EulerOS 2.0 SP2 : binutils (EulerOS-SA-2019-2450)

According to the versions of the binutils packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.29 and 2.30. Stack Exhaustion occurs in the C++...

openSUSE Security Update : xen (openSUSE-2019-2508)

This update for xen fixes the following issues : - CVE-2018-12207: Untrusted virtual machines on Intel CPUs could exploit a race condition in the Instruction Fetch Unit of the Intel CPU to cause a Machine Exception during Page Size Change, causing the CPU core to be non-functional. bsc1155945 -...

NewStart CGSL MAIN 4.05 : samba4 Multiple Vulnerabilities (NS-SA-2019-0115)

The remote NewStart CGSL host, running version MAIN 4.05, has samba4 packages installed that are affected by multiple vulnerabilities: - An information leak flaw was found in the way SMB1 protocol was implemented by Samba. A malicious client could use this flaw to dump server memory contents to a...

RHEL 7 : firefox (RHSA-2019:1763)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:1763 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox...

openSUSE Security Update : apache2 (openSUSE-2019-305)

This update for apache2 fixes the following issues : Security issues fixed : - CVE-2018-17189: Fixed a denial of service in modhttp2, via slow and unneeded request bodies bsc1122838 - CVE-2018-17199: Fixed that modsessioncookie did not respect expiry time bsc1122839 Non-security issue fixed : -...

Fedora 28 : 3:mariadb (2018-2513b888a4)

MariaDB 10.2.15 Release notes : https://mariadb.com/kb/en/library/mariadb-10215-release-notes/ CVEs fixed : CVE-2018-2755 CVE-2018-2761 CVE-2018-2766 CVE-2018-2771 CVE-2018-2781 CVE-2018-2782 CVE-2018-2784 CVE-2018-2787 CVE-2018-2813 CVE-2018-2817 CVE-2018-2819 CVE-2018-2786 CVE-2018-2759...

SUSE SLES12 Security Update : php5 (SUSE-SU-2016:2477-1)

This update for php5 fixes the following security issues : - CVE-2016-7411: php5: Memory corruption when destructing deserialized object - CVE-2016-7412: Heap overflow in mysqlnd when not receiving UNSIGNEDFLAG in BIT field - CVE-2016-7413: Use after free in wddxdeserialize - CVE-2016-7414: Out o...

Security Updates for Microsoft Skype for Business and Microsoft Lync (November 2018)

The Microsoft Skype for Business or Microsoft Lync installation on the remote host is missing a security update. It is, therefore, affected by the following vulnerability : - A denial of service vulnerability exists in Skype for Business. An attacker who successfully exploited the vulnerability...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2018-4244)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2018-4244 advisory. - mm: get rid of vmacacheflushall entirely Linus Torvalds Orabug: 28701016 CVE-2018-17182 Tenable has extracted the preceding description block directly fro...

CentOS 7 : firefox (CESA-2018:2113)

An update for firefox is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

MySQL 5.6.x < 5.6.39 Multiple Vulnerabilities (January 2018 CPU)

The version of MySQL running on the remote host is 5.6.x prior to 5.6.39. It is, therefore, affected by multiple vulnerabilities as noted in the January 2018 Critical Patch Update advisory. Please consult the CVRF details for the applicable CVEs for additional information. Note that Nessus has no...

EulerOS 2.0 SP2 : kernel (EulerOS-SA-2018-1001)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The recent speculative execution CVEs address three potential attacks across a wide variety of architectures and hardware platforms. - Note: Thi...

KB4019473: Windows 10 Version 1511 May 2017 Cumulative Update

The remote Windows 10 version 1511 host is missing security update KB4019473. It is, therefore, affected by multiple vulnerabilities : - A security bypass vulnerability exists in Internet Explorer due to an unspecified flaw. An unauthenticated, remote attacker can exploit this, by convincing a us...

Mozilla Thunderbird < 45.8 Multiple Vulnerabilities (macOS)

The version of Mozilla Thunderbird installed on the remote macOS or Mac OS X host is prior to 45.8. It is, therefore, affected by multiple vulnerabilities : - Mozilla developers and community members Boris Zbarsky, Christian Holler, Honza Bambas, Jon Coppeard, Randell Jesup, Andre Bargull, Kan-Ru...

RHEL 6 : kernel (RHSA-2015:2645)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:2645 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. It was found that the x86 ISA Instruction Set...

Debian DSA-3362-1 : qemu-kvm - security update

Several vulnerabilities were discovered in qemu-kvm, a full virtualization solution on x86 hardware. - CVE-2015-5278 Qinghao Tang of QIHU 360 Inc. discovered an infinite loop issue in the NE2000 NIC emulation. A privileged guest user could use this flaw to mount a denial of service QEMU process...

