Fedora 22 : ntp (2016-777d838c1b)

Security fix for CVE-2016-1548, CVE-2016-2516, CVE-2016-2518, CVE-2016-1550 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without...

OracleVM 3.2 : openssl (OVMSA-2016-0071)

The remote OracleVM system is missing necessary patches to address critical security updates : - To disable SSLv2 client connections create the file /etc/sysconfig/openssl-ssl-client-kill-sslv2 John Haxby orabug 21673934 - Backport openssl 08-Jan-2015 security fixes John Haxby orabug 20409893 - f...

Amazon Linux AMI : java-1.8.0-openjdk (ALAS-2016-688)

It was discovered that the ObjectInputStream class in the Serialization component of OpenJDK failed to properly ensure thread consistency when deserializing serialized input. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. CVE-2016-0686 It was...

Drupal 6.x < 6.38 Multiple Vulnerabilities

The version of Drupal running on the remote web server is 6.x prior to 6.38. It is, therefore, affected by the following vulnerabilities : - A flaw exists in the deserialization of user-supplied session data. An authenticated, remote attacker can exploit this, via truncated session data, to execu...

Debian DLA-410-1 : openjdk-6 security update (SLOTH)

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in breakouts of the Java sandbox, information disclosure, denial of service and insecure cryptography. CVE-2015-7575 A flaw was found in the way TLS 1.2 could use the MD5 hash functio...

MySQL Enterprise Monitor 2.3.x < 2.3.21 / 3.0.x < 3.0.23 Multiple Vulnerabilities

According to its self-reported version, the MySQL Enterprise Monitor application running on the remote host is 2.3.x prior to 2.3.21 or 3.0.x prior to 3.0.23. It is, therefore, potentially affected by multiple vulnerabilities : - An invalid read error exists in the ASN1TYPEcmp function due to...

F5 Networks BIG-IP : OpenSSL vulnerability (SOL16139) (FREAK)

The ssl3getkeyexchange function in s3clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct RSA-to-EXPORTRSA downgrade attacks and facilitate brute-force decryption by offering a weak ephemeral RSA key in a noncompliant role. C Tenable...

openSUSE Security Update : openssl (openSUSE-2015-447) (Logjam)

openssl was updated to fix six security issues. The following vulnerabilities were fixed : - CVE-2015-4000: The Logjam Attack / weakdh.org. Rject connections with DH parameters shorter than 768 bits, generates 2048-bit DH parameters by default. boo931698 - CVE-2015-1788: Malformed ECParameters...

SUSE SLED12 / SLES12 Security Update : java-1_7_0-openjdk (SUSE-SU-2014:1422-1)

OpenJDK was updated to icedtea 2.5.3 OpenJDK 7u71 fixing security issues and bugs. - Security : - S8015256: Better class accessibility - S8022783, CVE-2014-6504: Optimize C2 optimizations - S8035162: Service printing service - S8035781: Improve equality for annotations - S8036805: Correct linker...

MS15-051: Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (3057191)

The version of Windows running on the remote host is affected by multiple vulnerabilities : - Multiple information disclosure vulnerabilities exist due to the Win32k.sys kernel-mode driver improperly handling objects in memory. A local attacker can exploit this to reveal private address informati...

OracleVM 3.3 : xen (OVMSA-2014-0038) (POODLE)

The remote OracleVM system is missing necessary patches to address critical security updates : - xend: disable sslv3 due to CVE-2014-3566 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were extracted from OracleVM Security Advisory OVMSA-2014-0038...

Oracle Linux 6 / 7 : java-1.7.0-openjdk (ELSA-2014-1620)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1620 advisory. 1:1.7.0.65-2.5.3.1.0.1.el70 - Update DISTRONAME in specfile 1:1.7.0.65-2.5.3.1 - Bump to 2.5.3 for latest security fixes. - Remove obsolete patches...

MS KB2868725: Update for Disabling RC4

The remote host is missing KB2868725, an update for disabling the weak RC4 cipher suite. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid70854; scriptversion"1.3"; scriptcvsdate"Date: 2018/11/15 20:50:28"; scriptxrefname:"MSKB", value:"2868725"; scriptnameenglish:"MS...

Mozilla Thunderbird ESR < 17.0.10 Multiple Vulnerabilities

The installed version of Thunderbird ESR is earlier than 17.0.10 and is, therefore, potentially affected the following vulnerabilities: - The implementation of Network Security Services NSS does not ensure that data structures are initialized, which could result in a denial of service or disclosu...

Oracle Linux 3 / 4 : cups (ELSA-2009-1083)

From Red Hat Security Advisory 2009:1083 : Updated cups packages that fix multiple security issues are now available for Red Hat Enterprise Linux 3 and 4. This update has been rated as having important security impact by the Red Hat Security Response Team. The Common UNIXr Printing System CUPS...

