357771 matches found
EulerOS 2.0 SP3 : httpd (EulerOS-SA-2022-1730)
According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A carefully crafted request body can cause a buffer overflow in the modlua multipart parser r:parsebody called from Lua scripts. The Apache httpd...
RHEL 8 : openssl (RHSA-2022:1065)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:1065 advisory. OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols, as well as a full-strength...
Oracle Linux 8 : gnutls (ELSA-2022-9221)
The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9221 advisory. 3.6.16-4.0.1fips - Allow RSA keygen with modulus sizes bigger than 3072 bits and validate the seed length as defined in FIPS 186-4 section B.3.2 Orabug...
SUSE SLES12: libdcerpc-binding0 / libdcerpc-binding0-32bit / libdcerpc0 / etc (SUSE-SU-2022:0252-1)
The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2022:0252-1 advisory. - CVE-2021-44142: Fixed out-of-Bound Read/Write on Samba vfsfruit module. bsc1194859 Tenable has extracted the preceding description block directly fro...
EulerOS 2.0 SP5 : glibc (EulerOS-SA-2021-2660)
According to the versions of the glibc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The wordexp function in the GNU C Library aka glibc through 2.33 may crash or read arbitrary memory in parseparam in posix/wordexp.c when called...
Debian DLA-2711-1 : thunderbird - LTS security update
The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2711 advisory. Multiple security issues were discovered in Thunderbird, which could result in the execution of arbitrary code. CVE-2021-30547 Description For Debian 9 stretch,...
openSUSE 15 Security Update : nodejs14 (openSUSE-SU-2021:2354-1)
"The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:2354-1 advisory. - This affects the package y18n before 3.2.2, 4.0.1 and 5.0.5. PoC by po6ix: const y18n = require'y18n' %NASLMINLEVEL 70300 C Tenable...
Debian DLA-2647-1 : bind9 security update
Several vulnerabilities were discovered in BIND, a DNS server implementation. CVE-2021-25214 Greg Kuechle discovered that a malformed incoming IXFR transfer could trigger an assertion failure in named, resulting in denial of service. CVE-2021-25215 Siva Kakarla discovered that named could crash...
SUSE SLES12 Security Update : ucode-intel (SUSE-SU-2020:3279-1)
This update for ucode-intel fixes the following issues : Intel CPU Microcode updated to 20201027 prerelease CVE-2020-8695: Fixed Intel RAPL sidechannel attack SGX bsc1170446 CVE-2020-8698: Fixed Fast Store Forward Predictor INTEL-SA-00381 bsc1173594 New Platforms: | Processor | Stepping | F-M-S/P...
openSUSE Security Update : wpa_supplicant (openSUSE-2020-2059) (KRACK)
This update for wpasupplicant fixes the following issues : Security issue fixed : - CVE-2019-16275: Fixed an AP mode PMF disconnection protection bypass bsc1150934. Non-security issues fixed : - Enable SAE support jscSLE-14992. - Limit P2PDEVICE name to appropriate ifname size. - Fix wicked wlan...
Fedora 31 : php (2020-8e36afc743)
PHP version 7.3.21 06 Aug 2020 Apache: - Fixed bug php79030 Upgrade apache2handler's phpapachesapigetrequesttime to return usec. Herbert256 Core: - Fixed bug php79877 getimagesize function silently truncates after a null byte cmb - Fixed bug php79778 Assertion failure if dumping closure with...
Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-4427-1)
The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4427-1 advisory. It was discovered that the Kvaser CAN/USB driver in the Linux kernel did not properly initialize memory in certain situations. A local attacker could...
Solaris 10 (x86) : 119784-45
Vulnerability in the Solaris component of Oracle Sun Products Suite subcomponent: Bind/Postinstall script for Bind package. The supported version that is affected is 10. Very difficult to exploit vulnerability requiring logon to Operating System plus additional login/authentication to component o...
Apple iCloud 10.x < 10.9.2 Multiple Vulnerabilities
According to its version, the iCloud application installed on the remote Windows host is 10.x prior to 10.9.2. It is, therefore, affected by multiple vulnerabilities: - An arbitrary code execution vulnerability exist with in the WebKit due to multiple memory corruption issues. An unauthenticated,...
EulerOS 2.0 SP2 : sqlite (EulerOS-SA-2020-1624)
According to the versions of the sqlite packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - SQLite 3.30.1 mishandles certain parser-tree rewriting, related to expr.c, vdbeaux.c, and window.c. This is caused by incorrect...
