds support for the TLS Fallback Signaling Cipher Suite Value TLSFALLBACKSCSV, which can be used to prevent protocol downgrade attacks against applications which re-connect using a lower SSL/TLS protocol version when the initial connection indicating the highest supported protocol...

SuSE 11.1 Security Update : Mozilla Firefox (SAT Patch Number 6425)

Mozilla Firefox has been updated to 10.0.5ESR fixing various bugs and security issues. - Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain...

Ubuntu 10.04 LTS : linux-lts-backport-natty vulnerabilities (USN-1574-1)

A flaw was found in how the Linux kernel passed the replacement session keyring to a child process. An unprivileged local user could exploit this flaw to cause a denial of service panic. CVE-2012-2745 Ben Hutchings reported a flaw in the Linux kernel with some network drivers that support TSO TCP...

Scientific Linux Security Update : firefox on SL4.x, SL5.x, SL6.x i386/x86_64

Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with...

CentOS 6 : php (CESA-2012:1046)

Updated php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are...

SeaMonkey < 2.8.0 Multiple Vulnerabilities

The installed version of SeaMonkey is earlier than 2.8.0. Such versions are potentially affected by the following security issues : - Multiple memory corruption issues. By tricking a user into visiting a specially crafted page, these issues may allow an attacker to execute arbitrary code in the...

SuSE 11.1 Security Update : Java 1.6.0 (SAT Patch Number 5845)

java-160-openjdk was updated to the IcedTea 1.11.1 b24 release, fixing multiple security issues : - S7082299, CVE-2011-3571: Fix inAtomicReferenceArray - S7088367, CVE-2011-3563: Fix issues in java sound - S7110683, CVE-2012-0502: Issues with some KeyboardFocusManager method - S7110687,...

Debian DSA-2356-1 : openjdk-6 - several vulnerabilities (BEAST)

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Java platform : - CVE-2011-3389 The TLS implementation does not guard properly against certain chosen-plaintext attacks when block ciphers are used in CBC mode. - CVE-2011-3521 The CORBA implementation contains a...

FreeBSD : mozilla -- multiple vulnerabilities (45f102cd-4456-11e0-9580-4061862b8c22)

The Mozilla Project reports : MFSA 2011-01 Miscellaneous memory safety hazards rv:1.9.2.14/ 1.9.1.17 MFSA 2011-02 Recursive eval call causes confirm dialogs to evaluate to true MFSA 2011-03 Use-after-free error in JSON.stringify MFSA 2011-04 Buffer overflow in JavaScript upvarMap MFSA 2011-05...

Ubuntu 10.04 LTS / 10.10 : linux, linux-ec2 vulnerabilities (USN-1054-1)

Gleb Napatov discovered that KVM did not correctly check certain privileged operations. A local attacker with access to a guest kernel could exploit this to crash the host system, leading to a denial of service. CVE-2010-0435 Dan Rosenberg discovered that the Linux kernel TIPC implementation...

MySQL Zero-length Scrambled String Crafted Packet Authentication Bypass

A bug in the version of MySQL running on the remote host allows a remote attacker to bypass the password authentication mechanism using a specially crafted packet with a zero-length scramble buff string. An attacker with knowledge of an existing account defined to the affected service can leverag...

Slackware 12.0 / 12.1 / 12.2 / 13.0 / 13.1 / current : xorg-server (SSA:2010-240-06)

New xorg-server packages are available for Slackware 12.0, 12.1, 12.2, 13.0, 13.1, and -current to fix a security issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2010-240-06. The tex...

CentOS 5 : kernel (CESA-2010:0147)

Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed...

Web Application SQL Backend Identification

At least one web application hosted on the remote web server is built on a SQL backend that Nessus was able to identify by looking at error messages. Leaking this kind of information may help an attacker fine-tune attacks against the application and its backend. %NASLMINLEVEL 70300 C Tenable...

Safari < 3.2.2 Multiple Vulnerabilities

Binary data 4932.prm...

Fedora 8 : thunderbird-2.0.0.16-1.fc8 (2008-6706)

Updated thunderbird packages that fix several security issues are now available for Fedora 8. Several flaws were found in the processing of malformed HTML content. An HTML mail containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code as the user runnin...