PHP < 5.3.12 / 5.4.2 CGI Query String Code Execution

According to its banner, the version of PHP installed on the remote host is earlier than 5.3.12 / 5.4.2, and as such is potentially affected by a remote code execution and information disclosure vulnerability. An error in the file 'sapi/cgi/cgimain.c' can allow a remote attacker to obtain PHP...

CentOS 5 : postgresql84 (CESA-2011:1378)

Updated postgresql84 packages that fix one security issue are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, i...

Fedora 11 : Miro-2.5.2-7.fc11 / blam-1.8.5-17.fc11 / chmsee-1.0.1-14.fc11 / epiphany-2.26.3-7.fc11 / etc (2009-13333)

Update to new upstream Firefox version 3.5.6, fixing multiple security issues detailed in the upstream advisories: http://www.mozilla.org/security/known- vulnerabilities/firefox35.htmlfirefox3.5.6 Update also includes all packages depending on gecko-libs rebuilt against new version of Firefox /...

Mandriva Linux Security Advisory : libtool (MDVSA-2009:307-1)

A vulnerability was discovered and corrected in libtool : All versions of libtool prior to 2.2.6b suffers from a local privilege escalation vulnerability that could be exploited under certain conditions to load arbitrary code CVE-2009-3736. This advisory fixes this issue. Additionally, all...

CGI Generic SQL Injection

By providing specially crafted parameters to CGIs, Nessus was able to get an error from the underlying database. This error suggests that the CGI is affected by a SQL injection vulnerability. An attacker may exploit this flaw to bypass authentication, read confidential data, modify the remote...

Firefox < 2.0.0.18 Multiple Vulnerabilities

The installed version of Firefox is earlier than 2.0.0.18. Such versions are potentially affected by the following security issues : - Locally saved '.url' shortcut files can be used to read information stored in the local cache. MFSA 2008-47 - The canvas element can be used in conjunction with a...

Coppermine Photo Gallery < 1.4.19 data Cookie Local File Inclusion

Binary data 4613.prm...

SuSE 10 Security Update : MozillaFirefox (ZYPP Patch Number 5405)

Mozilla Firefox was updated to version 2.0.0.15, fixing various bugs including following security bugs : - Mozilla developers identified and fixed several stability bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these crashes showed evidence of memory...

Debian DSA-1479-1 : linux-2.6 - several vulnerabilities

Several local vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2007-2878 Bart Oldeman reported a denial of service DoS issue ...

SuSE 10 Security Update : PHP5 (ZYPP Patch Number 4808)

This update fixes multiple bugs in php : - use system pcre library to fix several pcre vulnerabilities. CVE-2007-1659 / CVE-2006-7230 / CVE-2007-1660 / CVE-2006-7227 / CVE-2005-4872 / CVE-2006-7228 - Flaws in processing multi byte sequences in htmlentities/htmlspecialchars. CVE-2007-5898 - overly...

RHEL 2.1 / 3 / 4 / 5 : samba (RHSA-2007:1114)

Updated samba packages that fix a security issue and a bug are now available for Red Hat Enterprise Linux. This update has been rated as having critical security impact by the Red Hat Security Response Team. Samba is a suite of programs used by machines to share files, printers, and other...

Sophos Anti-Virus Detection and Status

Sophos Anti-Virus, a commercial antivirus software package for Windows, is installed on the remote host. However, there is a problem with the installation; either its services are not running or its engine and/or virus definitions are out of date. C Tenable Network Security, Inc...

RIP Poisoning Routing Table Modification

The remote RIP listener accepts routes that are not sent by a neighbor. This cannot happen in the RIP protocol as defined by RFC2453, and although the RFC is silent on this point, such routes should probably be ignored. A remote attacker might use this flaw to access the local network if it is no...

WordPress 5.7.x < 5.7.12 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A Cross-Site Scripting XSS vulnerability affecting the HTML API. - A Cross-Site Scripting XSS vulnerability affecting the Template Part block. - A path traversal issue...

RHEL 8 : openssl (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - openssl: the crehash script allows command injection CVE-2022-2068 - The OpenSSL DSA signature algorithm...

VMware vCenter Server 6.5 < 6.5U3v / 6.7 < 6.7U3t / 7.0 < 7.0U3o / 8.0 < 8.0U1d Out-of-bounds Write (VMSA-2023-0023)

The version of VMware vCenter Server installed on the remote host is 6.5 prior to 6.5U3v, 6.7 prior to 6.7U3t, 7.0 prior to 7.0U3o, or 8.0 prior to 8.0U1d. It is, therefore, affected by an out-of-bounds write vulnerability as referenced in the VMSA-2023-0023 advisory: - vCenter Server contains an...

