Cisco Wireless LAN Controller (WLC) Version

The remote host is running Cisco Wireless LAN Controller WLC, an operating system for Cisco switches. It is possible to read the WLC version by connecting to the switch using SSH, SNMP, and/or CAPWAP. TRUSTED...

RHEL 5 / 6 : java-1.7.0-ibm (RHSA-2013:1060)

Updated java-1.7.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6 Supplementary. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System CVSS base scores, which give...

RHEL 5 / 6 : firefox (RHSA-2013:0144)

Updated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings...

CentOS 5 : java-1.6.0-openjdk (CESA-2012:0730)

Updated java-1.6.0-openjdk packages that fix several security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity...

Ubuntu 11.04 : linux vulnerabilities (USN-1432-1)

A flaw was found in the Linux's kernels ext4 file system when mounted with a journal. A local, unprivileged user could exploit this flaw to cause a denial of service. CVE-2011-4086 A flaw was discovered in the Linux kernel's cifs file system. An unprivileged local user could exploit this flaw to...

RHEL 6 : kernel (RHSA-2011:1849)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:1849 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security fix: Using the SGIO IOCTL to issue SCSI...

BlogEngine.NET api/BlogImporter.asmx GetFile Function Unauthorized Access

The web server hosts BlogEngine.NET, an open source .NET blogging project. An install of the software on the remote host allows unauthenticated access to the 'GetFile' function of the 'api/BlogImporter.asmx' script. An unauthenticated, remote attacker may be able to abuse this function to copy...

Unprotected QNX qconn Service

A QNX qconn service is running on this host. QNX plans to add some authentication to qconn. Meanwhile, qconn should be used only in development phase. Through this service, it is possible to upload and execute arbitrary code on the host. An attacker can use this service to take complete control o...

HP-UX PHNE_40339 : s700_800 11.23 BIND 9.2.0 Revision 5.0

s700800 11.23 BIND 9.2.0 Revision 5.0 : The remote HP-UX host is affected by multiple vulnerabilities : - A potential security vulnerability has been identified with HP-UX running BIND. The vulnerability could be exploited remotely to create a Denial of Service DoS and permit unauthorized...

SuSE9 Security Update : Apache 2 (YOU Patch Number 12526)

This update of the Apache webserver fixes various security issues : - modproxy could run into an infinite loop when used as reverse proxy. CVE-2009-1890 - moddeflate continued to compress large files even after a network connection was closed, causing moddeflate to consume large amounts of CPU...

openSUSE Security Update : OpenOffice_org (OpenOffice_org-1187)

This update of OpenOffice.org fixes potential buffer overflow in EMF parser code CVE-2009-2139, CVE-2009-2140 Thanks to Petr Mladek. Additionally Secunia reported an integer underflow CVE-2009-0200 and a buffer overflow CVE-2009-0201 that could be triggered while parsing Word documents...

Fedora 8 : kernel-2.6.26.6-49.fc8 (2008-8980)

Update kernel from version 2.6.26.5 to 2.6.26.6: http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.26.6 CVE-2008-3831 An IOCTL in the i915 driver was not properly restricted to users with the proper capabilities to use it. CVE-2008-4410 The vmiwriteldtentry function in...

Mambo / Joomla! Multiple Components 'mosConfig_live_site' Parameter Remote File Include

A third-party component for Mambo or Joomla! is running on the remote host. At least one such component is affected by a remote file include vulnerability due to improper sanitization of user-supplied input to the 'mosConfiglivesite' parameter before using it to include PHP code. Provided the PHP...

Microsoft IIS fpcount.exe CGI Remote Overflow

Nessus detected the 'fpcount.exe' CGI on the remote web server. Some versions of this CGI have a remote buffer overflow vulnerability. A remote attacker could exploit it to crash the web server, or possibly execute arbitrary code. Nessus did not actually check for this flaw, but solely relied on...

Multiple Linux rpc.mountd Remote Overflow

The remote mount daemon seems to have a buffer overflow vulnerability. A remote attacker could exploit this to execute arbitrary code as root. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid11337; scriptversion"1.18"; scriptcvsdate"Date: 2018/07/16 14:09:13";...

Oracle MySQL Server 8.0.x < 8.0.37 (January 2025 CPU)

The versions of MySQL Server installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2025 CPU advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Packaging OpenSSL. Supported versions that are affected are 8.0.36 and...