SUSE SLED15 / SLES15 Security Update : MozillaThunderbird (SUSE-SU-2020:1225-1)
This update for MozillaThunderbird fixes the following issues : Update to 68.8.0 ESR MFSA 2020-18 bsc1171186 - CVE-2020-12397 bmo1617370 Sender Email Address Spoofing using encoded Unicode characters - CVE-2020-12387 bmo1545345 Use-after-free during worker shutdown - CVE-2020-6831 bmo1632241 Buff...
Oracle Linux 8 : firefox (ELSA-2020-1406)
The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-1406 advisory. - Added fix for mozbz1348168/CVE-2017-5428 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note...
openSUSE Security Update : java-1_8_0-openjdk (openSUSE-2019-2687)
This update for java-180-openjdk jdk8u232/icedtea 3.14.0 fixes the following issues : Security issues fixed bsc1154212 : - CVE-2019-2933: Windows file handling redux - CVE-2019-2945: Better socket support - CVE-2019-2949: Better Kerberos ccache handling - CVE-2019-2958: Build Better Processes -...
Oracle Linux 7 : thunderbird (ELSA-2019-4148)
The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2019-4148 advisory. 68.3.0-1.0.1 - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js 68.3.0-1 - Update to 68.3.0 build2 68.2.0-2 - Adde...
RHEL 7 : libjpeg-turbo (RHSA-2019:2052)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2052 advisory. The libjpeg-turbo packages contain a library of functions for manipulating JPEG images. They also contain simple client programs for accessi...
NewStart CGSL MAIN 5.04 : thunderbird Multiple Vulnerabilities (NS-SA-2019-0009)
The remote NewStart CGSL host, running version MAIN 5.04, has thunderbird packages installed that are affected by multiple vulnerabilities: - It is possible to spoof the sender's email address and display an arbitrary sender address to the email recipient. The real sender's address is not display...
RHEL 7 : Virtualization Manager (RHSA-2019:1206) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)
An update for rhvm-setup-plugins is now available for Red Hat Virtualization 4.2. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
EulerOS Virtualization 2.5.4 : openssl (EulerOS-SA-2019-1201)
According to the versions of the openssl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigat...
RHEL 6 : java-1.7.0-openjdk (RHSA-2019:0462)
The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:0462 advisory. The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit. Security Fixes:...
Fedora 28 : community-mysql (2019-21b76d179e)
MySQL 5.7.25 Release notes : https://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-25.html CVEs fixed : CVE-2019-2420 CVE-2019-2434 CVE-2019-2455 CVE-2019-2481 CVE-2019-2482 CVE-2019-2486 CVE-2019-2503 CVE-2019-2507 CVE-2019-2510 CVE-2019-2528 CVE-2019-2529 CVE-2019-2531 CVE-2019-2532...
FreeBSD : mozilla -- multiple vulnerabilities (18211552-f650-4d86-ba4f-e6d5cbfcdbeb)
Mozilla Foundation reports : CVE-2018-18356: Use-after-free in Skia CVE-2019-5785: Integer overflow in Skia CVE-2018-18511: Cross-origin theft of images with ImageBitmapRenderingContext C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the...
Photon OS 1.0: Linux PHSA-2016-0012
An update of the linux package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2016-0012. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid121650;...
Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2019-4510)
The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-4510 advisory. - ALSA: usb-audio: Fix UAF decrement if card has no live interfaces in card.c Hui Peng Orabug: 29042981 CVE-2018-19824 - ALSA: usb-audio: Replace...
Slackware 14.0 / 14.1 / 14.2 / current : openssl (SSA:2018-325-01)
New openssl packages are available for Slackware 14.2 and -current to fix security issues. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2018-325-01. The text itself is copyright C Slackware Linux, Inc...
Oracle Linux 7 : xorg-x11-server (ELSA-2018-3410)
The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2018-3410 advisory. - CVE-2018-14665: Disable -logfile and -modulepath when running with elevated privileges Tenable has extracted the preceding description block directly from the...
SUSE SLES11 Security Update : xen (SUSE-SU-2018:0678-1) (Meltdown) (Spectre)
This update for xen fixes several issues. These security issues were fixed : - CVE-2017-5753, CVE-2017-5715, CVE-2017-5754: Prevent information leaks via side effects of speculative execution, aka 'Spectre' and 'Meltdown' attacks bsc1074562, bsc1068032 - CVE-2018-5683: The vgadrawtext function...
Apache Struts 2.3.x Struts 1 plugin RCE (remote)
The Struts 1 plugin in Apache Struts 2.3.x is affected by a remote code execution vulnerability via a malicious field value passed in a raw message to the ActionMessage class. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if descriptio...
RHEL 6 / 7 : ntp (RHSA-2017:0252)
An update for ntp is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...
