Oracle Linux 6 : php (ELSA-2013-0514)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-0514 advisory. - remove reproducer from security fix for CVE-2012-0781 - add security fixes for CVE-2012-2688, CVE-2012-0831, CVE-2011-1398 Tenable has extracted the...

Thunderbird < 17.0.2 Multiple Vulnerabilities (Mac OS X)

The installed version of Thunderbird is earlier than 17.0.2 and thus, is potentially affected by the following security issues : - Two intermediate certificates were improperly issued by TURKTRUST certificate authority. CVE-2013-0743 - A use-after-free error exists related to displaying HTML tabl...

Scientific Linux Security Update : java (jdk 1.6.0) on SL4.x, SL5.x i386/x86_64

This update fixes several vulnerabilities in the Sun Java 6 Runtime Environment and the Sun Java 6 Software Development Kit. These vulnerabilities are summarized on the 'Advance notification of Security Updates for Java SE' page from Sun Microsystems, listed in the References section. All running...

TeamViewer Insecure Directory Permissions Privilege Escalation

According to its version number, the TeamViewer install on the remote Windows host is affected by a privilege escalation vulnerability due to insecure file system permissions that are granted during installation. When 'Remote Access' is enabled, it may be possible for an attacker to execute...

CentOS 4 : seamonkey (CESA-2011:0313)

Updated SeaMonkey packages that fix several security issues are now available for Red Hat Enterprise Linux 4. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, ar...

SuSE 10 Security Update : OpenOffice_org (ZYPP Patch Number 6884)

This update of OpenOfficeorg includes fixes for the following vulnerabilities : - XML signature weakness CVE-2009-2949: XPM Import Integer Overflow CVE-2009-2950: GIF Import Heap Overflow CVE-2009-3301: MS Word sprmTDefTable Memory Corruption CVE-2009-3302: MS Word sprmTDefTable Memory Corruption...

Fedora 11 : gnash-0.8.6-13.fc11 (2010-1833)

This update makes Gnash use the system version of the libltdl library instead of the bundled copy which was vulnerable to CVE-2009-3736. An update to the system libltdl fixing CVE-2009-3736 was issued on December 21, 2009. Note that Tenable Network Security has extracted the preceding description...

CentOS 5 : ghostscript (CESA-2009:0421)

Updated ghostscript packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Ghostscript is a set of software that provides a PostScript interpreter, a set of C...

CGI Generic SQL Injection (HTTP Headers)

By sending specially crafted HTTP headers to one or more CGI scripts hosted on the remote web server, Nessus was able to cause an error in the underlying database. This error suggests that the CGI scripts are prone to SQL injection attack. An attacker may be able to exploit this issue to bypass...

SuSE9 Security Update : libpng (YOU Patch Number 12358)

A allocation mistake in libpng's pngread.c has been fixed CVE-2009-0040. The previous update was using an incomplete patch so it needed to be reissued. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

openSUSE 10 Security Update : kdegraphics3-pdf (kdegraphics3-pdf-4681)

A buffer overflow in the xpdf code contained in kpdf could be exploited by attackers to potentially execute arbitrary code CVE-2007-5393. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update...

MS07-028: Vulnerability in CAPICOM Could Allow Remote Code Execution (931906) (deprecated)

This plugin has been deprecated because KB931906 is no longer available for download. C Tenable Network Security, Inc. @DEPRECATED@ Disabled on 2021/08/20. Deprecated because KB931906 is no longer available for download. include"compat.inc"; if description scriptid25167; scriptversion"1.38";...

MyBB Detection

The remote host is running MyBB formerly known as MyBulletinBoard, a web-based bulletin board system written in PHP utilizing MySQL for its back-end storage. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid20841; scriptversion"1.21";...

Solaris 10 (x86) : 118669-86 (deprecated)

JavaSE 5.0x86: update 85 patch equivalent to JDK 5.0u85, 64bit. Date this patch was last updated by Sun : Apr/13/15 This plugin has been deprecated and either replaced with individual 118669 patch-revision plugins, or deemed non-security related. %NASLMINLEVEL 70300 C Tenable Network Security, In...

Mozilla Firefox < 2.0.0.15 Multiple Vulnerabilities

Binary data 4567.prm...

CentOS 9 : openssh-8.7p1-42.el9

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the openssh-8.7p1-42.el9 build changelog. - A security regression CVE-2006-5051 was discovered in OpenSSH's server sshd. There is a race condition which can lead to sshd to handle some...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2022-9694)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-9694 advisory. 4.1.12-124.65.1.1 - netsched: clsroute: remove from list when handle is 0 Thadeu Lima de Souza Cascardo Orabug: 34460939 CVE-2022-2588 Tenable has extracted...

