Default Password 'Zte521' for 'root' Account

The account 'root' on the remote host has the default password 'Zte521'. A remote attacker can exploit this issue to gain administrative access to the affected system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. account = "root"; password = "Zte521"; include'deprecatednasllevel.inc';...

SSH Server Type and Version Information

It is possible to obtain information about the remote SSH server by sending an empty authentication request. TRUSTED...

Firewall UDP Packet Source Port 53 Ruleset Bypass

It is possible to bypass the rules of the remote firewall by sending UDP packets with a source port equal to 53. An attacker may use this flaw to inject UDP packets to the remote hosts, in spite of the presence of a firewall. C Tenable Network Security, Inc. Problem: This check is prone to false...

phpMyAdmin grab_globals.lib.php subform Parameter Traversal Local File Inclusion

The version of phpMyAdmin installed on the remote host allows attackers to read and possibly execute code from arbitrary files on the local host because of its failure to sanitize the parameter 'subform' before using it in the 'libraries/grabglobals.lib.php' script. %NASLMINLEVEL 70300 C Tenable...

MS15-124: Cumulative Security Update for Internet Explorer (3116180)

The version of Internet Explorer installed on the remote host is missing Cumulative Security Update 3116180. It is, therefore, affected by multiple vulnerabilities, the majority of which are remote code execution vulnerabilities. An unauthenticated, remote attacker can exploit these issues by...

Allegro RomPager HTTP Cookie Management Remote Code Execution Vulnerability (Misfortune Cookie)

According to its banner, the remote host is running a version of Allegro Software RomPager 4.07 to 4.33. It is, therefore, affected by multiple vulnerabilities : - A flaw in HTTP cookie management in the embedded web server allows a remote attacker to execute arbitrary code with administrative...

IBM Domino ZMerge Database Security Bypass

The version of IBM Domino formerly IBM Lotus Domino running on the remote host is affected by a security bypass vulnerability due to insufficient access control list ACL settings on the administration databases for ZMerge. An unauthenticated, remote attacker can exploit this issue to disclose...

Apache 2.4.x < 2.4.28 HTTP Vulnerability (OptionsBleed)

According to its banner, the version of Apache running on the remote host is 2.4.x prior to 2.4.28. It is, therefore, affected by an HTTP vulnerability related to the directive in an .htaccess file. Note that Nessus has not tested for these issues but has instead relied only on the application's...

Web Server Generic 3xx Redirect

The remote web server is configured to redirect users using a HTTP 302, 303 or 307 response. However, the server can redirect to a domain that includes components included in the original request. A remote attacker could exploit this by crafting a URL which appears to resolve to the remote server...

FTP Privileged Port Bounce Scan

It is possible to force the remote FTP server to connect to third parties using the PORT command. The problem allows intruders to use your network resources to scan other hosts, making them think the attack comes from your network. TRUSTED...

DokuWiki Detection

The remote host is running DokuWiki, an open source wiki application written in PHP. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid24711; scriptversion"1.16"; scriptsetattributeattribute:"pluginmodificationdate", value:"2023/05/24"; scriptnameenglish:"DokuWiki...

Web Server No 404 Error Code Check

The remote web server is configured such that it does not return '404 Not Found' error codes when a nonexistent file is requested, perhaps returning instead a site map, search page or authentication page. Nessus has enabled some counter measures for this. However, they might be insufficient. If a...

Webmin < 1.930 Remote Code Execution Vulnerability

A remote code execution vulnerability exists in reset password component due to an insecure default configuration. An unauthenticated, remote attacker can exploit this to bypass authentication and execute arbitrary commands with root privileges. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

Microsoft Windows Guest Account Belongs to a Group

Using the supplied credentials, Nessus was able to determine that the 'Guest' user belongs to groups other than 'Guests' RID 546 or 'Domain Guests' RID 514. Guest users should not have any additional privileges. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid10907;...

ManageEngine OpManager Default Credentials

The remote ManageEngine OpManager web administration interface uses a known set of hard-coded default credentials. An attacker can use these to gain administrative access to the remote host. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'...

PHP 7.0.x < 7.0.33 Multiple vulnerabilities

According to its banner, the version of PHP running on the remote web server is 7.0.x prior to 7.0.33. It is, therefore, affected by multiple vulnerabilities: - An arbitrary command injection vulnerability exists in the imapopen function due to improper filters for mailbox names prior to passing...

Ubuntu 20.04 LTS / 22.04 LTS / 23.04 : OpenSSH vulnerability (USN-6242-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by a vulnerability as referenced in the USN-6242-1 advisory. It was discovered that OpenSSH incorrectly handled loading certain PKCS11 providers. If a user forwarded their ssh-agent to an untrusted syste...

Web Server HTTP Header Information Disclosure

The HTTP headers sent by the remote web server disclose information that can aid an attacker, such as the server version and languages used by the web server. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid88099; scriptversion"1.9"; scriptcvsdate"Date: 2019/04/30...

