346916 matches found
Microsoft SQL Server 2014 SP1 12.0.4100.0 through 12.0.4231.0 Privilege Escalation (3194720)
Binary data 9812.prm...
RHEL 6 / 7 : java-1.8.0-oracle (RHSA-2016:2088)
An update for java-1.8.0-oracle is now available for Oracle Java for Red Hat Enterprise Linux 6 and Oracle Java for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which give...
Debian DLA-529-1 : tomcat7 security update
A denial of service vulnerability was identified in Commons FileUpload that occurred when the length of the multipart boundary was just below the size of the buffer 4096 bytes used to read the uploaded file. This caused the file upload process to take several orders of magnitude longer than if th...
Debian DSA-3515-1 : graphite2 - security update
Multiple vulnerabilities have been found in the Graphite font rendering engine which might result in denial of service or the execution of arbitrary code if a malformed font file is processed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...
OracleVM 3.3 / 3.4 : nss-util (OVMSA-2016-0034)
The remote OracleVM system is missing necessary patches to address critical security updates : - Actually apply the fix for CVE-2016-1950 from NSS 3.19.2.3 ... - Rebuild to ensure use of correct NSPR. - Include the fix for CVE-2016-1950 from NSS 3.19.2.3 %NASLMINLEVEL 70300 C Tenable Network...
Fedora 22 : mingw-libxml2-2.9.3-1.fc22 (2016-a9ee80b01d)
Update to 2.9.3 which fixes various CVE's Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVE...
AIX Java Advisory : java_jan2016_advisory.asc (January 2016 CPU) (SLOTH)
The version of Java SDK installed on the remote AIX host is affected by multiple vulnerabilities in the following components : - 2D - AWT - IBM J9 JVM - JAXP - JMX - Libraries - Networking - Security %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...
Ubuntu 14.04 LTS : Linux kernel (Vivid HWE) vulnerabilities (USN-2910-1)
The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2910-1 advisory. halfdog discovered that OverlayFS, when mounting on top of a FUSE mount, incorrectly propagated file attributes, including setuid. A local unprivileged...
Debian DSA-3414-1 : xen - security update
Multiple security issues have been found in the Xen virtualisation solution, which may result in denial of service or information disclosure. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory...
CentOS 6 / 7 : java-1.7.0-openjdk (CESA-2015:1920)
Updated java-1.7.0-openjdk packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity...
RHEL 5 / 6 : Red Hat Satellite IBM Java Runtime (RHSA-2015:0264)
The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:0264 advisory. This update corrects several security vulnerabilities in the IBM Java Runtime Environment shipped as part of Red Hat Satellite 5.6. In a...
Oracle Linux 5 / 6 / 7 : java-1.6.0-openjdk (ELSA-2014-1634)
The remote Oracle Linux 5 / 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1634 advisory. 1:1.6.0.33-1.13.5.0 - Update to IcedTea 1.13.5 - Remove upstreamed patches. - Regenerate add-final-location-rpaths patch against new release. -...
ESXi 5.5 < Build 1746974 / 5.5 Update 1 < Build 1746018 OpenSSL Library Multiple Vulnerabilities (remote check) (Heartbleed)
The remote VMware ESXi host is 5.5 prior to build 1746974 or 5.5 Update 1 prior to build 1746018. It is, therefore, potentially affected by the following vulnerabilities in the OpenSSL library : - An error exists related to the implementation of the Elliptic Curve Digital Signature Algorithm ECDS...
Blue Coat ProxyAV Detection
Blue Coat ProxyAV, an anti-malware appliance, was found. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid69929; scriptversion"1.8"; scriptsetattributeattribute:"pluginmodificationdate", value:"2020/09/14"; scriptnameenglish:"Blue Coat ProxyAV Detection";...
Mac OS X : Java for OS X 2013-003
The remote Mac OS X 10.7 or 10.8 host has a Java runtime that is missing the Java for OS X 2013-003 update, which updates the Java version to 1.6.045. It is, therefore, affected by multiple security vulnerabilities, the most serious of which may allow an untrusted Java applet to execute arbitrary...
Thunderbird < 17.0.2 Multiple Vulnerabilities (Mac OS X)
The installed version of Thunderbird is earlier than 17.0.2 and thus, is potentially affected by the following security issues : - Two intermediate certificates were improperly issued by TURKTRUST certificate authority. CVE-2013-0743 - A use-after-free error exists related to displaying HTML tabl...
IBM WebSphere Portal Dojo Module Arbitrary File Download
The version of WebSphere Portal on the remote host is using a vulnerable version of the Dojo toolkit. Input to the 'path' parameter of layerLoader.jsp is not properly validated. A remote, unauthenticated attacker could exploit this to download arbitrary files. This vulnerability exists due to an...