Juniper Junos OS Pre-Auth RCE (JSA72300)

The version of Junos OS installed on the remote host is affected by multiple vulnerabilities as referenced in the JSA72300 advisory. - A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX and SRX Series allows an unauthenticated, network-based attacker to...

EulerOS 2.0 SP8 : openssl (EulerOS-SA-2022-2228)

According to the versions of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In addition to the crehash shell command injection identified in CVE-2022-1292, further circumstances where the crehash script does not properl...

Atlassian Jira 8.13.x < 8.13.21 / 8.20.x < 8.20.9 / 8.22.x < 8.22.3 / 9.0.0 SQLI (JRASERVER-73885)

The version of Atlassian Jira installed on the remote host is prior to 8.13.x 8.13.21 / 8.20.x 8.20.9 / 8.22.x 8.22.3 / 9.0.0. It is, therefore, affected by a vulnerability as referenced in the JRASERVER-73885 advisory. - The version of log4j used by Jira has been updated from version...

EulerOS 2.0 SP10 : expat (EulerOS-SA-2022-1645)

According to the versions of the expat package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Expat aka libexpat before 2.4.4 has a signed integer overflow in XMLGetBuffer, for configurations with a nonzero XMLCONTEXTBYTES. CVE-2022-23852 -...

EulerOS 2.0 SP9 : golang (EulerOS-SA-2022-1449)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header falsely designating that many files are present can cause ...

Oracle Linux 8 : kernel (ELSA-2022-0188)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-0188 advisory. - vfs: Out-of-bounds write of heap buffer in fscontext.c Frantisek Hrbata 2040585 2040586 CVE-2022-0185 - xfs: map unwritten blocks in XFSIOCALLOC,FREE...

EulerOS 2.0 SP8 : httpd (EulerOS-SA-2021-2803)

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier. CVE-2021-34798 -...

CentOS 8 : thunderbird (CESA-2021:2883)

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2021:2883 advisory. - Mozilla: IMAP server responses sent by a MITM prior to STARTTLS could be processed CVE-2021-29969 - Mozilla: Use-after-free in accessibility features...

RHEL 7 : thunderbird (RHSA-2021:2881)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:2881 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 78.12.0. Security Fixes: Mozilla:...

Photon OS 3.0: Linux PHSA-2021-3.0-0229

An update of the linux package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-3.0-0229. The text itself is copyright C VMware, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if descripti...

Ubuntu 18.04 LTS / 20.04 LTS : WebKitGTK vulnerabilities (USN-4894-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4894-1 advisory. A large number of security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a maliciou...

GLSA-202012-24 : Samba: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202012-24 Samba: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Samba. Please review the CVE identifiers referenced below for details. Impact : Please review the referenced CVE identifiers for details...

Oracle WebLogic Server RCE (CVE-2020-14882)

Binary data oracleweblogicserverCVE-2020-14882.nbin...

RHEL 8 : virt:rhel (RHSA-2020:4058)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:4058 advisory. Kernel-based Virtual Machine KVM offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contains packag...

EulerOS Virtualization 3.0.6.0 : kvm (EulerOS-SA-2020-1792)

According to the versions of the kvm package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - An out-of-bounds access issue was found in the Linux kernel, all versions through 5.3, in the way Linux kernel's KVM hypervisor...

FreeBSD : drm graphics drivers -- Local privilege escalation and denial of service (ecb7fdec-0b82-11ea-874d-0c9d925bbbc0)

Intel reports : As part of IPU 2019.2, INTEL-SA-00242 advises that insufficient access control may allow an authenticated user to potentially enable escalation of privilege via local access. INTEL-SA-00260 advises that insufficient access control may allow an authenticated user to potentially...

Oracle Linux 8 : thunderbird (ELSA-2019-1799)

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2019-1799 advisory. 60.8.0-1.0.1 60.8.0-1 - Updated to 60.8.0 60.7.2-3 - Rebuild to fix rhbz1725919 - Thunderbird fails to authenticate with gmail with ssl/tls and OAuth2...

SUSE SLED12 / SLES12 Security Update : python (SUSE-SU-2019:2091-1)

This update for python fixes the following issues : CVE-2019-10160: Fixed a regression in urlparse and urlsplit introduced by the fix for CVE-2019-9636 bsc1138459. CVE-2018-20852: Fixed an information leak where cookies could be send to the wrong server because of incorrect domain validation...

Debian DLA-1869-1 : firefox-esr security update

Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, cross-site scripting, spoofing, information disclosure, denial of service or cross-site request forgery. For Debian 8 'Jessie', these problems have been...