Service Detection (GET request)

It was possible to identify the remote service by its banner or by looking at the error message it sends when it receives an HTTP request. C Tenable, Inc. include"compat.inc"; if description scriptid17975; scriptversion"1.395"; scriptsetattributeattribute:"pluginmodificationdate",...

Oracle Java SE 1.7.0_311 / 1.8.0_301 / 1.11.0_12 / 1.16.0_2 Multiple Vulnerabilities (Unix July 2021 CPU)

The version of Oracle formerly Sun Java SE or Java for Business installed on the remote host is prior to 7 Update 301, 8 Update 291, 11 Update 11, or 16 Update 1. It is, therefore, affected by multiple vulnerabilities as referenced in the July 2021 CPU advisory: - Vulnerability in the Java SE,...

Oracle WebLogic Server Multiple Vulnerabilities (Oct 2020 CPU)

The version of WebLogic Server installed on the remote host is affected by multiple vulnerabilities as referenced in the October 2020 CPU advisory. - An unspecified vulnerability exists in the Console component. An unauthenticated, remote attacker with network access via HTTP can exploit this iss...

SMB Use Host SID to Enumerate Local Users Without Credentials

Using the host security identifier SID, Nessus was able to enumerate local users on the remote Windows system, without credentials. C Tenable Network Security, Inc. @PREFERENCES@ include'compat.inc'; if description scriptid56211; scriptversion"1.13";...

Windows PrintNightmare Registry Exposure CVE-2021-34527 OOB Security Update RCE (July 2021)

A remote command execution vulnerability exists in Windows Print Spooler service improperly performs privileged file operations. An authenticated, remote attacker can exploit this to bypass and run arbitrary code with SYSTEM privileges. The remote system is not fully secure as the point and print...

FileZilla Server < 0.9.44 OpenSSL Heartbeat Information Disclosure (Heartbleed)

According to its banner, the version of FileZilla Server running on the remote host is prior to 0.9.44. It is, therefore, affected by an information disclosure vulnerability. An information disclosure flaw exists with the OpenSSL included with FileZilla Server. A remote attacker could read the...

MySQL 5.5.x < 5.5.60 Multiple Vulnerabilities (RPM Check) (April 2018 CPU)

The version of MySQL running on the remote host is 5.5.x prior to 5.5.60. It is, therefore, affected by multiple vulnerabilities as noted in the April 2018 Critical Patch Update advisory. Please consult the CVRF details for the applicable CVEs for additional information. Note that Nessus has not...

Web Server HTTP Header Memory Exhaustion DoS

It was possible to kill the web server by sending an invalid 'infinite' HTTP request that never ends, like: GET / HTTP/1.0 Referer: XXXXXXXXXXXXXXXXXXXXXXXX ... An attacker may exploit this vulnerability to make your web server crash continually if the attack saturates virtual memory on the targe...

RHEL 9 : compat-openssl11 (RHSA-2022:4899)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2022:4899 advisory. OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols, as well as a full-strength...

PHP 7.2 < 7.2.34 / 7.3.x < 7.3.23 / 7.4.x < 7.4.11 Mulitiple Vulnerabilities

According to its self-reported version number, the version of PHP running on the remote web server is 7.2.x prior to 7.2.34, 7.3.x prior to 7.3.23 or 7.4.x prior to 7.4.11. It is, therefore, affected by multiple vulnerabilties: - A weak cryptography vulnerability exists in PHP's opensslencrypt...

HP System Management Homepage < 7.6 Multiple Vulnerabilities (HPSBMU03653) (httpoxy)

According to its banner, the version of HP System Management Homepage SMH hosted on the remote web server is prior to 7.6. It is, therefore, affected by the following vulnerabilities : - A heap buffer overflow condition exists in OpenSSL in the EVPEncodeUpdate function within file...

The Microsoft Windows Support Diagnostic Tool (MSDT) RCE Workaround Detection (CVE-2022-30190)

The remote host has the HKEYCLASSESROOT\ms-msdt registry key. This is a known exposure for CVE-2022-30190. Note that Nessus has not tested for CVE-2022-30190. It is only checking if the registry key exists. The recommendation is to apply the latest patch. C Tenable, Inc. include'compat.inc'; if...

Oracle WebLogic Server Multiple Vulnerabilities (July 2017 CPU)

The version of Oracle WebLogic Server installed on the remote host is affected by multiple vulnerabilities : - A flaw exists in Jython due to executable classes being created with insecure permissions. A local attacker can exploit this to bypass intended access restrictions and thereby disclose...

ISC BIND Allow-Recursion Vulnerability

According to its self-reported version, the instance of ISC BIND 9 running on the remote name server is 9.9.12, 9.10.7, 9.11.3, 9.12.0 prior to or equal to 9.12.1-P2, development release 9.13.0, 9.9.12-S1, 9.11.3-S1, or 9.11.3-S2. It is, therefore, affected by an allow-recursion vulnerability whi...

Apache Tomcat 9.0.35 < 9.0.58 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 9.0.58. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat9.0.58security-9 advisory. - When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to...

