366284 matches found
EulerOS Virtualization 3.0.2.6 : ruby (EulerOS-SA-2021-2866)
According to the versions of the ruby packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip...
CentOS 8 : gcc-toolset-10-gcc (CESA-2021:4585)
The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:4585 advisory. - Developer environment: Unicode's bidirectional BiDi override characters can cause trojan source attacks CVE-2021-42574 Note that Nessus has not tested for thi...
CentOS 8 : container-tools:3.0 (CESA-2021:4222)
The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:4222 advisory. - buildah: Host environment variables leaked in build container when using chroot isolation CVE-2021-3602 Note that Nessus has not tested for this issue but has...
Mozilla Firefox < 92.0
The version of Firefox installed on the remote Windows host is prior to 92.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2021-38 advisory. - Mozilla developers Christian Holler and Lars T Hansen reported memory safety bugs present in Firefox 91. Some of these...
Photon OS 4.0: Glibc PHSA-2021-4.0-0095
An update of the glibc package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-4.0-0095. The text itself is copyright C VMware, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if descripti...
ManageEngine ServiceDesk Plus < 11.2 Build 11205 RCE
A command injection vulnerability exists in ManageEngine ServiceDesk Plus 11.2 Build 11205 due to insufficient sanitisation of user supplied input. An authenticated, remote attacker can exploit this to execute arbitrary commands with SYSTEM privileges. Note that Nessus has not tested for this iss...
RHEL 8 : postgresql:9.6 (RHSA-2021:2393)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2393 advisory. PostgreSQL is an advanced object-relational database management system DBMS. The following packages have been upgraded to a later upstream...
Oracle Linux 8 : nodejs:10 (ELSA-2021-0548)
The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-0548 advisory. nodejs 1:10.23.1-1 - January Security release - https://nodejs.org/en/blog/vulnerability/january-2021-security-releases/ - Rebase to 10.23.1 - Resolves...
Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2021-9005)
The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9005 advisory. - target: fix XCOPY NAA identifier lookup David Disseldorp Orabug: 32248040 CVE-2020-28374 - xenbus/xenbusbackend: Disallow pending watch messages...
SUSE SLES12 Security Update : samba (SUSE-SU-2020:2720-1)
This update for samba fixes the following issues : Update to 4.10.18 ZeroLogon: An elevation of privilege was possible with some non default configurations when an attacker established a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol MS-NR...
RHEL 8 : thunderbird (RHSA-2020:4913)
The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:4913 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 78.4.0. Security Fixes: Mozilla:...
Mozilla Firefox < 82.0
The version of Firefox installed on the remote macOS or Mac OS X host is prior to 82.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-45 advisory. - Mozilla developers Christian Holler, Sebastian Hengst, Bogdan Tara, and Tyson Smith reported memory safety bu...
NewStart CGSL MAIN 4.05 : thunderbird Multiple Vulnerabilities (NS-SA-2020-0046)
The remote NewStart CGSL host, running version MAIN 4.05, has thunderbird packages installed that are affected by multiple vulnerabilities: - When removing data about an origin whose tab was recently closed, a use-after-free could occur in the Quota manager, resulting in a potentially exploitable...
openSUSE Security Update : python (openSUSE-2020-1257)
This update for python fixes the following issues : - CVE-2019-20907: Avoid a possible infinite loop caused by specifically crafted tarballs bsc1174091. This update was imported from the SUSE:SLE-15:Update update project. C Tenable Network Security, Inc. The descriptive text and package checks in...
Fedora 31 : php (2020-8e36afc743)
PHP version 7.3.21 06 Aug 2020 Apache: - Fixed bug php79030 Upgrade apache2handler's phpapachesapigetrequesttime to return usec. Herbert256 Core: - Fixed bug php79877 getimagesize function silently truncates after a null byte cmb - Fixed bug php79778 Assertion failure if dumping closure with...
RHEL 6 : kernel-rt (RHSA-2020:3266)
The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:3266 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Securi...
Trend Micro InterScan Web Security Virtual Appliance (IWSVA) Multiple Vulnerabilities (000253095)
The Trend Micro InterScan Web Security Virtual Appliance is affected by multiple vulnerabilities : - A path traversal vulnerability exists in the Apache Solr application due to improper validation of a user-supplied path prior to using it in file operations when parsing the file parameter in an...