Scientific Linux Security Update : thunderbird on SL7.x x86_64 (2022:4891)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2022:4891-1 advisory. - Mozilla: Braille space character caused incorrect sender email to be shown for a digitally signed email CVE-2022-1834 - Mozilla: Cross-Origin...

Debian DSA-5133-1 : qemu - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5133 advisory. Multiple security issues were discovered in QEMU, a fast processor emulator, which could result in denial of service or the execution of arbitrary code. For the...

EulerOS Virtualization 2.9.0 : expat (EulerOS-SA-2022-1628)

According to the versions of the expat package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - In Expat aka libexpat before 2.4.3, a left shift by 29 or more places in the storeAtts function in xmlparse.c can lead to realloc...

IBM Java 7.0 < 7.0.10.80 / 7.1 < 7.1.4.80 / 8.0 < 8.0.6.25

The version of IBM Java installed on the remote host is prior to 7.0 7.0.10.80 / 7.1 7.1.4.80 / 8.0 8.0.6.25. It is, therefore, affected by a vulnerability as referenced in the Oracle January 19 2021 CPU advisory. - Vulnerability in the Java SE product of Oracle Java SE component: Libraries...

Oracle MySQL Workbench < 8.0.29 (Jan 2022)

The version of Oracle MySQL Workbench installed on the remote Windows host is prior to 8.0.29. It is, therefore, affected by a vulnerability in the MySQL Workbench product of Oracle MySQL component: Workbench: libssh. Supported versions that are affected are 8.0.28 and prior. Easily exploitable...

EulerOS 2.0 SP3 : openssl098e (EulerOS-SA-2022-1180)

According to the versions of the openssl098e package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - ASN.1 strings are represented internally within OpenSSL as an ASN1STRING structure which contains a buffer holding the string data and a fie...

Amazon Linux 2 : vim (ALAS-2021-1728)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1728 advisory. 2024-05-09: CVE-2020-20703 was added to this advisory. Buffer Overflow vulnerability in VIM v.8.1.2135 allows a remote attacker to execute arbitrary code via the operand parameter. CVE-2020-20703...

EulerOS 2.0 SP9 : libxml2 (EulerOS-SA-2021-2275)

According to the versions of the libxml2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - There's a flaw in libxml2's xmllint in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by xmllint coul...

RabbitMQ < 3.8.18 XSS

Pivotal RabbitMQ versions prior to 3.8.18 are affected by a cross-site scripting XSS vulnerability in the rabbitmqfederationmanagement plugin due to improper validation of user-supplied input before returning it to users. An unauthenticated, remote attacker can exploit this, by convincing a user ...

FreeBSD : PostgreSQL server -- two security issues (62da9702-b4cc-11eb-b9c9-6cc21735f730)

The PostgreSQL project reports : Memory disclosure in INSERT ... ON CONFLICT ... DO UPDATE Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted table, an attacker can read arbitrary bytes of server memory. In the default configuration, any authenticated database user can...

FreeBSD : Node.js -- April 2021 Security Releases (c0c1834c-9761-11eb-acfd-0022489ad614)

Node.js reports : OpenSSL - CA certificate check bypass with X509VFLAGX509STRICT High CVE-2021-3450 This is a vulnerability in OpenSSL which may be exploited through Node.js. You can read more about it in https://www.openssl.org/news/secadv/20210325.txt OpenSSL - NULL pointer deref in...

Fedora 32 : python39 (2021-e3a5a74610)

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-e3a5a74610 advisory. - Python 3.x through 3.9.1 has a buffer overflow in PyCArgrepr in ctypes/callproc.c, which may lead to remote code execution in certain Python...

SUSE SLES12 Security Update : xen (SUSE-SU-2020:3088-1)

This update for xen fixes the following issues : bsc1177409 - VUL-0: CVE-2020-27673: xen: x86 PV guest INVLPG-like flushes may leave stale TLB entries XSA-286 bsc1177412 - VUL-0: CVE-2020-27672: xen: Race condition in Xen mapping code XSA-345 bsc1177413 - VUL-0: CVE-2020-27671: xen: undue deferra...

Oracle Linux 7 : freeradius (ELSA-2020-3984)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-3984 advisory. 3.0.13-15 - Fixes EAP-PWD: DoS issues due to multithreaded BNCTX access Resolves: bz1818808 3.0.13-14 - Fixes receiving of multiple RADIUS packets unde...

EulerOS Virtualization for ARM 64 3.0.2.0 : bind (EulerOS-SA-2020-1953)

According to the versions of the bind packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - An assertion failure was found in BIND, which checks the validity of messages containing TSIG resource records. This fla...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : OpenJDK 8 vulnerabilities (USN-4453-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4453-1 advisory. Johannes Kuhn discovered that OpenJDK 8 incorrectly handled access control contexts. An attacker could possibly use this issue to...

openSUSE Security Update : gcc9 (openSUSE-2020-716)

This update includes the GNU Compiler Collection 9. This update ships the GCC 9.3 release. A full changelog is provided by the GCC team on : https://www.gnu.org/software/gcc/gcc-9/changes.html The base system compiler libraries libgccs1, libstdc++6 and others are now built by the gcc 9 packages. ...

