iSCSI Unauthenticated Target Detection

Binary data iscsinoauthtarget.nbin...

SeaMonkey < 2.0.6 Multiple Vulnerabilities

The installed version of SeaMonkey is earlier than 2.0.6. Such versions are potentially affected by the following security issues : - Multiple memory safety bugs could result in memory corruption, potentially resulting in arbitrary code execution. MFSA 2010-34 - An error in DOM attribute cloning...

RHEL 3 / 4 / 5 : java-1.4.2-ibm (RHSA-2010:0155)

Updated java-1.4.2-ibm packages that fix one security issue and a bug are now available for Red Hat Enterprise Linux 3 Extras, Red Hat Enterprise Linux 4 Extras, and Red Hat Enterprise Linux 5 Supplementary. The Red Hat Security Response Team has rated this update as having moderate security...

Debian DSA-1931-1 : nspr - several vulnerabilities

Several vulnerabilities have been discovered in the NetScape Portable Runtime Library, which may lead to the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-1563 A programming error in the string handling code may lead t...

CentOS 3 / 4 / 5 : php (CESA-2010:0040)

Updated php packages that fix several security issues are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web...

SuSE 11 Security Update : MozillaFirefox (SAT Patch Number 1134)

The Mozilla Firefox 3.0.12 release fixes various bugs and some critical security issues. - Mozilla developers and community members identified and fixed several stability bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these crashes showed evidence of memory...

openSUSE Security Update : java-1_6_0-openjdk (java-1_6_0-openjdk-578)

OpenJDK Java 1.6.0 was upgraded to build b14, fixing quite a lot of security issues. It fixes at least: 4486841 UTF8 decoder should adhere to corrigendum to Unicode 3.0.1 CVE-2008-5351 6484091 FileSystemView leaks directory info CVE-2008-5350 aka SUN SOLVE 246266 6497740 Limit the size of RSA...

Web Application Tests Settings

This script sets options for generic web tests. It does not perform any test by itself. Several scripts use the options set here to test web applications, look for cross-site scripting attacks, SQL injection, etc. in CGIs. C Tenable Network Security, Inc. include"compat.inc"; ifdescription...

Slackware 10.2 / 11.0 / 12.0 / 12.1 : mozilla-firefox (SSA:2008-198-01)

New mozilla-firefox packages are available for Slackware 10.2, 11.0, 12.0, and 12.1 to fix security issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2008-198-01. The text itself is...

Apache Tomcat 9.0.0.M1 < 9.0.90

The version of Tomcat installed on the remote host is prior to 9.0.90. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat9.0.90security-9 advisory. - Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat...

WordPress 5.2.x < 5.2.18 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A directory traversal via wplang. CVE-2023-2745 - A Cross-Site Request Forgery CSRF via wpajaxsetattachmentthumbnail. - An authenticated stored Cross-Site Scripting XSS vi...

Amazon Linux 2 : java-11-openjdk (ALASJAVA-OPENJDK11-2022-002)

The version of java-11-openjdk installed on the remote host is prior to 11.0.16.0.8-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2JAVA-OPENJDK11-2022-002 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java S...

Oracle Linux 9 : java-17-openjdk (ELSA-2022-5736)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-5736 advisory. 1:17.0.4.0.8-0.2.ea - Revert the following changes until copy-java-configs has adapted to relative symlinks: - Move cacerts replacement to install...

Security Updates for Microsoft Office Products C2R (July 2022)

The Microsoft Office Products are missing a security update. It is, therefore, affected by the following vulnerability: - A security feature bypass vulnerability exists. An attacker can exploit this and bypass the security feature and perform unauthorized actions compromising the integrity of the...

RHEL 9 : xz (RHSA-2022:4940)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:4940 advisory. XZ Utils is an integrated collection of user-space file compression utilities based on the Lempel-Ziv- Markov chain algorithm LZMA, which performs...

EulerOS 2.0 SP10 : expat (EulerOS-SA-2022-1786)

According to the versions of the expat package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - xmltokimpl.c in Expat aka libexpat before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a...

IBM Java 6.0 < 6.0.16.70 / 6.1 < 6.1.8.70 / 7.0 < 7.0.10.30 / 7.1 < 7.1.4.30 / 8.0 < 8.0.5.20 Multiple Vulnerabilities (Jul 17, 2018)

The version of IBM Java installed on the remote host is prior to 6.0 6.0.16.70 / 6.1 6.1.8.70 / 7.0 7.0.10.30 / 7.1 7.1.4.30 / 8.0 8.0.5.20. It is, therefore, affected by multiple vulnerabilities as referenced in the Oracle July 17 2018 CPU advisory. - Vulnerability in the Java SE, Java SE Embedd...

