346916 matches found
GNOME Shell <= 45.7 Code Execution in Portal Helper (CVE-2024-36472)
In GNOME Shell through 45.7, a portal helper can be launched automatically without user confirmation based on network responses provided by an adversary e.g., an adversary who controls the local Wi-Fi network, and subsequently loads untrusted JavaScript code, which may lead to resource consumptio...
Security Updates for Microsoft Visual Studio Products (August 2022)
The Microsoft Visual Studio Products are missing security updates. It is, therefore, affected by multiple vulnerabilities: - Fbx File parser Heap overflow Vulnerability. CVE-2022-35777, CVE-2022-35826 - Fbx File parser OOBW Vulnerability. CVE-2022-35825, CVE-2022-35827 Note that Nessus has not...
EulerOS 2.0 SP3 : vim (EulerOS-SA-2022-1193)
According to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - vim is vulnerable to Heap-based Buffer Overflow CVE-2021-3778, CVE-2021-3872, CVE-2021-3927 - vim is vulnerable to Use After Free CVE-2021-3796,...
AlmaLinux 8 : firefox (ALSA-2021:5013)
The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2021:5013 advisory. - Under certain circumstances, asynchronous functions could have caused a navigation to fail but expose the target URL. This vulnerability affects...
EulerOS Virtualization 3.0.2.6 : ruby (EulerOS-SA-2021-2866)
According to the versions of the ruby packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip...
Amazon Linux 2 : java-17-amazon-corretto, java-11-amazon-corretto, java-1.8.0-openjdk, java-1.7.0-openjdk (ALAS-2021-1731)
The version of java-1.7.0-openjdk installed on the remote host is prior to 1.7.0.261-2.6.22.2. The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.312.b07-1. The version of java-11-amazon-corretto installed on the remote host is prior to 11.0.13+8-2. The version of...
Security Updates for Microsoft Internet Explorer OOB (Sept 2021) (deprecated)
This plugin is a work-around and is being deprecated due other superceded Microsoft Security patches. See Nessus Plugin IDs: 153374, 153372, 153373, 153375, 153377, 153381, 153383 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. @DEPRECATED@ Disabled on 2021/09/23. Deprecated due to patch...
EulerOS Virtualization for ARM 64 3.0.6.0 : python3 (EulerOS-SA-2021-2007)
According to the versions of the python3 packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from...
AngularJS < 1.8.0 Cross-Site Scripting
According to its self-reported version number, AngularJS is prior to 1.8.0. Therefore, it may be affected by a a Cross-Site Scripting XSS vulnerability through the wrapping of elements in ones. Note that the scanner has not tested for these issues but has instead relied only on the application's...
EulerOS Virtualization 3.0.6.6 : perl (EulerOS-SA-2020-2459)
According to the versions of the perl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Perl before 5.30.3 has an integer overflow related to mishandling of a 'PLregkindOPn == NOTHING' situation. A crafted regular...
FreeBSD : libxml -- multiple vulnerabilities (f5abafc0-fcf6-11ea-8758-e0d55e2a8bf9)
CVE mitre reports : CVE-2019-20388 xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak. CVE-2020-7595 xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation. CVE-2020-24977 GNOME project libxml2...
openSUSE Security Update : python (openSUSE-2020-1257)
This update for python fixes the following issues : - CVE-2019-20907: Avoid a possible infinite loop caused by specifically crafted tarballs bsc1174091. This update was imported from the SUSE:SLE-15:Update update project. C Tenable Network Security, Inc. The descriptive text and package checks in...
Oracle Linux 8 : nodejs:10 (ELSA-2020-2848)
The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-2848 advisory. - Fixes CVE-2020-11080, CVE-2020-8174, CVE-2020-10531 Tenable has extracted the preceding description block directly from the Oracle Linux security...
CentOS 7 : thunderbird (RHSA-2020:2050)
The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2050 advisory. - A race condition when running shutdown code for Web Worker led to a use-after-free vulnerability. This resulted in a potentially exploitable crash...
Amazon Linux AMI : mysql56 (ALAS-2020-1332)
The version of mysql56 installed on the remote host is prior to 5.6.46-1.35. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1332 advisory. Vulnerability in the MySQL Server product of Oracle MySQL component: Information Schema. Supported versions that are...
openSUSE Security Update : qemu (openSUSE-2019-2510)
This update for qemu fixes the following issues : qemu was updated to v3.1.1.1, a stable, bug-fix-only release, which includes 2 fixes we already carry, as well as one additional use- after-free fix in slirp. CVE-2018-20126 bsc1119991, CVE-2019-14378 bsc1143794, and CVE-2019-15890 bsc1149811...