Scientific Linux Security Update : java (jdk 1.6.0) on SL4.x, SL5.x i386/x86_64
This update fixes several vulnerabilities in the Sun Java 6 Runtime Environment and the Sun Java 6 Software Development Kit. These vulnerabilities are summarized on the 'Advance notification of Security Updates for Java SE' page from Sun Microsystems, listed in the References section. All running...
Scientific Linux Security Update : firefox on SL4.x, SL5.x i386/x86_64
Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. CVE-2010-3169, CVE-2010-2762 Several use-after-free and dangling point...
Scientific Linux Security Update : tomcat6 on SL6.x i386/x86_64
A denial of service flaw was found in the way certain strings were converted to Double objects. A remote attacker could use this flaw to cause Tomcat to hang via a specially crafted HTTP request. CVE-2010-4476 A flaw was found in the Tomcat NIO Non-Blocking I/O connector. A remote attacker could...
Oracle Java SE 7 <= Update 11 Multiple Vulnerabilities (February 2013 CPU)
Binary data 6685.prm...
Mac OS X XProtect Installed
There is a problem with the installation of the Apple XProtect application on the remote Mac OS X host - either updates are not enabled / running or its definitions are out of date. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid56568; scriptversion"1.57";...
SuSE 10 Security Update : OpenOffice_org (ZYPP Patch Number 6884)
This update of OpenOfficeorg includes fixes for the following vulnerabilities : - XML signature weakness CVE-2009-2949: XPM Import Integer Overflow CVE-2009-2950: GIF Import Heap Overflow CVE-2009-3301: MS Word sprmTDefTable Memory Corruption CVE-2009-3302: MS Word sprmTDefTable Memory Corruption...
SeaMonkey < 2.0.1 Multiple Vulnerabilities
The installed version of SeaMonkey is earlier than 2.0.1. Such versions are potentially affected by the following security issues : - Multiple crashes can result in arbitrary code execution. MFSA 2009-65 - Multiple vulnerabilities in 'liboggplay' can lead to arbitrary code execution. MFSA 2009-66...
Mandriva Linux Security Advisory : xine-lib (MDVSA-2009:319)
Vulnerabilities have been discovered and corrected in xine-lib : Failure on Ogg files manipulation can lead remote attackers to cause a denial of service by using crafted files CVE-2008-3231. Failure on manipulation of either MNG or Real or MOD files can lead remote attackers to cause a denial of...
CentOS 3 : python (CESA-2009:1178)
Updated python packages that fix multiple security issues are now available for Red Hat Enterprise Linux 3. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Python is an interpreted, interactive, object-oriented programming language. When the...
Fedora 10 : kernel-2.6.27.12-170.2.5.fc10 (2009-0923)
Update to kernel 2.6.27.12: http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.27.10 http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.27.11 http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.27.12 Includes security fixes: CVE-2009-0029 Linux Kernel insecure 64 bit system ca...
Firefox 3.0.x < 3.0.7 Multiple Vulnerabilities
The installed version of Firefox 3.0.x is earlier than 3.0.7. Such versions are potentially affected by the following security issues : - By exploiting stability bugs in the browser engine, it might be possible for an attacker to execute arbitrary code on the remote system under certain condition...
MyBB Detection
The remote host is running MyBB formerly known as MyBulletinBoard, a web-based bulletin board system written in PHP utilizing MySQL for its back-end storage. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid20841; scriptversion"1.21";...
AppServ appserv/main.php appserv_root Parameter Remote File Inclusion
The remote host appears to be running AppServ, a compilation of Apache, PHP, MySQL, and phpMyAdmin for Windows and Linux. The version of AppServ installed on the remote host fails to sanitize user-supplied input to the 'appservroot' parameter of the 'appserv/main.php' script before using it in a...
Microsoft Windows ICMP Type 9 Packet Remote DoS
It was possible to crash the remote machine by flooding it with ICMP type 9 packets. An attacker may use this attack to make this host crash continuously, preventing you from working. C Tenable Network Security, Inc. p-smash Script audit and contributions from Carmichael Security Erik Anderson...
FastCGI Multiple Sample CGI XSS
Two sample CGI's supplied with FastCGI are vulnerable to cross-site scripting attacks. FastCGI is an 'open extension to CGI that provides high performance without the limitations of server specific APIs', and is included in the default installation of the 'Unbreakable' Oracle9i Application Server...
Splunk Enterprise < 9.0 Multiple Vulnerabilities
The version of Splunk installed on the remote host is prior to 9.0. It is, therefore, affected by multiple vulnerabilities. - The httplib and urllib Python libraries that Splunk shipped with Splunk Enterprise did not validate certificates using the certificate authority CA certificate stores by...