Oracle Linux 8 : gnutls (ELSA-2022-9221)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9221 advisory. 3.6.16-4.0.1fips - Allow RSA keygen with modulus sizes bigger than 3072 bits and validate the seed length as defined in FIPS 186-4 section B.3.2 Orabug...

WordPress 5.4.x < 5.4.10 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A stored cross-site scripting XSS vulnerability exists via wpfilterglobalstylespost. - A prototype pollution exists via the Gutenberg wordpress/url package. Note that the...

Oracle Linux 7 : Unbreakable Enterprise kernel-container (ELSA-2022-9180)

The remote Oracle Linux 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2022-9180 advisory. - cgroup-v1: Require capabilities to set releaseagent Eric W. Biederman Orabug: 33876756 CVE-2022-0492 - tee: handle lookup of shm with reference count 0 Jens...

EulerOS 2.0 SP3 : openssl (EulerOS-SA-2022-1181)

According to the versions of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - ASN.1 strings are represented internally within OpenSSL as an ASN1STRING structure which contains a buffer holding the string data and a field...

CentOS 7 : httpd (RHSA-2021:3856)

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:3856 advisory. - A crafted request uri-path can cause modproxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server...

CentOS 8 : java-11-openjdk (CESA-2021:2781)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:2781 advisory. - OpenJDK: FTP PASV command response can cause FtpClient to connect to arbitrary host Networking, 8258432 CVE-2021-2341 - OpenJDK: Incorrect verificati...

EulerOS Virtualization 3.0.2.2 : samba (EulerOS-SA-2021-2168)

According to the versions of the samba packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A flaw was found in the way samba handled file and directory permissions. An authenticated user could use this flaw to gain access...

Oracle Linux 7 : Unbreakable Enterprise kernel-container (ELSA-2021-9308)

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2021-9308 advisory. - dm ioctl: fix out of bounds array access when no devices Mikulas Patocka Orabug: 32860493 CVE-2021-31916 - powerpc/64s: flush L1D after user accesses...

Debian DLA-2647-1 : bind9 security update

Several vulnerabilities were discovered in BIND, a DNS server implementation. CVE-2021-25214 Greg Kuechle discovered that a malformed incoming IXFR transfer could trigger an assertion failure in named, resulting in denial of service. CVE-2021-25215 Siva Kakarla discovered that named could crash...

Oracle Linux 6 : openssl (ELSA-2021-9150) (deprecated)

This plugin has been deprecated, please use oraclelinuxELSA-2021-9137.nasl instead. C Tenable Network Security, Inc. @DEPRECATED@ The descriptive text and package checks in this plugin were extracted from Oracle Linux Security Advisory ELSA-2021-9150. Disabled on 2021/04/28. Use...

Debian DSA-4877-1 : webkit2gtk - security update

The following vulnerabilities have been discovered in the webkit2gtk web engine : - CVE-2020-27918 Liu Long discovered that processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2020-29623 Simon Hunt discovered that users may be unable to fully delete their browsi...

Fedora 33 : mingw-glib2 (2021-7c71cda8da)

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-7c71cda8da advisory. - An issue was discovered in GNOME GLib before 2.66.7 and 2.67.x before 2.67.4. If gbytearraynewtake was called with a buffer of 4GB or more on a...

NewStart CGSL CORE 5.04 / MAIN 5.04 : kernel Multiple Vulnerabilities (NS-SA-2021-0012)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has kernel packages installed that are affected by multiple vulnerabilities: - A TOCTOU mismatch in the NFS client code in the Linux kernel before 5.8.3 could be used by local attackers to corrupt memory or possibly have...

NewStart CGSL MAIN 4.06 : bind Multiple Vulnerabilities (NS-SA-2021-0003)

The remote NewStart CGSL host, running version MAIN 4.06, has bind packages installed that are affected by multiple vulnerabilities: - Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows or successfully guesses th...

openSUSE Security Update : wpa_supplicant (openSUSE-2020-2059) (KRACK)

This update for wpasupplicant fixes the following issues : Security issue fixed : - CVE-2019-16275: Fixed an AP mode PMF disconnection protection bypass bsc1150934. Non-security issues fixed : - Enable SAE support jscSLE-14992. - Limit P2PDEVICE name to appropriate ifname size. - Fix wicked wlan...

Fedora 31 : php (2020-8e36afc743)

PHP version 7.3.21 06 Aug 2020 Apache: - Fixed bug php79030 Upgrade apache2handler's phpapachesapigetrequesttime to return usec. Herbert256 Core: - Fixed bug php79877 getimagesize function silently truncates after a null byte cmb - Fixed bug php79778 Assertion failure if dumping closure with...