EulerOS 2.0 SP8 : kernel (EulerOS-SA-2019-2106)
According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The kernel package contains the Linux kernel vmlinuz, the core of any Linux operating system. The kernel handles the basic functions of the...
EulerOS 2.0 SP5 : expat (EulerOS-SA-2019-2145)
According to the versions of the expat packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An integer overflow during the parsing of XML using the Expat library. This vulnerability affects Firefox 50.CVE-2016-9063 - In libexpat before...
Photon OS 3.0: Linux PHSA-2019-3.0-0030
An update of the linux package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2019-3.0-0030. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid129163;...
RHEL 6 : kernel-rt (RHSA-2019:2730)
The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2730 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirement...
EulerOS Virtualization for ARM 64 3.0.2.0 : glibc (EulerOS-SA-2019-1703)
According to the version of the glibc packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - The iconv program in the GNU C Library aka glibc or libc6 2.25 and earlier, when invoked with the -c option, enters an...
Fedora 29 : kernel / kernel-headers / kernel-tools (2019-be9add5b77)
The 5.0.6 update contains a number of importnat fixes across the tree Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...
openSUSE Security Update : ImageMagick (openSUSE-2019-1141)
This update for ImageMagick fixes the following issues : Security issues fixed : - CVE-2019-7175: Fixed multiple memory leaks in DecodeImage function bsc1128649. - CVE-2018-18544: Fixed a memory leak in the function WriteMSLImage bsc1113064. - CVE-2018-20467: Fixed an infinite loop in coders/bmp....
Elasticsearch ESA-2019-04
A permission issue was found in Elasticsearch when Field Level Security and Document Level Security are disabled and the aliases, shrink, or split endpoints are used . If the elasticsearch.yml file has xpack.security.dlsfls.enabled set to false, certain permission checks are skipped when users...
SUSE SLED12 / SLES12 Security Update : tiff (SUSE-SU-2018:3289-1)
This update for tiff fixes the following issues : CVE-2018-17100: There is a int32 overflow in multiplyms in tools/ppm2tiff.c, which can cause a denial of service crash or possibly have unspecified other impact via a crafted image file. bsc1108637 CVE-2018-17101: There are two out-of-bounds write...
openSUSE Security Update : the Linux Kernel (openSUSE-2018-826)
The openSUSE Leap 15.0 kernel was updated to receive various security and bugfixes. The following security bugs were fixed : - CVE-2018-5390 aka 'SegmentSmack': A remote attacker even with relatively low bandwidth could have caused lots of CPU usage by triggering the worst case scenario during IP...
SUSE SLES12 Security Update : kernel (SUSE-SU-2018:2110-1)
This update for the Linux Kernel 3.12.74-606496 fixes one issue. The following security issue was fixed : - CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from...
Amazon Linux 2 : kernel (ALAS-2018-939) (Meltdown) (Spectre)
An updated kernel release for Amazon Linux has been made available which prevents speculative execution of indirect branches within the kernel. This release incorporates latest stable open source Linux security improvements to address CVE-2017-5715 within the kernel and builds upon previously...
EulerOS 2.0 SP1 : kernel (EulerOS-SA-2017-1245)
According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The iscsiifrx function in drivers/scsi/scsitransportiscsi.c in the Linux kernel through 4.13.2 allows local users to cause a denial of service...
EulerOS 2.0 SP2 : kernel (EulerOS-SA-2017-1072)
According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in the Linux kernel key management subsystem in which a local attacker could crash the kernel or corrupt the stack and addition...
SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2017:0571-1)
This update for xen fixes several issues. These security issues were fixed : - CVE-2017-2620: In CIRRUSBLTMODEMEMSYSSRC mode the bitblit copy routine cirrusbitbltcputovideo failed to check the memory region, allowing for an out-of-bounds write that allows for privilege escalation bsc1024834. -...
Blue Coat ProxySG 6.5.x < 6.5.9.8 / 6.6.x < 6.6.4.1 Multiple OpenSSL Vulnerabilities
The self-reported SGOS version installed on the remote Blue Coat ProxySG device is 6.5.x prior to 6.5.9.8 or 6.6.x prior to 6.6.4.1. It is, therefore, affected by multiple vulnerabilities in its bundled version of OpenSSL : - Multiple flaws exist in the aesnicbchmacsha1cipher function in file...
RHEL 7 : java-1.8.0-openjdk (RHSA-2016:0650)
An update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
CentOS 6 : samba (CESA-2016:0011)
Updated samba packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are available f...