EulerOS Virtualization 3.0.6.0 : qemu-kvm (EulerOS-SA-2020-1790)
According to the versions of the qemu-kvm packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Memory leak in hw/audio/es1370.c in QEMU aka Quick Emulator allows local guest OS privileged users to cause a denial of service...
OpenSSL 1.0.2 < 1.0.2u Vulnerability
The version of OpenSSL installed on the remote host is prior to 1.0.2u. It is, therefore, affected by a vulnerability as referenced in the 1.0.2u advisory. - There is an overflow bug in the x6464 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are...
EulerOS 2.0 SP5 : expat (EulerOS-SA-2019-2145)
According to the versions of the expat packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An integer overflow during the parsing of XML using the Expat library. This vulnerability affects Firefox 50.CVE-2016-9063 - In libexpat before...
Fedora 29 : python2 / python2-docs (2019-758824a3ff)
Python 2.7.17 is a bug fix release in the Python 2.7.x series. It is expected to be the penultimate release for Python 2.7. https://www.python.org/downloads/release/python-2717/ - Security fix for CVE-2018-20852. - Security fix for CVE-2019-16056. - Security fix for CVE-2019-16935. Note that...
EulerOS 2.0 SP3 : systemd (EulerOS-SA-2019-1998)
According to the versions of the systemd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - It has been discovered that systemd-tmpfiles mishandles symbolic links present in non-terminal path components. In some configurations a local...
EulerOS 2.0 SP5 : kernel (EulerOS-SA-2019-1972)
According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in the Linux kernel before 5.1.8. There is a double-free caused by a malicious USB device in the drivers/usb/misc/rio500...
CentOS 7 : curl (CESA-2019:1880)
An update for curl is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE li...
Amazon Linux 2 : kernel (ALAS-2019-1214)
A flaw was found in the Linux kernel's freescale hypervisor manager implementation. A parameter passed via to an ioctl was incorrectly validated and used in size calculations for the page size calculation. An attacker can use this flaw to crash the system or corrupt memory or, possibly, create...
EulerOS Virtualization 2.5.4 : kvm (EulerOS-SA-2019-1372)
According to the version of the kvm package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - A use-after-free vulnerability was found in the way the Linux kernel's KVM hypervisor implements its device control API. While creating ...
Oracle Tuxedo Multiple Vulnerabilities (Apr 2019 CPU)
The version of Oracle Tuxedo installed on the remote host is missing a security patch. It is, therefore, affected by multiple vulnerabilities: - An information disclosure vulnerability exists in OpenSSL due to the potential for a side-channel timing attack. An unauthenticated attacker can exploit...
openSUSE Security Update : apache2 (openSUSE-2019-1190)
This update for apache2 fixes the following issues : - CVE-2019-0220: The Apache HTTP server did not use a consistent strategy for URL normalization throughout all of its components. In particular, consecutive slashes were not always collapsed. Attackers could potentially abuse these...
Photon OS 1.0: Zlib PHSA-2017-0021
An update of the zlib package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2017-0021. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid121704;...
Oracle Linux 7 : kernel (ELSA-2018-3083)
The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-3083 advisory. - fs exec: Limit arg stack to at most 75 of STKLIM Yauheni Kaliuta 1625991 CVE-2018-14634 - fs exec: account for argv/envp pointers Yauheni Kaliuta...
SUSE SLES12 Security Update : kernel (SUSE-SU-2018:3084-1)
The SUSE Linux Enterprise 12 SP2 LTSS kernel was updated to receive various security and bugfixes. CVE-2018-10853: A flaw was found in the way the KVM hypervisor emulated instructions such as sgdt/sidt/fxsave/fxrstor. It did not check current privilegeCPL level while emulating unprivileged...
Debian DLA-1531-1 : linux-4.9 security update
Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. CVE-2018-6554 A memory leak in the irdabind function in the irda subsystem was discovered. A local user can take advantage of this flaw to cause a deni...
Mozilla Thunderbird < 52.9 Multiple Vulnerabilities (macOS)
The version of Mozilla Thunderbird installed on the remote OSX host is prior to 52.9. It is, therefore, affected by multiple vulnerabilities. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid111043; scriptversion"1.5";...
SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1508-1)
This update for the Linux Kernel 4.4.121-9273 fixes one issue. The following security issue was fixed : - CVE-2018-1000199: - CVE-2018-1000199: An address corruption flaw was discovered while modifying a h/w breakpoint via 'modifyuserhwbreakpoint' routine, an unprivileged user/process could use...
