OpenJDK 8 <= 8u392 / 11.0.0 <= 11.0.21 / 17.0.0 <= 17.0.9 / 21.0.0 <= 21.0.1 Multiple Vulnerabilities (2024-01-16

The version of OpenJDK installed on the remote host is prior to 8 = 8u392 / 11.0.0 = 11.0.21 / 17.0.0 = 17.0.9 / 21.0.0 = 21.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the 2024-01-16 advisory. Please Note: Java CVEs do not always include OpenJDK versions, but are...

GLSA-202211-01 : OpenSSL: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202211-01 OpenSSL: Multiple Vulnerabilities - A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and...

SUSE SLES12 Security Update : kernel (Live Patch 26 for SLE 12 SP4) (SUSE-SU-2022:3373-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3373-1 advisory. This update for the Linux Kernel 4.12.14-9596 fixes several issues. The following security issues were fixed: - CVE-2022-39188: Fixed a race...

Security Updates for Microsoft Office Products C2R (July 2022)

The Microsoft Office Products are missing a security update. It is, therefore, affected by the following vulnerability: - A security feature bypass vulnerability exists. An attacker can exploit this and bypass the security feature and perform unauthorized actions compromising the integrity of the...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2022-019)

The version of kernel installed on the remote host is prior to 5.4.91-41.139. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2022-019 advisory. A flaw was found in the JFS filesystem code. This flaw allows a local attacker with the ability to set...

openSUSE 15 Security Update : nodejs12 (openSUSE-SU-2022:0657-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:0657-1 advisory. - All versions of package path-parse are vulnerable to Regular Expression Denial of Service ReDoS via splitDeviceRe, splitTailRe, and...

Oracle Linux 8 : python39:3.9 / and / python39-devel:3.9 (ELSA-2021-4160)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-4160 advisory. - Security fix for CVE-2021-28957 Resolves: rhbz1941534 - Fixes CVE-2020-27783 and another vulnerability in the HTML Cleaner - Fix for CVE-2021-33503...

CentOS 8 : annobin (CESA-2021:4593)

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:4593 advisory. - Developer environment: Unicode's bidirectional BiDi override characters can cause trojan source attacks CVE-2021-42574 Note that Nessus has not tested for thi...

CentOS 8 : pcs (CESA-2021:4142)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4142 advisory. - jquery: Untrusted code execution via tag in HTML passed to DOM manipulation methods CVE-2020-11023 - jquery: Cross-site scripting XSS via HTML tags...

Oracle Linux 8 : java-1.8.0-openjdk (ELSA-2021-3893)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-3893 advisory. 1:1.8.0.312.b07-1 - Update to aarch64-shenandoah-jdk8u312-b07 EA - Update release notes for 8u312-b07. - Switch to GA mode for final release. - This...

KB5005030: Windows 10 Version 1809 and Windows Server 2019 Security Update (August 2021)

The remote Windows host is missing security update 5005030. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. CVE-2021-26424, CVE-2021-26432,...

Oracle Linux 7 : java-1.8.0-openjdk (ELSA-2021-2845)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-2845 advisory. 1:1.8.0.302.b08-0 - Update to aarch64-shenandoah-jdk8u302-b08 EA - Update release notes for 8u302-b08. - Switch to GA mode for final release. - This...

EulerOS Virtualization 3.0.6.6 : qemu (EulerOS-SA-2021-1455)

According to the versions of the qemu packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - hw/ide/pci.c in QEMU before 5.1.1 can trigger a NULL pointer dereference because it lacks a pointer check before an idecanceldmasyn...

RHEL 8 : mariadb:10.3 (RHSA-2020:5665)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5665 advisory. MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. The following packages have been upgraded ...

Oracle Solaris Critical Patch Update : oct2020_SRU11_3_36_23_0

This Solaris system is missing necessary patches to address a critical security update : - Vulnerability in the Oracle Solaris product of Oracle Systems component: Pluggable authentication module. Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows...

RHEL 8 : virt:rhel (RHSA-2020:1358)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1358 advisory. Kernel-based Virtual Machine KVM offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contai...

Oracle Linux 6 : firefox (ELSA-2020-3233)

The remote Oracle Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-3233 advisory. 68.11.0-1.0.1 - fix LDLIBRARYPATH - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat one Thu Jul 23 2020 Jan Horak - Update to...