IBM Java 7.0 < 7.0.10.80 / 7.1 < 7.1.4.80 / 8.0 < 8.0.6.25
The version of IBM Java installed on the remote host is prior to 7.0 7.0.10.80 / 7.1 7.1.4.80 / 8.0 8.0.6.25. It is, therefore, affected by a vulnerability as referenced in the Oracle January 19 2021 CPU advisory. - Vulnerability in the Java SE product of Oracle Java SE component: Libraries...
Oracle MySQL Workbench < 8.0.29 (Jan 2022)
The version of Oracle MySQL Workbench installed on the remote Windows host is prior to 8.0.29. It is, therefore, affected by a vulnerability in the MySQL Workbench product of Oracle MySQL component: Workbench: libssh. Supported versions that are affected are 8.0.28 and prior. Easily exploitable...
RHEL 8 : httpd:2.4 (RHSA-2022:1080)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:1080 advisory. The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: Errors encountered during...
AlmaLinux 8 : samba (ALSA-2021:5082)
The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:5082 advisory. - A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve the plaintext password sent over the wire...
Oracle Linux 8 : nodejs:14 (ELSA-2022-0350)
The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-0350 advisory. nodejs 1:14.18.2-2 - Add missing fixes - Resolves: RHBZ2027642, RHBZ2027635 1:14.18.2-1 - Resolves: RHBZ2027609 - Resolves: RHBZ2027649, RHBZ2027646,...
Oracle Linux 7 / 8 : Unbreakable Enterprise kernel-container (ELSA-2021-9623)
The remote Oracle Linux 7 / 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-9623 advisory. - bpf: Fix integer overflow in preallocelemsandfreelist Tatsuhiko Yasumatsu Orabug: 33431722 CVE-2021-41864 Tenable has extracted the preceding description...
Apache Log4j Installed (Linux / Unix)
Binary data apachelog4jnixinstalled.nbin...
RHEL 8 : thunderbird (RHSA-2021:3839)
The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:3839 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 91.2.0. Security Fixes: Mozilla:...
KB5006729: Windows 8.1 and Windows Server 2012 R2 Security Update (October 2021)
The remote Windows host is missing security update 5006729. It is, therefore, affected by multiple vulnerabilities. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the Microsoft Security Updates API. The text itself i...
OracleVM 3.4 : kernel-uek (OVMSA-2021-0023)
The remote OracleVM system is missing necessary patches to address security updates: - fs/seqfile.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer allocations, leading to an integer overflow, an Out-of-bounds Write, and escalation to root by an...
CentOS 8 : virt:rhel and virt-devel:rhel (CESA-2021:1064)
The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:1064 advisory. - QEMU: Regression of CVE-2020-10756 fix in virt:rhel/qemu-kvm in Red Hat Enterprise Linux 8.3 CVE-2021-20295 Note that Nessus has not tested for this issue but...
Debian DLA-2563-1 : openssl security update
It was discovered that there were two issues in the openssl cryptographic system : - CVE-2021-23840: Prevent an issue where 'Digital EnVeloPe' EVP-related calls could cause applications to behave incorrectly or even crash. - CVE-2021-23841: Prevent an issue in the X509 certificate parsing caused ...
CentOS 8 : thunderbird (CESA-2019:1308)
The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2019:1308 advisory. - mozilla: Cross-origin theft of images with ImageBitmapRenderingContext CVE-2018-18511 - Mozilla: Use-after-free in XMLHttpRequest CVE-2019-11691 -...
Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : OpenJDK 8 vulnerabilities (USN-4453-1)
The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4453-1 advisory. Johannes Kuhn discovered that OpenJDK 8 incorrectly handled access control contexts. An attacker could possibly use this issue to...
EulerOS 2.0 SP8 : php (EulerOS-SA-2020-1586)
According to the versions of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In PHP versions 7.2.x below 7.2.9, 7.3.x below 7.3.16 and 7.4.x below 7.4.34, while parsing EXIF data with exifreaddata function, it is possible fo...
Ubuntu 16.04 LTS / 18.04 LTS : OpenJDK vulnerabilities (USN-4257-1)
The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4257-1 advisory. It was discovered that OpenJDK incorrectly handled exceptions during deserialization in BeanContextSupport. An attacker could possibly use th...
Debian DSA-4571-1 : thunderbird - security update
Multiple security issues have been found in Thunderbird which could potentially result in the execution of arbitrary code or denial of service. Debian follows the Thunderbird upstream releases. Support for the 60.x series has ended, so starting with this update we're now following the 68.x...