Apache Zookeeper x < 3.4.10 / 3.5.x < 3.5.4 Missing Authentication Remote Quorum Joining Vulnerability
The instance of Apache Zookeeper listening on the remote host is either running a version that does not support quorum authentication or has not been configured to use quorum authentication. This may allow a remote attacker to join a cluster quorum and begin propagating counterfeit changes to the...
Amazon Linux 2 : kernel (ALAS-2018-939) (Meltdown) (Spectre)
An updated kernel release for Amazon Linux has been made available which prevents speculative execution of indirect branches within the kernel. This release incorporates latest stable open source Linux security improvements to address CVE-2017-5715 within the kernel and builds upon previously...
RHEL 6 : MRG (RHSA-2018:0470)
Updated Red Hat Enterprise Messaging, Realtime, and Grid MRG Realtime packages that fix multiple security issues and add one enhancement are now available for Red Hat Enterprise MRG 2.5. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scorin...
Oracle Java SE Multiple Vulnerabilities (January 2018 CPU)
The version of Oracle formerly Sun Java SE or Java for Business installed on the remote host is prior to 9 Update 4, 8 Update 161, 7 Update 171, or 6 Update 181. It is, therefore, affected by multiple vulnerabilities related to the following components : - AWT - Deployment - Hotspot - I18n -...
SUSE SLES12 Security Update : kernel (SUSE-SU-2018:0114-1) (Meltdown) (Spectre)
The SUSE Linux Enterprise 12 SP1 LTSS kernel was updated to receive various security and bugfixes. This update is only provided as a fix update for IBM Z platform. - CVE-2017-5753 / 'Spectre Attack': IBM Z fixes were included but not enabled in the previous update. This update enables those fixes...
Oracle Linux 7 : kernel (ELSA-2017-2930-1) (BlueBorne)
Description of changes: - 3.10.0-693.5.2.0.1.el7.OL7 - ipc ipc/sem.c: bugfix for semctl,,GETZCNT Manfred Spraul orabug 22552377 - Oracle Linux certificates Alexey Petrenko - Oracle Linux RHCK Module Signing Key was compiled into kernel olkmodsigningkey.x509alexey.petrenko at oracle.com - Update...
MySQL 5.5.x < 5.5.57 Multiple Vulnerabilities (July 2017 CPU)
The version of MySQL running on the remote host is 5.5.x prior to 5.5.57. It is, therefore, affected by multiple vulnerabilities : - An unspecified flaw exists in the Connector/C and C API components that allow an authenticated, remote attacker to cause a denial of service condition. CVE-2017-363...
openSUSE Security Update : qemu (openSUSE-2017-822)
This update for qemu fixes several issues. These security issues were fixed : - CVE-2017-9330: USB OHCI Emulation in qemu allowed local guest OS users to cause a denial of service infinite loop by leveraging an incorrect return value bsc1042159. - CVE-2017-8379: Memory leak in the keyboard input...
EulerOS 2.0 SP2 : ntp (EulerOS-SA-2017-1125)
According to the versions of the ntp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - ntpq in NTP before 4.2.8p7 allows remote attackers to obtain origin timestamps and then impersonate peers via unspecified vectors.CVE-2015-8139 - N...
ISC BIND 9.10.x < 9.10.3-P4 DoS
Binary data 9873.prm...
OpenSSH 7.x < 7.4 Multiple Vulnerabilities
Binary data 9855.prm...
Amazon Linux AMI : java-1.7.0-openjdk (ALAS-2016-771)
It was discovered that the Libraries component of OpenJDK did not restrict the set of algorithms used for JAR integrity verification. This flaw could allow an attacker to modify content of the JAR file that used weak signing key or hash algorithm. CVE-2016-5542 A flaw was found in the way the JMX...
Fedora 25 : kernel (2016-c8a0c7eece) (Dirty COW)
The 4.8.3 stable update contains a number of important fixes across the tree. In particular, it includes a fix for CVE-2016-5195. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically...
Oracle Linux 7 : qemu-kvm (ELSA-2016-2585)
The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-2585 advisory. - Resolves: bz1359729 CVE-2016-5403 qemu-kvm: Qemu: virtio: unbounded memory allocation on host via guest leading to DoS rhel-7.3 - Resolves: bz1340929...
MariaDB Server 10.0.x < 10.0.28 Multiple Vulnerabilities
Binary data 9752.prm...
F5 Networks BIG-IP : Java vulnerabilities (K48802597)
CVE-2013-5825 Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect availability via vectors related to...