RHEL 4 : kernel (RHSA-2007:0488)

Updated kernel packages that fix several security issues and bugs in the Red Hat Enterprise Linux 4 kernel are now available. This security advisory has been rated as having important security impact by the Red Hat Security Response Team. The Linux kernel handles the basic functions of the...

YaBB 1 GOLD SP 1.3.2 Multiple Vulnerabilities

The 'YaBB.pl' CGI is installed. This version is affected by a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied input. As a result of this vulnerability, it is possible for a remote attacker to create a malicious link containi...

Microsoft Windows LAN Manager SNMP LanMan Services Disclosure

It is possible to obtain the list of LanMan services on the remote host by sending SNMP requests with the OID 1.3.6.1.4.1.77.1.2.3.1.1 An attacker may use this information to gain more knowledge about the target host. TRUSTED...

Amazon Linux 2022 : php, php-bcmath, php-cli (ALAS2022-2022-073)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-073 advisory. A flaw was found in php. The main cause of this vulnerability is improper input validation while parsing an Extensible Markup LanguageXML entity. A special character could allow an attacker to...

AlmaLinux 8 : GNOME (ALSA-2019:3553)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2019:3553 advisory. - It was discovered that the gnome-shell lock screen since version 3.15.91 did not properly restrict all contextual actions. An attacker with physical...

AlmaLinux 8 : GNOME (ALSA-2020:4451)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2020:4451 advisory. - A logic issue was addressed with improved state management. This issue is fixed in tvOS 13, iTunes for Windows 12.10.1, iCloud for Windows 10.7, iCloud...

Oracle Database Server (Jan 2022 CPU)

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2022 CPU advisory. - Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 19c and 21c...

CentOS 8 : virt:rhel and virt-devel:rhel (CESA-2021:5238)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:5238 advisory. - QEMU: net: e1000: infinite loop while processing transmit descriptors CVE-2021-20257 - QEMU: off-by-one error in modesensepage in hw/scsi/scsi-disk.c...

SUSE SLES15: kernel-azure / kernel-azure-devel / kernel-devel-azure / etc (SUSE-SU-2021:2409-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2409-1 advisory. The SUSE Linux Enterprise 15 SP3 Azure kernel was updated to receive various security and bugfixes. The following security bugs were fixed: -...

Debian DLA-2608-1 : jquery security update

Two vulnerabilities have been discovered in jquery's handling of untrusted HTML which may result in execution of untrusted code. For Debian 9 stretch, these problems have been fixed in version 3.1.1-2+deb9u2. We recommend that you upgrade your jquery packages. For the detailed security status of...

SUSE SLES15 Security Update : grub2 (SUSE-SU-2021:0684-1)

This update for grub2 fixes the following issues : grub2 now implements the new 'SBAT' method for SHIM based secure boot revocation. bsc1182057 Following security issues are fixed that can violate secure boot constraints : CVE-2020-25632: Fixed a use-after-free in rmmod command bsc1176711...

Amazon Linux AMI : python27, python36, python38 (ALAS-2021-1484)

The version of python27 installed on the remote host is prior to 2.7.18-2.141. The version of python36 installed on the remote host is prior to 3.6.12-1.20. The version of python38 installed on the remote host is prior to 3.8.5-1.5. It is, therefore, affected by a vulnerability as referenced in t...

openSUSE Security Update : MozillaThunderbird (openSUSE-2020-2317)

This update for MozillaThunderbird fixes the following issues : - Mozilla Thunderbird 78.6 - new: MailExtensions: Added browser.windows.openDefaultBrowser bmo1664708 - changed: Thunderbird now only shows quota exceeded indications on the main window bmo1671748 - changed: MailExtensions: menus API...

Oracle Linux 7 : Unbreakable Enterprise kernel-container (ELSA-2020-5924)

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-5924 advisory. - powercap: restrict energy meter to root access Kanth Ghatraju Orabug: 32040805 CVE-2020-8694 CVE-2020-8695 - hdlcppp: add range checks in pppcpparsec...

