AlmaLinux 8 : kernel-rt (5565) (ALSA-2022:5565)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2022:5565 advisory. - kernel: race condition in perfeventopen leads to privilege escalation CVE-2022-1729 Note that Nessus has not tested for this issue but has instead relied only on...

KB5014692: Windows 10 version 1809 / Windows Server 2019 Security Update (June 2022)

The remote Windows host is missing security update 5014692. It is, therefore, affected by multiple vulnerabilities - Windows Network File System Remote Code Execution Vulnerability CVE-2022-30136 - Windows Kerberos Elevation of Privilege Vulnerability CVE-2022-30165 - Windows Lightweight Director...

SUSE SLES12: cluster-md-kmp-rt / dlm-kmp-rt / gfs2-kmp-rt / kernel-devel-rt / etc (SUSE-SU-2022:0555-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0555-1 advisory. The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security and bugfixes. The following security bugs were fixed: -...

Oracle Linux 8 : kernel (ELSA-2021-4056)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-4056 advisory. - RDMA/ucma: Rework ucmamigrateid to avoid races with destroy Kamal Heib 1982040 1931846 CVE-2020-36385 - RDMA/ucma: Fix locking for ctx-eventsreported...

PHP 7.3.x < 7.3.32 Privilege Escalation

According to its self-reported version number, the version of PHP running on the remote web server is 7.3.x priori to 7.3.32, 7.4.x prior to 7.4.25 or 8.0.x prior to 8.0.12. It is, therefore, affected by a privilege escalation vulnerability. The root FPM process can be forced to read/write at...

EulerOS 2.0 SP5 : glib2 (EulerOS-SA-2021-1898)

According to the versions of the glib2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in GNOME GLib before 2.66.7 and 2.67.x before 2.67.4. If gbytearraynewtake was called with a buffer of 4GB or more on a...

Fedora 32 : kernel / kernel-headers / kernel-tools (2021-14f6642aa6)

The remote Fedora 32 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2021-14f6642aa6 advisory. - An issue was discovered in the Linux kernel through 5.11.6. fastrpcinternalinvoke in drivers/misc/fastrpc.c does not prevent user applications fro...

AngularJS < 1.8.0 Cross-Site Scripting

According to its self-reported version number, AngularJS is prior to 1.8.0. Therefore, it may be affected by a a Cross-Site Scripting XSS vulnerability through the wrapping of elements in ones. Note that the scanner has not tested for these issues but has instead relied only on the application's...

FreeBSD : glpi -- Account takeover vulnerability (d3f60db0-3aea-11eb-af2a-080027dbe4b7)

MITRE Corporation reports : GLPI through 9.4.3 is prone to account takeover by abusing the ajax/autocompletion.php autocompletion feature. The lack of correct validation leads to recovery of the token generated via the password reset functionality, and thus an authenticated attacker can set an...

Oracle Linux 8 : firefox (ELSA-2020-4317)

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-4317 advisory. 78.4.0-1.0.1 - Removed Upstream references - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file 78.4.0-1 - Update to 78.4.0...

Oracle Linux 6 : firefox (ELSA-2020-3233)

The remote Oracle Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-3233 advisory. 68.11.0-1.0.1 - fix LDLIBRARYPATH - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat one Thu Jul 23 2020 Jan Horak - Update to...

CentOS 7 : thunderbird (RHSA-2020:2050)

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2050 advisory. - A race condition when running shutdown code for Web Worker led to a use-after-free vulnerability. This resulted in a potentially exploitable crash...

RHEL 7 : java-1.7.1-ibm (RHSA-2019:4110)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:4110 advisory. IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update upgrades IB...

Fedora 31 : apache-commons-beanutils (2019-bcad44b5d6)

Update to version 1.9.4. Resolves CVE-2019-10086. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. ...

EulerOS 2.0 SP5 : binutils (EulerOS-SA-2019-1799)

According to the versions of the binutils packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - elflink.c in the Binary File Descriptor BFD library aka libbfd, as distributed in GNU Binutils 2.28, has a 'member access within null pointer'...