OS Identification : HTML

Nessus was able to identify the remote operating system by examining the HTML returned from certain HTTP requests. C Tenable, Inc. include"compat.inc"; if description scriptid35779; scriptversion"1.149"; scriptsetattributeattribute:"pluginmodificationdate", value:"2026/03/26"; scriptnameenglish:"...

SMTP Server Non-standard Port Detection

This SMTP server is running on a non-standard port. This might be a backdoor set up by attackers to send spam or even control of a targeted machine. C Tenable Network Security, Inc. References: RFC 2645 On-Demand Mail Relay ODMR SMTP with Dynamic IP Addresses include"compat.inc"; if description...

TLS Version 1.1 Deprecated Protocol

The remote service accepts connections encrypted using TLS 1.1. TLS 1.1 lacks support for current and recommended cipher suites. Ciphers that support encryption before MAC computation, and authenticated encryption modes such as GCM cannot be used with TLS 1.1 As of March 31, 2020, Endpoints that...

AWStats awstats.pl configdir Parameter Arbitrary Command Execution

The remote host is running AWStats, a free logfile analysis tool for analyzing ftp, mail, web, ... traffic. The remote version of this software fails to sanitize user-supplied input to the 'configdir' parameter of the 'awstats.pl' script. An attacker may exploit this condition to execute commands...

Security Updates for Microsoft Defender (April 2020)

The version of Microsoft Malware Protection Signature Update Stub MpSigStub.exe installed on the remote Windows host is prior to 1.1.16638.0. It is, therefore, affected by a elevation of privilege vulnerability which could allow an attacker who successfully exploited this vulnerability to elevate...

Web Server Uses Basic Authentication Without HTTPS

The remote web server contains web pages that are protected by 'Basic' authentication over cleartext. An attacker eavesdropping the traffic might obtain logins and passwords of valid users. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid34850; scriptversion"$Revision...

SSL Cipher Suites Supported

This plugin detects which SSL ciphers are supported by the remote service for encrypting communications. TRUSTED...

Treck TCP/IP stack multiple vulnerabilities. (Ripple20)

This plugin detects the usage of the Treck TCP/IP stack by the host thereby indicating that it could be potentially vulnerable to the Ripple20 vulnerabilities. Patches are being slowly rolled out by vendors and we will release plugins for patches as they are released by the vendors. In the interi...

Return Of Bleichenbacher's Oracle Threat (ROBOT) Information Disclosure

The remote host is affected by an information disclosure vulnerability. The SSL/TLS service supports RSA key exchanges, and incorrectly leaks whether or not the RSA key exchange sent by a client was correctly formatted. This information can allow an attacker to decrypt previous SSL/TLS sessions o...

PHP 7.4.x < 7.4.30 Multiple Vulnerabilities

The version of PHP installed on the remote host is prior to 7.4.30. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 7.4.30 advisory. - In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplyi...

OpenSSH < 9.8 RCE

The version of OpenSSH installed on the remote host is prior to 9.8. It is, therefore, affected by a vulnerability as referenced in the release-9.8 advisory. - This release contains fixes for two security problems, one critical and one minor. 1 Race condition in sshd8 A critical vulnerability in...

MySQL 5.5.x < 5.5.59 Multiple Vulnerabilities (January 2018 CPU)

The version of MySQL running on the remote host is 5.5.x prior to 5.5.59. It is, therefore, affected by multiple vulnerabilities as noted in the January 2018 Critical Patch Update advisory. Please consult the CVRF details for the applicable CVEs for additional information. Note that Nessus has no...

OpenSSH >= 2.3.0 AllowTcpForwarding Port Bouncing

According to its banner, the remote host is running OpenSSH, version 2.3.0 or later. Such versions of OpenSSH allow forwarding TCP connections. If the OpenSSH server is configured to allow anonymous connections e.g. AnonCVS, remote, unauthenticated users could use the host as a proxy. C Tenable,...

MS14-057: Vulnerabilities in .NET Framework Could Allow Remote Code Execution (3000414)

The remote Windows host has a version of the Microsoft .NET Framework that is affected by a vulnerability that allows a remote attacker to to execute code remotely. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid78432; scriptversion"1.11"; scriptcvsdate"Date:...

Dragonfly CMS install.php newlang Parameter Local File Inclusion

The remote host appears to be running Dragonfly / CPG-Nuke CMS, a content management system written in PHP. The installed version of Dragonfly / CPG-Nuke CMS fails to validate user input to the 'getlang' parameter as well as the 'installlang' cookie before using them in the 'install.php' script i...

Microsoft Windows Installed Hotfixes

Using the supplied credentials, Nessus was unable to log into the remote Windows host, enumerate installed hotfixes, or store them in its knowledge base for other plugins to use. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include"compat.inc"; if...

NFS Share User Mountable

Nessus was either able to mount some of the NFS shares exported by the remote server or disclose potentially sensitive information such as a directory listing. An attacker may exploit this issue to gain read and possibly write access to files on remote host. Note that root privileges were not...