Fedora 20 : php-5.5.22-1.fc20 (2015-2328)

19 Feb 2015, PHP 5.5.22 Core : - Fixed bug 67068 getClosure returns somethings that's not a closure. Danack at basereality dot com - Fixed bug 68925 Mitigation for CVE-2015-0235 ' GHOST: glibc gethostbyname buffer overflow. Stas - Fixed bug 68942 Use after free vulnerability in unserialize with...

Oracle Linux 7 : kernel (ELSA-2014-1971)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1971 advisory. - alsa control: Make sure that id-index does not overflow Jaroslav Kysela 1117313 1117314 CVE-2014-4656 - alsa control: Handle numid overflow Jaroslav...

OracleVM 2.1 : kernel (OVMSA-2008-2005)

The remote OracleVM system is missing necessary patches to address critical security updates : - fix utrace deadengine ops race - fix ptraceattach leak - CVE-2007-5093: kernel PWC driver DoS - CVE-2007-6282: IPSec ESP kernel panics - CVE-2007-6712: kernel: infinite loop in highres timers kernel...

Fedora 21 : openssl-1.0.1j-1.fc21 (2014-12951) (POODLE)

Update fixing three moderate security issues. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

openSUSE Security Update : kernel (openSUSE-SU-2014:0985-1)

The Linux kernel was updated to fix security issues and bugs : Security issues fixed: CVE-2014-4699: The Linux kernel on Intel processors did not properly restrict use of a non-canonical value for the saved RIP address in the case of a system call that does not use IRET, which allowed local users...

FreeBSD : apache22 -- several vulnerabilities (f927e06c-1109-11e4-b090-20cf30e32f6d)

Apache HTTP SERVER PROJECT reports : moddeflate: The DEFLATE input filter inflates request bodies now limits the length and compression ratio of inflated request bodies to avoid denial of service via highly compressed bodies. See directives DeflateInflateLimitRequestBody, DeflateInflateRatioLimit...

Cisco ACE30 and ACE4710 OpenSSL 'ChangeCipherSpec' MiTM Vulnerability

The remote device is running a software version known to be affected by an OpenSSL related vulnerability. The flaw could allow a MiTM attacker to decrypt or forge SSL messages by telling the service to begin encrypted communications before key material has been exchanged, which causes predictable...

MediaWiki < 1.19.11 / 1.21.5 / 1.22.2 Multiple Remote Code Execution Vulnerabilities

According to its version number, the instance of MediaWiki running on the remote host is affected by the following remote code execution vulnerabilities : - A user-input validation error exists during thumbnail generation in the 'thumb.php' script that allows the execution of arbitrary shell...

RHEL 6 : java-1.7.0-openjdk (RHSA-2014:0026)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:0026 advisory. These packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Software Development Kit. An input validation flaw was...

ProFTPD TELNET IAC Escape Sequence Remote Buffer Overflow

The remote ProFTP daemon is susceptible to an overflow condition. The TELNETIAC escape sequence handling fails to properly sanitize user- supplied input resulting in a stack overflow. With a specially crafted request, an unauthenticated, remote attacker could potentially execute arbitrary code. C...

Cisco Wireless LAN Controller (WLC) Version

The remote host is running Cisco Wireless LAN Controller WLC, an operating system for Cisco switches. It is possible to read the WLC version by connecting to the switch using SSH, SNMP, and/or CAPWAP. TRUSTED...

Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2013-2513)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-2513 advisory. - wakeupprocess should be never used to wakeup a TASKSTOPPED/TRACED task Oleg Nesterov Orabug: 16405869 CVE-2013-0871 - ptrace: ensure...

CentOS 4 : php (CESA-2012:0071)

Updated php packages that fix several security issues are now available for Red Hat Enterprise Linux 4. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are...

CentOS 5 / 6 : thunderbird (CESA-2012:1483)

An updated thunderbird package that fixes several security issues is now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity...

Ubuntu 10.04 LTS : linux-lts-backport-natty vulnerabilities (USN-1470-1)

Andy Adamson discovered a flaw in the Linux kernel's NFSv4 implementation. A remote NFS server attacker could exploit this flaw to cause a denial of service. CVE-2011-4131 A flaw was found in the Linux kernel's KVM Kernel Virtual Machine virtual cpu setup. An unprivileged local user could exploit...

Fedora 15 : libguestfs-1.10.12-1.fc15 (2011-17388)

Fixes Security: Mitigate possible privilege escalation via SGIO ioctl CVE-2011-4127, RHBZ757071. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as...

Mandriva Linux Security Advisory : php (MDVSA-2011:165)

Multiple vulnerabilities has been identified and fixed in php : Use-after-free vulnerability in the substrreplace function in PHP 5.3.6 and earlier allows context-dependent attackers to cause a denial of service memory corruption or possibly have unspecified other impact by using the same variabl...

Unprotected QNX qconn Service

A QNX qconn service is running on this host. QNX plans to add some authentication to qconn. Meanwhile, qconn should be used only in development phase. Through this service, it is possible to upload and execute arbitrary code on the host. An attacker can use this service to take complete control o...