SUSE SLES12 Security Update : kernel (Live Patch 26 for SLE 12 SP4) (SUSE-SU-2022:3373-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3373-1 advisory. This update for the Linux Kernel 4.12.14-9596 fixes several issues. The following security issues were fixed: - CVE-2022-39188: Fixed a race...

RHEL 8 : parfait:0.5 (RHSA-2022:0294)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0294 advisory. Parfait is a Java performance monitoring library that collects metrics and exposes them through a variety of outputs. It provides APIs for...

Security Updates for Exchange (January 2022)

The Microsoft Exchange Server installed on the remote host is missing security updates. It is, therefore, affected by a remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary code. %NASLMINLEVEL 70300 C Tenable, Inc...

EulerOS 2.0 SP9 : httpd (EulerOS-SA-2021-2915)

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier. CVE-2021-34798 -...

RHEL 8 : Red Hat JBoss Enterprise Application Platform 7.3.10 security update on RHEL 8 (Moderate) (RHSA-2021:5151)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:5151 advisory. This release of Red Hat JBoss Enterprise Application Platform 7.3.10 serves as a replacement for Red Hat JBoss Enterprise Application Platfo...

CentOS 7 : firefox (RHSA-2021:4116)

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:4116 advisory. - The iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass restrictions such as executing scripts or...

SUSE SLES11 Security Update : openssl (SUSE-SU-2019:14249-1)

The remote SUSE Linux SLES11 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2019:14249-1 advisory. - In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very...

Photon OS 2.0: Mysql PHSA-2021-2.0-0320

An update of the mysql package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-2.0-0320. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid146769...

KB4586808: Windows Server 2012 November 2020 Security Update

The Windows installation on the remote host is missing security update 4586781. It is, therefore, affected by multiple vulnerabilities. Please review the vendor advisory for more details. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from t...

Debian DLA-2377-1 : qt4-x11 security update

Several vulnerabilities were fixed in qt4-x11, the legacy version of the Qt toolkit. CVE-2018-15518 Double-free or corruption in QXmlStreamReader during parsing of a specially crafted illegal XML document. CVE-2018-19869 A malformed SVG image causes a segmentation fault. CVE-2018-19870 A malforme...

EulerOS 2.0 SP3 : kernel (EulerOS-SA-2020-2150)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The Linux kernel through 5.7.11 allows remote attackers to make observations that help to obtain sensitive information about the internal state ...

openSUSE Security Update : grub2 (openSUSE-2020-1168)

This update for grub2 fixes the following issues : - CVE-2020-10713 bsc1168994 - CVE-2020-14308 CVE-2020-14309, CVE-2020-14310, CVE-2020-14311 bsc1173812 - CVE-2020-15706 bsc1174463 - CVE-2020-15707 bsc1174570 - Use overflow checking primitives where the arithmetic expression for buffer allocatio...

Fedora 31 : 1:java-11-openjdk (2020-93cc9c3ef2)

July 2020 OpenJDK security update for OpenJDK 11 Full release notes: https://bitly.com/openjdk1108 Security fixes - JDK-8230613: Better ASCII conversions - JDK-8231800: Better listing of arrays - JDK-8232014: Expand DTD support - JDK-8233234: Better Zip Naming - JDK-8233239, CVE-2020-14562: Enhan...

RHEL 7 : .NET Core 2.1 on Red Hat Enterprise Linux (RHSA-2020:2937)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2937 advisory. .NET Core is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR...

Apache Tomcat 9.0.0 < 9.0.35

The version of Tomcat installed on the remote host is prior to 9.0.35. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat9.0.35security-9 advisory. - When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to...

EulerOS 2.0 SP5 : kernel (EulerOS-SA-2020-1308)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The kernel package contains the Linux kernel vmlinuz, the core of any Linux operating system. The kernel handles the basic functions of the...

RHEL 7 / 8 : OpenShift Container Platform 4.1.20 golang (RHSA-2019:3131)

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3131 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or...

openSUSE Security Update : apache2 (openSUSE-2019-2051) (Internal Data Buffering)

This update for apache2 fixes the following issues : Security issues fixed : - CVE-2019-9517: Fixed HTTP/2 implementations that are vulnerable to unconstrained interal data buffering bsc1145575. - CVE-2019-10081: Fixed modhttp2 that is vulnerable to memory corruption on early pushes bsc1145742. -...