Scientific Linux Security Update : NetworkManager on SL7.x x86_64 (20151119)
It was discovered that NetworkManager would set device MTUs based on MTU values received in IPv6 RAs Router Advertisements, without sanity checking the MTU value first. A remote attacker could exploit this flaw to create a denial of service attack, by sending a specially crafted IPv6 RA packet to...
IBM Rational ClearQuest 7.1.1.x / 7.1.2.x < 7.1.2.13.01 / 8.0.0.x < 8.0.0.10.01 / 8.0.1.x < 8.0.1.3.01 OpenSSL Library Multiple Vulnerabilities (credentialed check) (Heartbleed)
The remote host has a version of IBM Rational ClearQuest 7.1.1.x / 7.1.2.x prior to 7.1.2.13.01 / 8.0.0.x prior to 8.0.0.10.01 / 8.0.1.x prior to 8.0.1.3.01 installed. It is, therefore, potentially affected by multiple vulnerabilities in the OpenSSL library : - An error exists related to the...
Cisco NX-OS GNU Bash Environment Variable Command Injection Vulnerability (cisco-sa-20140926-bash) (Shellshock)
According to its self-reported version, the remote NX-OS device is affected by a command injection vulnerability in GNU Bash known as Shellshock, which is due to the processing of trailing strings after function definitions in the values of environment variables. This allows a remote attacker to...
Oracle Linux 5 : kernel (ELSA-2014-0926)
The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-0926 advisory. - infiniband rds: do not deref NULL dev in rdsiwladdrcheck Jacob Tanenbaum 1093311 1093312 CVE-2014-2678 - xen page-alloc: scrub anonymous domain heap...
Oracle Linux 7 : unbreakable enterprise kernel (ELSA-2014-3049)
The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-3049 advisory. - l2tp: fix an unprivileged user to kernel privilege escalation Sasha Levin Orabug: 19229497 CVE-2014-4943 CVE-2014-4943 - ptrace,x86: force IRET path...
openSUSE Security Update : MozillaThunderbird (MozillaThunderbird-4458)
Mozilla Thunderbird was updated to the 3.1.10 security release. MFSA 2011-12: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain...
Scientific Linux Security Update : php on SL5.x i386/x86_64 (20131211)
A memory corruption flaw was found in the way the opensslx509parse function of the PHP openssl extension parsed X.509 certificates. A remote attacker could use this flaw to provide a malicious self-signed certificate or a certificate signed by a trusted authority to a PHP application using the...
Oracle Linux 6 : libjpeg-turbo (ELSA-2013-1803)
The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-1803 advisory. - Resolves: 1031955 apply patch for CVE-2013-6630 Tenable has extracted the preceding description block directly from the Oracle Linux security advisor...
RHEL 6 : firefox (RHSA-2013:0696)
The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:0696 advisory. Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found ...
Scientific Linux Security Update : gpdf on SL4.x i386/x86_64
Multiple integer overflow flaws were found in GPdf's JBIG2 decoder. An attacker could create a malicious PDF file that would cause GPdf to crash or, potentially, execute arbitrary code when opened. CVE-2009-0147, CVE-2009-1179 Multiple buffer overflow flaws were found in GPdf's JBIG2 decoder. An...
Mac OS X 10.6 < 10.6.8 Multiple Vulnerabilities
Binary data 5968.prm...
openSUSE Security Update : libltdl-3 (libltdl-3-1638)
libtool: libltdl may load modules from the current working directory. CVE-2009-3736 has been assigned to this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update libltdl-3-1638. The text...
SuSE 11 Security Update : Xerces-j2 (SAT Patch Number 1235)
The xerces-j2 package was vulnerable to various bugs while parsing XML.CVE-2009-2625 has been assigned to this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from SuSE 11 update information. The text itself is...
FreeBSD : mozilla -- multiple vulnerabilities (da185955-5738-11de-b857-000f20797ede)
Mozilla Foundation reports : MFSA 2009-32 JavaScript chrome privilege escalation MFSA 2009-31 XUL scripts bypass content-policy checks MFSA 2009-30 Incorrect principal set for file: resources loaded via location bar MFSA 2009-29 Arbitrary code execution using event listeners attached to an elemen...
WS-Management Server Detection
The remote web server supports the Web Services for Management WS-Management specification, a general web services protocol based on SOAP for managing systems, applications, and other such entities. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid33139;...
RHEL 4 / 5 : tetex (RHSA-2007:1027)
Updated tetex packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. TeTeX is an implementation of TeX. TeX takes a text file and a set of formatting...