Microsoft Windows SMB Registry : Enumerate the list of SNMP communities

Using the registry, it was possible to extract the list of SNMP communities configured on the remote host. You should ensure that each community has the appropriate permission and that it can not be guessed by an attacker C Tenable Network Security, Inc. include"compat.inc"; if description...

AIX 530011 : U832265

The remote host is missing AIX PTF U832265 which is related to the security of the package devices.pci.2b102725.rte You should install this PTF for your system to be up-to-date. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. if ! definedfunc"bnrandom" exit0; include'deprecatednasllevel.inc'...

FreeBSD : opera -- multiple vulnerabilities (6431c4db-deb4-11de-9078-0030843d3802)

Opera Team reports : - Fixed a heap buffer overflow in string to number conversion - Fixed an issue where error messages could leak onto unrelated sites - Fixed a moderately severe issue, as reported by Chris Evans of the Google Security Team; details will be disclosed at a later date...

openSUSE Security Update : kdegraphics3 (kdegraphics3-819)

This update fixes security problems while decoding JBIG2. CVE-2009-0146, CVE-2009-0147, CVE-2009-0165, CVE-2009-0166, CVE-2009-0799, CVE-2009-0800, CVE-2009-1179, CVE-2009-1180, CVE-2009-1181, CVE-2009-1182, CVE-2009-1183 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text a...

Mandrake Linux Security Advisory : kernel (MDKSA-2006:151)

A number of vulnerabilities were discovered and corrected in the Linux 2.6 kernel : Prior to and including 2.6.16-rc2, when running on x8664 systems with preemption enabled, local users can cause a DoS oops via multiple ptrace tasks that perform single steps CVE-2006-1066. Prior to 2.6.16, a...

MS05-051: Vulnerabilities in MSDTC Could Allow Remote Code Execution (902400) (uncredentialed check)

The remote version of Windows contains a version of MSDTC Microsoft Data Transaction Coordinator service that has several remote code execution, local privilege escalation, and denial of service vulnerabilities. An attacker may exploit these flaws to obtain the complete control of the remote host...

Security Updates for Azure Pipelines Agent (November 2023)

The Microsoft Azure Pipelines Agent running on the remote host is prior to 2.217.2. It is, therefore affected by a remote code execution vulnerability due to an integer overflow in the embedded mingit component. Note that Nessus has not tested for this issue but has instead relied only on the...

Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.20.1)

The version of AOS installed on the remote host is prior to 5.20.1. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.20.1 advisory. - encoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a denial of service invalid write access and...

Security Updates for Microsoft PowerPoint Products C2R (April 2020)

The Microsoft PowerPoint Products are missing a security update. It is, therefore, affected by the following vulnerability : - A remote code execution vulnerability exists when Microsoft Office improperly loads arbitrary type libraries. An attacker could then install programs; view, change, or...

Amazon Linux 2 : kernel, --advisory ALAS2-2022-1768 (ALAS-2022-1768)

The version of kernel installed on the remote host is prior to 4.14.273-207.502. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1768 advisory. A flaw was found in the Linux kernel in linux/net/netfilter/nftablesapi.c of the netfilter subsystem. This flaw...

Oracle Linux 7 : qemu (ELSA-2022-9123)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9123 advisory. - Document CVE-2021-4158 and CVE-2021-3947 as fixed Mark Kanda Orabug: 33719302 Orabug: 33754145 CVE-2021-3947 CVE-2021-4158 - hw/block/fdc: Kludge...

EulerOS 2.0 SP9 : httpd (EulerOS-SA-2021-2915)

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier. CVE-2021-34798 -...

SUSE SLES12: java-11-openjdk / java-11-openjdk-demo / java-11-openjdk-devel / etc (SUSE-SU-2021:2613-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2613-1 advisory. - Update to jdk-11.0.12+7 - CVE-2021-2369: Fixed JAR file handling problem containing multiple MANIFEST.MF files. bsc1188565 -...

IBM HTTP Server 7.0.0.0 <= 7.0.0.45 / 8.0.0.0 <= 8.0.0.15 / 8.5.0.0 < 8.5.5.17 / 9.0.0.0 < 9.0.5.1 Multiple Vulnerabilities (964768)

The version of IBM HTTP Server running on the remote host is affected by multiple vulnerabilities as follows: - In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and CPU resources while...

FreeBSD : chromium -- multiple vulnerabilities (f4722927-1375-11eb-8711-3065ec8fd3ec)

Chrome Releases reports : This release includes 5 security fixes : - 1125337 High CVE-2020-16000: Inappropriate implementation in Blink. Reported by amaebijp on 2020-09-06 - 1135018 High CVE-2020-16001: Use after free in media. Reported by Khalil Zhani on 2020-10-05 - 1137630 High CVE-2020-16002:...

RHEL 8 : kernel (RHSA-2020:4286)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4286 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: net: bluetooth: type confusion...