RHEL 8 : firefox (RHSA-2020:3241)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:3241 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox...

Mozilla Firefox ESR < 68.9

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 68.9. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-21 advisory. - Mozilla developers Tom Tung and Karl Tomlinson reported memory safety bugs present in Firefox 76 and...

Photon OS 1.0: Python2 PHSA-2020-1.0-0288

An update of the python2 package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-1.0-0288. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

MikroTik RouterOS DNS Cache Poisoning (CVE-2019-3978)

Binary data mikrotikcve-2019-3978.nbin...

RHEL 7 : kpatch-patch (RHSA-2019:4171)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:4171 advisory. This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify the code of a running kernel. Security Fix:...

EulerOS 2.0 SP5 : php (EulerOS-SA-2019-1795)

According to the versions of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The filecheckmem function in funcs.c in file before 5.23, as used in the Fileinfo component in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x befo...

Ubuntu 16.04 LTS / 18.04 LTS : LibreOffice vulnerabilities (USN-4063-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4063-1 advisory. Nils Emmerich discovered that LibreOffice incorrectly handled LibreLogo scripts. If a user were tricked into opening a specially crafted...

RHEL 7 : redhat-virtualization-host (RHSA-2019:1699)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1699 advisory. The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host,...

Mozilla Firefox ESR < 60.5.1

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 60.5.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-05 advisory. - A use-after-free vulnerability in the Skia library can occur when creating a path, leading to a...

Security Updates for Microsoft Visual Studio Products (December 2018)

The Microsoft Visual Studio Products are missing a security update. It is, therefore, affected by the following vulnerability : - An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector Service improperly impersonates certain file operations. An attacker who...

Amazon Linux AMI : java-1.7.0-openjdk (ALAS-2018-1007)

Unbounded memory allocation during deserialization in NamedNodeMapImpl JAXP, 8189993 Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE subcomponent: JAXP. Supported versions that are affected are Java SE: 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit:...

OracleVM 3.3 : Unbreakable / etc (OVMSA-2017-0164)

The remote OracleVM system is missing necessary patches to address critical security updates : - mqueue: fix a use-after-free in sysmqnotify Cong Wang Orabug: 26643556 CVE-2017-11176 - ipv6: avoid overflow of offset in ip6find1stfragopt Sabrina Dubroca Orabug: 27011273 CVE-2017-7542 - packet: fix...

Security Updates for Microsoft Skype for Business and Microsoft Lync and Microsoft Live Meeting (September 2017)

The Microsoft Skype for Business or Microsoft Lync or Microsoft Live Meeting installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists when Windows Uniscribe improperly discloses the...

Amazon Linux AMI : php70 (ALAS-2017-867)

Out-of-bounds heap write in bitsetsetrange : An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write occurs in bitsetsetrange during regular expression compilation due to an uninitialized variable fro...

Windows 8.1 and Windows Server 2012 R2 June 2017 Security Updates

The remote Windows host is missing security update 4022717 or cumulative update 4022726. It is, therefore, affected by multiple vulnerabilities : - An elevation of privilege vulnerability exists in Windows Hyper-V instruction emulation due to a failure to properly enforce privilege levels. An...

Fedora 22 : glibc-2.21-11.fc22 (2016-0480defc94)

This updates addresses a critical security vulnerability in the DNS resolver related to AFUNSPEC queries with getaddrinfo CVE-2015-7547. It also includes security fixes for CVE-2015-8777 and CVE-2015-1781. It improves malloc scalability for applications which start and terminate many threads. The...

Scientific Linux Security Update : nss on SL6.x, SL7.x i386/x86_64 (20160107) (SLOTH)

A flaw was found in the way TLS 1.2 could use the MD5 hash function for signing ServerKeyExchange and Client Authentication packets during a TLS handshake. A man-in-the-middle attacker able to force a TLS connection to use the MD5 hash function could use this flaw to conduct collision attacks to...

Fedora 23 : icu-54.1-5.fc23 (2015-16315)

Security fix for CVE-2014-6585 CVE-2014-6591 CVE-2014-7923 CVE-2014-7926 CVE-2014-9654 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible withou...

openSUSE Security Update : php5 (openSUSE-2015-352)

PHP was updated to fix three security issues. The following vulnerabilities were fixed : - CVE-2015-3330: Specially crafted PHAR files could, when executed under Apache httpd 2.4 apache2handler, allow arbitrary code execution bnc928506 - CVE-2015-3329: Specially crafted PHAR data could lead to...