EulerOS 2.0 SP5 : php (EulerOS-SA-2019-1795)

According to the versions of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The filecheckmem function in funcs.c in file before 5.23, as used in the Fileinfo component in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x befo...

RHEL 7 : kernel-rt (RHSA-2019:1176)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1176 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirement...

KB4493458: Windows Server 2008 April 2019 Security Update

The remote Windows host is missing security update 4493458 or cumulative update 4493471. It is, therefore, affected by multiple vulnerabilities : - A security feature bypass vulnerability exists in Windows which could allow an attacker to bypass Device Guard when Windows improperly handles calls ...

openSUSE Security Update : MozillaFirefox (openSUSE-2019-1056)

This update for MozillaFirefox fixes the following issues : Mozilla Firefox was updated to 60.6.1esr MFSA 2019-10 boo1130262 - CVE-2019-9810: IonMonkey MArraySlice has incorrect alias information - CVE-2019-9813: Ionmonkey type confusion with proto mutations Mozilla Firefox was updated to 60.6.0e...

Mozilla Firefox < 66.0

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 66.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-07 advisory. - A latent vulnerability exists in the Prio library where data may be read from uninitialized memory for some...

Photon OS 1.0: Openjdk PHSA-2017-0016

An update of the openjdk package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2017-0016. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid121693;...

Scientific Linux Security Update : kernel on SL7.x x86_64 (20190129)

Security Fixes : - kernel: Use-after-free due to race condition in AFPACKET implementation CVE-2018-18559 - kernel: userfaultfd bypasses tmpfs file permissions CVE-2018-18397 Bug Fixes : See the descriptions in the related Knowledge Article : C Tenable Network Security, Inc. The descriptive text ...

MySQL 5.6.x < 5.6.42 Multiple Vulnerabilities (October 2018 CPU)

The version of MySQL running on the remote host is 5.6.x prior to 5.6.42. It is, therefore, affected by multiple vulnerabilities as noted in the October 2018 Critical Patch Update advisory. Please consult the CVRF details for the applicable CVEs for additional information. Note that Nessus has no...

Amazon Linux 2 : qemu-kvm (ALAS-2018-1073)

A heap buffer overflow issue was found in the way SLiRP networking back-end in QEMU processes fragmented packets. It could occur while reassembling the fragmented datagrams of an incoming packet. A privileged user/process inside guest could use this flaw to crash the QEMU process resulting in DoS...

KB4284880: Windows 10 Version 1607 and Windows Server 2016 June 2018 Security Update

The remote Windows host is missing security update 4284880. It is, therefore, affected by multiple vulnerabilities : - An elevation of privilege vulnerability exists when the Human Interface Device HID Parser Library driver improperly handles objects in memory. An attacker who successfully...

RHEL 6 : kernel-rt (RHSA-2018:1354)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:1354 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirement...

Apache POI < 3.17 Multiple DoS Vulnerabilities

The version of Apache POI installed on the remote host is a version prior to 3.17. It is, therefore, affected by multiple DoS vulnerabilities. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 70300 C...

Debian DSA-4075-1 : thunderbird - security update

Multiple security issues have been found in Thunderbird, which may lead to the execution of arbitrary code, denial of service, information disclosure or spoofing of sender's email addresses. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugi...

OracleVM 3.3 : Unbreakable / etc (OVMSA-2017-0164)

The remote OracleVM system is missing necessary patches to address critical security updates : - mqueue: fix a use-after-free in sysmqnotify Cong Wang Orabug: 26643556 CVE-2017-11176 - ipv6: avoid overflow of offset in ip6find1stfragopt Sabrina Dubroca Orabug: 27011273 CVE-2017-7542 - packet: fix...

openSUSE Security Update : qemu (openSUSE-2017-589)

This update for qemu fixes several issues. These security issues were fixed : - CVE-2017-2620: In CIRRUSBLTMODEMEMSYSSRC mode the bitblit copy routine cirrusbitbltcputovideo failed to check the memory region, allowing for an out-of-bounds write that allows for privilege escalation bsc1024972 -...

VMware vCenter Server Appliance BlazeDS AMF3 RCE (VMSA-2017-0007)

The version of VMware vCenter Server Appliance installed on the remote host is 6.0 prior to Update 3b or 6.5 prior to Update c. It is, therefore, affected by a flaw in FlexBlazeDS when processing AMF3 messages due to allowing the instantiation of arbitrary classes when deserializing objects. An...