MySQL 5.6.x < 5.6.35 Multiple Vulnerabilities (January 2017 CPU)
The version of MySQL running on the remote host is 5.6.x prior to 5.6.35. It is, therefore, affected by multiple vulnerabilities : - An unspecified flaw exists in the Security: Encryption subcomponent that allows an authenticated, remote attacker to cause a denial of service condition...
RHEL 7 : kernel (RHSA-2016:1657)
An update for kernel is now available for Red Hat Enterprise Linux 7.1 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...
OracleVM 3.3 : Unbreakable / etc (OVMSA-2016-0095)
The remote OracleVM system is missing necessary patches to address critical security updates : - KEYS: potential uninitialized variable Dan Carpenter Orabug: 24393864 CVE-2016-4470 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were extracted from OracleVM...
Scientific Linux Security Update : openssl on SL6.x, SL7.x i386/x86_64 (20160107) (SLOTH)
A flaw was found in the way TLS 1.2 could use the MD5 hash function for signing ServerKeyExchange and Client Authentication packets during a TLS handshake. A man-in-the-middle attacker able to force a TLS connection to use the MD5 hash function could use this flaw to conduct collision attacks to...
MS11-067: Vulnerability in Microsoft Report Viewer Could Allow Information Disclosure (2578230)
The installed version of the Microsoft Report Viewer control fails to properly validate parameters within a data source, which results in a reflected or non-persistent cross-site scripting vulnerability. If an attacker can trick a user into clicking on a link to a malicious server, he could injec...
CentOS 4 : thunderbird (CESA-2010:0544)
An updated thunderbird package that fixes several security issues is now available for Red Hat Enterprise Linux 4. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity rating...
Debian DSA-1928-1 : linux-2.6.24 - privilege escalation/denial of service/sensitive memory leak
Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service, sensitive memory leak or privilege escalation. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-2846 Michael Buesch noticed a typing issue in the...
PHP 8.2.x < 8.2.20 Multiple Vulnerabilities
The version of PHP installed on the remote host is prior to 8.2.20. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.2.20 advisory. - In PHP versions 8.1. before 8.1.29, 8.2. before 8.2.20, 8.3. before 8.3.8, when using Apache and PHP- CGI on Windows, if the...
KB5025239: Windows 11 version 22H2 Security Update (April 2023)
The remote Windows host is missing security update 5025239. It is, therefore, affected by multiple vulnerabilities - Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability CVE-2023-28275 - Windows Pragmatic General Multicast PGM Remote Code Execution Vulnerability...
Amazon Linux 2 : java-11-openjdk (ALASJAVA-OPENJDK11-2022-002)
The version of java-11-openjdk installed on the remote host is prior to 11.0.16.0.8-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2JAVA-OPENJDK11-2022-002 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java S...
RHEL 7 : rh-ruby26-ruby (RHSA-2021:2230)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2230 advisory. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system...
RHEL 9 : xz (RHSA-2022:4940)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:4940 advisory. XZ Utils is an integrated collection of user-space file compression utilities based on the Lempel-Ziv- Markov chain algorithm LZMA, which performs...
EulerOS 2.0 SP10 : expat (EulerOS-SA-2022-1786)
According to the versions of the expat package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - xmltokimpl.c in Expat aka libexpat before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a...
Amazon Linux 2 : kernel (ALASKERNEL-5.4-2022-018)
The version of kernel installed on the remote host is prior to 5.4.80-40.140. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2022-018 advisory. A flaw was found in the Linux kernel. A use-after-free memory flaw was found in the perf subsystem allowing ...
IBM Java 6.0 < 6.0.16.70 / 6.1 < 6.1.8.70 / 7.0 < 7.0.10.30 / 7.1 < 7.1.4.30 / 8.0 < 8.0.5.20 Multiple Vulnerabilities (Jul 17, 2018)
The version of IBM Java installed on the remote host is prior to 6.0 6.0.16.70 / 6.1 6.1.8.70 / 7.0 7.0.10.30 / 7.1 7.1.4.30 / 8.0 8.0.5.20. It is, therefore, affected by multiple vulnerabilities as referenced in the Oracle July 17 2018 CPU advisory. - Vulnerability in the Java SE, Java SE Embedd...
RHEL 8 : openssl (RHSA-2022:1091)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:1091 advisory. OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols, as well as a full-strength...
WordPress 5.4.x < 5.4.10 Multiple Vulnerabilities
According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A stored cross-site scripting XSS vulnerability exists via wpfilterglobalstylespost. - A prototype pollution exists via the Gutenberg wordpress/url package. Note that the...