Oracle Linux 8 : kernel (ELSA-2019-1479)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-1479 advisory. - net tcp: enforce tcpminsndmss in tcpmtuprobing Florian Westphal 1719922 1719923 CVE-2019-11479 - net tcp: add tcpminsndmss sysctl Florian Westphal...

openSUSE Security Update : MozillaThunderbird (openSUSE-2019-664)

This update for MozillaThunderbird to version 60.0 fixes the following issues : These security issues were fixed : - CVE-2018-12359: Prevent buffer overflow using computed size of canvas element bsc1098998. - CVE-2018-12360: Prevent use-after-free when using focus bsc1098998. - CVE-2018-12361:...

Oracle Linux 6 : thunderbird (ELSA-2019-0159)

The remote Oracle Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2019-0159 advisory. 60.4.0-1.0.1 - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js 60.4.0-1 - Update to 60.4.0 60.3.0-1 - Update to...

Fedora 27 : python-requests (2018-41320b315a)

Update to v2.20.0 - Includes fix for CVE-2018-18074 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...

MySQL 5.6.x < 5.6.42 Multiple Vulnerabilities (October 2018 CPU)

The version of MySQL running on the remote host is 5.6.x prior to 5.6.42. It is, therefore, affected by multiple vulnerabilities as noted in the October 2018 Critical Patch Update advisory. Please consult the CVRF details for the applicable CVEs for additional information. Note that Nessus has no...

PHP 7.2.x < 7.2.3 Stack Buffer Overflow

According to its banner, the version of PHP running on the remote web server is 7.2.x prior to 7.2.3. It is, therefore, affected by a stack buffer overflow vulnerability. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

RHEL 5 : kernel (RHSA-2018:0292)

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:0292 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: An industry-wide issue was found in th...

CentOS 6 : kernel (CESA-2018:0008) (Meltdown) (Spectre)

An update for kernel is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

Debian DSA-4075-1 : thunderbird - security update

Multiple security issues have been found in Thunderbird, which may lead to the execution of arbitrary code, denial of service, information disclosure or spoofing of sender's email addresses. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugi...

OracleVM 3.3 : Unbreakable / etc (OVMSA-2017-0164)

The remote OracleVM system is missing necessary patches to address critical security updates : - mqueue: fix a use-after-free in sysmqnotify Cong Wang Orabug: 26643556 CVE-2017-11176 - ipv6: avoid overflow of offset in ip6find1stfragopt Sabrina Dubroca Orabug: 27011273 CVE-2017-7542 - packet: fix...

Oracle Linux 6 : wpa_supplicant (ELSA-2017-2911)

The remote Oracle Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2017-2911 advisory. - Fix backport errors CVE-2017-13077, CVE-2017-13080 Tenable has extracted the preceding description block directly from the Oracle Linux security...

SUSE SLES12 Security Update : kernel (SUSE-SU-2017:2510-1)

This update for the Linux Kernel 3.12.61-5266 fixes several issues. The following security bugs were fixed : - CVE-2017-1000112: Prevent a race condition in net-packet code that could have been exploited by unprivileged users to gain root access bsc1052368. Note that Tenable Network Security has...

RHEL 6 : kernel (RHSA-2017:2428)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2017:2428 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: The NFSv2 and NFSv3 server implementations in t...

SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2017:0864-1)

The SUSE Linux Enterprise 12 kernel was updated to fix the following security bugs : - CVE-2017-7184: The Linux kernel allowed local users to obtain root privileges or cause a denial of service heap-based out-of-bounds access via unspecified vectors, as demonstrated during a Pwn2Own competition a...

RHEL 6 : kernel (RHSA-2016:2105)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2016:2105 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: A race condition was found in the way the Linux...

GLSA-201606-10 : PHP: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201606-10 PHP: Multiple vulnerabilities Multiple vulnerabilities have been discovered in PHP. Please review the CVE identifiers referenced below for details. Impact : An attacker can possibly execute arbitrary code or create a...

RHEL 7 : samba (RHSA-2016:0618)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:0618 advisory. Samba is an open-source implementation of the Server Message Block SMB protocol and the related Common Internet File System CIFS protocol,...

Fedora 22 : glibc-2.21-11.fc22 (2016-0480defc94)

This updates addresses a critical security vulnerability in the DNS resolver related to AFUNSPEC queries with getaddrinfo CVE-2015-7547. It also includes security fixes for CVE-2015-8777 and CVE-2015-1781. It improves malloc scalability for applications which start and terminate many threads. The...

openSUSE Security Update : xen (openSUSE-2015-893)

This update fixes the following security issues : - bsc947165 - CVE-2015-7311: xen: libxl fails to honour readonly flag on disks with qemu-xen xsa-142 - bsc954405 - CVE-2015-8104: Xen: guest to host DoS by triggering an infinite loop in microcode via DB exception - bsc954018 - CVE-2015-5307: xen:...