Oracle Linux 7 : firefox (ELSA-2020-2037)

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-2037 advisory. 68.8.0-1.0.1 - Remove upstream references Orabug: 30143292 - Update distribution for Oracle Linux Orabug: 30143292 - Add firefox-oracle-default-prefs.j...

SSLv2-Only Open Ports Unsupported

This plugin detects if the remote host has any open ports which only support SSLv2. This protocol has been deprecated since 2011 because of security vulnerabilities and most major SSL libraries such as OpenSSL, NSS, Mbed TLS, and wolfSSL do not provide this functionality in their latest versions...

Fedora 30 : python3 / python3-docs (2019-9bfb4a3e4b)

Python 3.7.4 is the fourth and most recent maintenance release of Python 3.7. Changelog for final, 3.7.4 release candidate 2 and 3.7.4 release candidate 1. Contains security fixes for CVE-2019-9948 and CVE-2019-10160. Note that Tenable Network Security has extracted the preceding description bloc...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2019-4703)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-4703 advisory. kernel-uek 3.8.13-118.36.1 - tun: call devgetvalidname before registernetdevice Cong Wang Orabug: 29925557 CVE-2018-7191 Tenable has extracted the preceding...

SUSE SLED12 / SLES12 Security Update : ucode-intel (SUSE-SU-2019:1296-1) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)

This update for ucode-intel fixes the following issues : ucode-intel was updated to official QSR 2019.1 microcode release bsc1111331 CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091 ---- new platforms ---------------------------------------- VLV C0 6-37-8/02 00000838 Atom Z series VLV ...

RHEL 7 : thunderbird (RHSA-2019:0160)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:0160 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 60.4.0. Security Fixes: Mozilla:...

Oracle Java SE 1.7.x < 1.7.0_211 / 1.8.x < 1.8.0_201 / 1.11.x < 1.11.0_2 Multiple Vulnerabilities (January 2019 CPU) (Unix)

The version of Oracle formerly Sun Java SE or Java for Business installed on the remote host is prior to 7 Update 211, 8 Update 201, 11 Update 2. It is, therefore, affected by multiple vulnerabilities related to the following components : - An issue in libjpeg 9a, a divide-by-zero error, could...

Oracle Linux 6 : firefox (ELSA-2018-3831)

The remote Oracle Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2018-3831 advisory. 60.4.0-1.0.1 - fix LDLIBRARYPATH - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat one 60.4.0-1 - Update to 60.4.0 ESR 60.3.0-...

Kibana ESA-2018-18

Nethanel Coppenhagen of CyberArk Labs discovered Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute javascript code. This could possibly lead to...

Photon OS 2.0 : libtiff / glibc / libsoup (PhotonOS-PHSA-2018-2.0-0060) (deprecated)

An update of 'libtiff', 'glibc', 'libsoup' packages of Photon OS has been released. C Tenable Network Security, Inc. @DEPRECATED@ Disabled on 2/7/2019 The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2018-2.0-0060. The text itself is copyrig...

SUSE SLES11 Security Update : libvirt (SUSE-SU-2018:1452-1) (Spectre)

This update for libvirt fixes the following issues : - CVE-2018-3639: cpu: add support for 'ssbd' and 'virt-ssbd' CPUID feature bits pass through. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to...

Solaris 10 (sparc) : 123590-12

SunOS 5.10: PostgreSQL patch. Date this patch was last updated by Sun : Jan/14/10 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

EulerOS 2.0 SP2 : java-1.8.0-openjdk (EulerOS-SA-2018-1028)

According to the versions of the java-1.8.0-openjdk packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Multiple flaws were found in the Hotspot and AWT components of OpenJDK. An untrusted Java application or applet could use these flaw...

openSUSE Security Update : ImageMagick (openSUSE-2018-61)

This update for ImageMagick fixes several issues. These security issues were fixed : - CVE-2018-5246: Fixed memory leak vulnerability in ReadPATTERNImage in coders/pattern.c bsc1074973 - CVE-2017-18022: Fixed memory leak vulnerability in MontageImageCommand in MagickWand/montage.c bsc1074975 -...

Grandstream Phone Web UI Information Disclosure

The remote Grandstream phone is affected by an information disclosure vulnerability in the web administration interface due to the failure to restrict access to sensitive configuration data. An unauthenticated, remote attacker can exploit this to disclose sensitive information related to the...

RHEL 6 / 7 : java-1.8.0-oracle (RHSA-2016:2088)

An update for java-1.8.0-oracle is now available for Oracle Java for Red Hat Enterprise Linux 6 and Oracle Java for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which give...