RHEL 6 : java-1.8.0-openjdk (RHSA-2020:4348)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4348 advisory. The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security...

RHEL 8 : java-1.8.0-ibm (RHSA-2020:3386)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3386 advisory. IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update upgrades IBM Java SE ...

Fedora 31 : kernel (2020-1b2dae6219)

The 5.6.19 stable kernel updates contain a number of important fixes across the tree. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible...

Apache Tomcat 9.0.0 < 9.0.35

The version of Tomcat installed on the remote host is prior to 9.0.35. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat9.0.35security-9 advisory. - When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to...

openSUSE Security Update : chromium (openSUSE-2020-620)

This update for chromium fixes the following issues : Update to 81.0.4044.138 boo1171247 : - CVE-2020-6831: Stack-based buffer overflow in SCTP - CVE-2020-6464: Type Confusion in Blink C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

NewStart CGSL MAIN 5.04 : java-1.8.0-openjdk Multiple Vulnerabilities (NS-SA-2019-0016)

The remote NewStart CGSL host, running version MAIN 5.04, has java-1.8.0-openjdk packages installed that are affected by multiple vulnerabilities: - Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE subcomponent: JNDI. Supported versions that are affected are Jav...

Oracle Linux 8 : java-1.8.0-openjdk (ELSA-2019-1816)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-1816 advisory. 1:1.8.0.222.b10-0 - Update to aarch64-shenandoah-jdk8u222-b10. - Resolves: rhbz1724452 1:1.8.0.222.b09-0 - Update to aarch64-shenandoah-jdk8u222-b09. -...

Amazon Linux 2 : java-11-amazon-corretto (ALAS-2019-1246)

OpenJDK: Insufficient restriction of privileges in AccessController Security, 8216381 CVE-2019-2786 OpenJDK: Unbounded memory allocation during deserialization in Collections Utilities, 8213432 CVE-2019-2769 libpng: pngimagefree in png.c in libpng has a use-after-free because pngimagefreefunction...

Oracle Linux 6 : java-1.8.0-openjdk (ELSA-2019-0416)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-0416 advisory. - Re-generate patches mostly due to upstream build changes - JDK-8073139/PR1758/RH1191652 - JDK-8197429/PR3546/RH1536622 due to JDK-8189170 - JDK-8199936/PR3533...

SUSE SLED12 / SLES12 Security Update : ImageMagick (SUSE-SU-2018:3191-1)

This update for ImageMagick fixes the following issues : Security issues fixed : CVE-2018-18024: Fixed an infinite loop in the ReadBMPImage function of the coders/bmp.c file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file. bsc1111069...

Virtuozzo 7 : readykernel-patch (VZA-2018-050)

According to the version of the vzkernel package and the readykernel-patch installed, the Virtuozzo installation on the remote host is affected by the following vulnerability : - The implementation of timercreate system call in the Linux kernel before 4.14.8 doesn't properly validate the...

SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1233-1)

This update for the Linux Kernel 3.12.61-5280 fixes several issues. The following security issues were fixed : - CVE-2018-1000199: A bug in x86 debug register handling of ptrace could lead to memory corruption, possibly a denial of service or privilege escalation bsc1090036. - CVE-2017-0861:...

JQuery 1.x < 1.12.0 / 2.x < 2.2.0 XSS

The version of JQuery library hosted on the remote web server is 1.x prior to 1.12.0 or 2.x prior to 2.2.0. It is, therefore, affected by a cross site scripting vulnerability when using location.host to select elements. C Tenable Network Security, Inc. include"compat.inc"; if description...

openSUSE Security Update : the Linux Kernel (openSUSE-2017-1224) (KRACK)

The openSUSE Leap 42.2 kernel was updated to 4.4.92 to receive various security and bugfixes. The following security bugs were fixed : - CVE-2017-13080: Wi-Fi Protected Access WPA and WPA2 allowed reinstallation of the Group Temporal Key GTK during the group key handshake, allowing an attacker...

EulerOS 2.0 SP2 : tomcat (EulerOS-SA-2017-1192)

According to the versions of the tomcat packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The Realm implementations did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to...

CentOS 6 : kernel (CESA-2017:0293)

An update for kernel is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...