Mac OS X : Java for OS X 2014-001

The remote Mac OS X 10.7, 10.8, 10.9, or 10.10 host has a Java runtime that is missing the Java for OS X 2014-001 update, which updates the Java version to 1.6.065. It is, therefore, affected by multiple security vulnerabilities, the most serious of which may allow an untrusted Java applet to...

Ipswitch IMail Server 11.x / 12.x < 12.4.1.15 Multiple Vulnerabilities (Heartbleed)

The remote host appears to be running Ipswitch IMail Server 11.x or 12.x older than version 12.4.1.15 and is, therefore, potentially affected by the following vulnerabilities : - An error exists related to the implementation of the Elliptic Curve Digital Signature Algorithm ECDSA that could allow...

Oracle Linux 5 : kernel (ELSA-2014-0433)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-0433 advisory. - virt HID: memory corruption flaw drivers/usb/input/hid-core.c Jacob Tanenbaum 1032996 1032999 CVE-2013-2888 - virt HID: memory corruption flaw in...

Jetpack Plugin for WordPress Security Bypass

The WordPress Jetpack plugin installed on the remote host is affected by a security bypass vulnerability due to a flaw in the 'class.jetpack.php' script. This can allow a remote, unauthenticated attacker to submit crafted XML-RPC requests that bypass access controls, allowing the attacker to...

RHEL 5 / 6 : java-1.7.0-ibm (RHSA-2013:1060)

Updated java-1.7.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6 Supplementary. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System CVSS base scores, which give...

Oracle Linux 5 : kernel (ELSA-2008-0612)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2008-0612 advisory. - tty add NULL pointer checks Aristeu Rozanski 453425 453154 CVE-2008-2812 - net sctp: make sure sctpaddr does not overflow David S. Miller 452482 4524...

RHEL 5 / 6 : firefox (RHSA-2013:0144)

Updated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings...

Mac OS X Multiple Vulnerabilities (Security Update 2012-004) (BEAST)

The remote host is running a version of Mac OS X 10.6 that does not have Security Update 2012-004 applied. This update contains multiple security-related fixes for the following components : - Apache - Data Security - DirectoryService - ImageIO - International Components for Unicode - Mail - PHP ...

Scientific Linux Security Update : samba on SL5.x, SL4.x, SL3.x i386/x86_64

A stack-based buffer overflow flaw was found in the way Samba authenticates remote users. A remote unauthenticated user could trigger this flaw to cause the Samba server to crash, or execute arbitrary code with the permissions of the Samba server. CVE-2007-6015 This update also fixes a regression...

BlogEngine.NET api/BlogImporter.asmx GetFile Function Unauthorized Access

The web server hosts BlogEngine.NET, an open source .NET blogging project. An install of the software on the remote host allows unauthenticated access to the 'GetFile' function of the 'api/BlogImporter.asmx' script. An unauthenticated, remote attacker may be able to abuse this function to copy...

SuSE 10 Security Update : OpenSSL (ZYPP Patch Number 6655)

The TLS/SSLv3 protocol as implemented in openssl prior to this update was not able to associate data to a renegotiated connection. This allowed man-in-the-middle attackers to inject HTTP requests in a HTTPS session without being noticed. For example Apache's modssl was vulnerable to this kind of...

SuSE 10 Security Update : IBM Java 1.4.2 (ZYPP Patch Number 6523)

IBM Java 1.4.2 was updated to SR13 FP1. It fixes following two security issues: CVE-2009-2625: A vulnerability in the Java Runtime Environment JRE with parsing XML data might allow a remote client to create a denial-of-service condition on the system that the JRE runs on. - A vulnerability in how...

HP-UX PHNE_40339 : s700_800 11.23 BIND 9.2.0 Revision 5.0

s700800 11.23 BIND 9.2.0 Revision 5.0 : The remote HP-UX host is affected by multiple vulnerabilities : - A potential security vulnerability has been identified with HP-UX running BIND. The vulnerability could be exploited remotely to create a Denial of Service DoS and permit unauthorized...

RHEL 4 : kernel (RHSA-2009:1541)

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2009:1541 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. This update fixes the following security issues: a NULL pointer...