RHEL 5 : java-1.7.0-ibm (RHSA-2015:1007) (Bar Mitzvah)

Updated java-1.7.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 5 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity...

GLSA-201408-12 : Apache HTTP Server: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201408-12 Apache HTTP Server: Multiple vulnerabilities Multiple vulnerabilities have been found in Apache HTTP Server. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could send a special...

Ipswitch IMail Server 11.x / 12.x < 12.4.1.15 Multiple Vulnerabilities (Heartbleed)

The remote host appears to be running Ipswitch IMail Server 11.x or 12.x older than version 12.4.1.15 and is, therefore, potentially affected by the following vulnerabilities : - An error exists related to the implementation of the Elliptic Curve Digital Signature Algorithm ECDSA that could allow...

openSUSE Security Update : seamonkey (seamonkey-4113)

Mozilla SeaMonkey was updated to version 2.0.12, fixing various security issues. Following security issues were fixed: MFSA 2011-01: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed...

Oracle Linux 5 / 6 : openssl097a / and / openssl098e (ELSA-2014-0626)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2014-0626 advisory. - fix for CVE-2014-0224 - SSL/TLS MITM vulnerability Tenable has extracted the preceding description block directly from the Oracle Linux security advisory...

RHEL 5 : kvm (RHSA-2014:0163)

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:0163 advisory. KVM Kernel-based Virtual Machine is a full virtualization solution for Linux on AMD64 and Intel 64 systems. KVM is a Linux kernel module bui...

RHEL 5 / 6 : java-1.7.0-ibm (RHSA-2013:1060)

Updated java-1.7.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6 Supplementary. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System CVSS base scores, which give...

Ubuntu 12.04 LTS : linux-lts-quantal vulnerabilities (USN-1834-1)

A buffer overflow vulnerability was discovered in the Broadcom tg3 ethernet driver for the Linux kernel. A local user could exploit this flaw to cause a denial of service crash the system or potentially escalate privileges on the system. CVE-2013-1929 A flaw was discovered in the Linux kernel's...

Mac OS X : Java for OS X 2013-003

The remote Mac OS X 10.7 or 10.8 host has a Java runtime that is missing the Java for OS X 2013-003 update, which updates the Java version to 1.6.045. It is, therefore, affected by multiple security vulnerabilities, the most serious of which may allow an untrusted Java applet to execute arbitrary...

Ubuntu 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : firefox regression (USN-1548-2)

USN-1548-1 fixed vulnerabilities in Firefox. The new package caused a regression in Private Browsing which could leak sites visited to the browser cache. This update fixes the problem. Gary Kwong, Christian Holler, Jesse Ruderman, Steve Fink, Bob Clary, Andrew Sutherland, Jason Smith, John...

RHEL 6 : kernel (RHSA-2011:1849)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:1849 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security fix: Using the SGIO IOCTL to issue SCSI...

Mac OS X 10.6 < 10.6.8 Multiple Vulnerabilities

Binary data 5968.prm...

BlogEngine.NET api/BlogImporter.asmx GetFile Function Unauthorized Access

The web server hosts BlogEngine.NET, an open source .NET blogging project. An install of the software on the remote host allows unauthenticated access to the 'GetFile' function of the 'api/BlogImporter.asmx' script. An unauthenticated, remote attacker may be able to abuse this function to copy...

Mozilla Firefox < 3.5.10 Multiple Vulnerabilities

Binary data 5579.prm...

openSUSE Security Update : kdelibs3 (kdelibs3-1648)

KDE KDELibs Remote Array Overrun Arbitrary code execution, CVE-2009-0689 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update kdelibs3-1648. The text description of this plugin is C SUSE LLC...

SuSE9 Security Update : Apache 2 (YOU Patch Number 12526)

This update of the Apache webserver fixes various security issues : - modproxy could run into an infinite loop when used as reverse proxy. CVE-2009-1890 - moddeflate continued to compress large files even after a network connection was closed, causing moddeflate to consume large amounts of CPU...