SUSE SLES12 Security Update : xen (SUSE-SU-2020:1630-1)

This update for xen fixes the following issues : CVE-2020-0543: Fixed a side channel attack against special registers which could have resulted in leaking of read values to cores other than the one which called it. This attack is known as Special Register Buffer Data Sampling SRBDS or 'CrossTalk'...

Oracle Linux 8 : firefox (ELSA-2020-1406)

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-1406 advisory. - Added fix for mozbz1348168/CVE-2017-5428 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note...

RHEL 8 : java-1.8.0-openjdk (RHSA-2020:0202)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0202 advisory. The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security...

EulerOS 2.0 SP8 : python2 (EulerOS-SA-2019-2114)

According to the versions of the python2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the servertitle field. This...

MySQL 5.7.x < 5.7.27 Multiple Vulnerabilities (Jul 2019 CPU)

The version of MySQL running on the remote host is 5.7.x prior to 5.7.27. It is, therefore, affected by multiple vulnerabilities, including three of the top vulnerabilities below, as noted in the July 2019 Critical Patch Update advisory: - A stack-based buffer overflow vulnerability in the 'Serve...

RHEL 7 : Virtualization Manager (RHSA-2019:1206) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)

An update for rhvm-setup-plugins is now available for Red Hat Virtualization 4.2. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

EulerOS Virtualization 3.0.1.0 : sqlite (EulerOS-SA-2019-1425)

According to the versions of the sqlite packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - It was found that SQLite's sqlite3VdbeExec function did not properly implement comparison operators. A local attacker could submi...

EulerOS Virtualization 3.0.1.0 : curl (EulerOS-SA-2019-1549)

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A NULL pointer dereference flaw was found in the way libcurl checks values returned by the openldap ldapgetattributeber function. A...

Fedora 28 : community-mysql (2019-21b76d179e)

MySQL 5.7.25 Release notes : https://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-25.html CVEs fixed : CVE-2019-2420 CVE-2019-2434 CVE-2019-2455 CVE-2019-2481 CVE-2019-2482 CVE-2019-2486 CVE-2019-2503 CVE-2019-2507 CVE-2019-2510 CVE-2019-2528 CVE-2019-2529 CVE-2019-2531 CVE-2019-2532...

openSUSE Security Update : tiff (openSUSE-2018-1242)

This update for tiff fixes the following issues : Security issue fixed : - CVE-2018-10779: TIFFWriteScanline in tifwrite.c had a heap-based buffer over-read, as demonstrated by bmp2tiff.bsc1092480 - CVE-2018-17100: There is a int32 overflow in multiplyms in tools/ppm2tiff.c, which can cause a...

Apache Tomcat 9.0.0.M1 < 9.0.12 Open Redirect Weakness

The version of Apache Tomcat installed on the remote host is 9.0.x prior to 9.0.12. It is, therefore, affected by a open redirect vulnerability. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid118037;...

openSUSE Security Update : xen (openSUSE-2018-803)

This update for xen fixes the following issues : Security issues fixed : - CVE-2018-3665: Fix Lazy FP Save/Restore issue XSA-267 bsc1095242. - CVE-2018-12891: Fix possible Denial of Service DoS via certain PV MMU operations that affect the entire host XSA-264 bsc1097521. - CVE-2018-12892: Fix lib...

RHEL 6 : kernel (RHSA-2018:1351)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:1351 advisory. - Kernel: error in exception handling leads to DoS CVE-2018-8897 Note that Nessus has not tested for this issue but has instead relied only on the...

SUSE SLES11 Security Update : java-1_7_0-ibm (SUSE-SU-2018:0061-1)

This update for java-170-ibm fixes the following issues : - Security update to version 7.0.10.15 bsc1070162 : - CVE-2017-10346 CVE-2017-10285 CVE-2017-10388 CVE-2017-10356 CVE-2017-10293 CVE-2016-9841 CVE-2016-10165 CVE-2017-10355 CVE-2017-10357 CVE-2017-10348 CVE-2017-10349 CVE-2017-10347...

MS17-017: Security Update for Windows Kernel (4013081)

The remote Windows host is missing a security update. It is, therefore, affected by multiple elevation of privilege vulnerabilities : - An elevation of privilege vulnerability exists in the Windows Kernel API due to improper enforcement of permissions. A local attacker can exploit this, via a...

Microsoft SQL Server 2012 SP3 11.0.6020.0 through 11.0.6247.0 Multiple Privilege Escalation (3194721)

Binary data 9811.prm...

RHEL 5 : kernel (RHSA-2016:2127)

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2016:2127 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: A race condition was found in the way the Linux...