and <textarea>, can contain literal angle brackets without treating them as markup. It is possible to pass a literal closing tag to .innerHTML on these elements, and subsequent content after that will be parsed as if it were outside the tag. This can lead to XSS if a site does not filter user input as strictly for these elements as it does for other elements. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1. (CVE-2019-11744) - A use-after-free vulnerability can occur while manipulating video elements if the body is freed while still in use. This results in a potentially exploitable crash. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1. (CVE-2019-11746) - It is possible to delete an IndexedDB key value and subsequently try to extract it during conversion. This results in a use-after-free and a potentially exploitable crash. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1. (CVE-2019-11752) - When following the value's prototype chain, it was possible to retain a reference to a locale, delete it, and subsequently reference it. This resulted in a use-after-free and a potentially exploitable crash. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. (CVE-2019-11757) - Mozilla community member Philipp reported a memory safety bug present in Firefox 68 when 360 Total Security was installed. This bug showed evidence of memory corruption in the accessibility engine and we presume that with enough effort that it could be exploited to run arbitrary code. This vulnerability affects Firefox < 69, Thunderbird < 68.2, and Firefox ESR < 68.2. (CVE-2019-11758) - If two same-origin documents set document.domain differently to become cross-origin, it was possible for them to call arbitrary DOM methods/getters/setters on the now-cross-origin window. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. (CVE-2019-11762) - Failure to correctly handle null bytes when processing HTML entities resulted in Firefox incorrectly parsing these entities. This could have led to HTML comment text being treated as HTML which could have led to XSS in a web application under certain conditions. It could have also led to HTML entities being masked from filters - enabling the use of entities to mask the actual characters of interest from filters. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. (CVE-2019-11763) - Mozilla developers and community members reported memory safety bugs present in Firefox 69 and Firefox ESR 68.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. (CVE-2019-11764) - An attacker could have caused 4 bytes of HMAC output to be written past the end of a buffer stored on the stack. This could be used by an attacker to execute arbitrary code or more likely lead to a crash. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. (CVE-2019-11759) - A fixed-size stack buffer could overflow in nrappkit when doing WebRTC signaling. This resulted in a potentially exploitable crash in some instances. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. (CVE-2019-11760) - By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned into content. Impact from exposing this object appears to be minimal, however it was a bypass of existing defense in depth mechanisms. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. (CVE-2019-11761) - Under certain conditions, when checking the Resist Fingerprinting preference during device orientation checks, a race condition could have caused a use-after-free and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71. (CVE-2019-17010) - Under certain conditions, when retrieving a document from a DocShell in the antitracking code, a race condition could cause a use-after-free condition and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71. (CVE-2019-17011) - Mozilla developers reported memory safety bugs present in Firefox 70 and Firefox ESR 68.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71. (CVE-2019-17012) - When using nested workers, a use-after-free could occur during worker destruction. This resulted in a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71. (CVE-2019-17008) - The plain text serializer used a fixed-size array for the number of elements it could process; however it was possible to overflow the static-sized array leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71. (CVE-2019-17005) - By carefully crafting promise resolutions, it was possible to cause an out-of-bounds read off the end of an array resized during script execution. This could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox < ESR68.6, and Firefox ESR < 68.6. (CVE-2020-6806) - In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting in an exploitable use-after-free condition. This vulnerability affects Firefox < 82.0.3, Firefox ESR < 78.4.1, and Thunderbird < 78.4.2. (CVE-2020-26950) - When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer does not escape < and > characters. Because the resulting string is pasted directly into the text node of the element this does not result in a direct injection into the webpage; however, if a webpage subsequently copies the node's innerHTML, assigning it to another innerHTML, this would result in an XSS vulnerability. Two WYSIWYG editors were identified with this behavior, more may exist. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72. (CVE-2019-17022) - When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule. This could allow for injection into certain types of websites resulting in data exfiltration. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72. (CVE-2019-17016) - Due to a missing case handling object types, a type confusion vulnerability could occur, resulting in a crash. We presume that with enough effort that it could be exploited to run arbitrary code. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72. (CVE-2019-17017) - Mozilla developers reported memory safety bugs present in Firefox 71 and Firefox ESR 68.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72. (CVE-2019-17024) - Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 68.4.1, Thunderbird < 68.4.1, and Firefox < 72.0.1. (CVE-2019-17026) - When processing an email message with an ill-formed envelope, Thunderbird could read data from a random memory location. This vulnerability affects Thunderbird < 68.5. (CVE-2020-6793) - When processing a message that contains multiple S/MIME signatures, a bug in the MIME processing code caused a null pointer dereference, leading to an unexploitable crash. This vulnerability affects Thunderbird < 68.5. (CVE-2020-6795) - When deriving an identifier for an email message, uninitialized memory was used in addition to the message contents. This vulnerability affects Thunderbird < 68.5. (CVE-2020-6792) - If a template tag was used in a select tag, the parser could be confused and allow JavaScript parsing and execution when it should not be allowed. A site that relied on the browser behaving correctly could suffer a cross-site scripting vulnerability as a result. In general, this flaw cannot be exploited through email in the Thunderbird product because scripting is disabled when reading mail, but is potentially a risk in browser or browser-like contexts. This vulnerability affects Thunderbird < 68.5, Firefox < 73, and Firefox < ESR68.5. (CVE-2020-6798) - Mozilla developers and community members reported memory safety bugs present in Firefox 72 and Firefox ESR 68.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. In general, these flaws cannot be exploited through email in the Thunderbird product because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts. This vulnerability affects Thunderbird < 68.5, Firefox < 73, and Firefox < ESR68.5. (CVE-2020-6800) - If a user saved passwords before Thunderbird 60 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is because the older stored password file was not deleted when the data was copied to a new format starting in Thunderbird 60. The new master password is added only on the new file. This could allow the exposure of stored password data outside of user expectations. This vulnerability affects Thunderbird < 68.5. (CVE-2020-6794) - In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read. (CVE-2019-15903) - The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website. If a user used the 'Copy as Curl' feature and pasted the command into a terminal, it could have resulted in command injection and arbitrary command execution. This vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox < ESR68.6, and Firefox ESR < 68.6. (CVE-2020-6811) - usrsctp before 2019-12-20 has out-of-bounds reads in sctp_load_addresses_from_init. (CVE-2019-20503) - The first time AirPods are connected to an iPhone, they become named after the user's name by default (e.g. Jane Doe's AirPods.) Websites with camera or microphone permission are able to enumerate device names, disclosing the user's name. To resolve this issue, Firefox added a special case that renames devices containing the substring 'AirPods' to simply 'AirPods'. This vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox < ESR68.6, and Firefox ESR < 68.6. (CVE-2020-6812) - When a device was changed while a stream was about to be destroyed, the stream-reinit task may have been executed after the stream was destroyed, causing a use-after-free and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox < ESR68.6, and Firefox ESR < 68.6. (CVE-2020-6807) - Mozilla developers reported memory safety bugs present in Firefox and Thunderbird 68.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox < ESR68.6, and Firefox ESR < 68.6. (CVE-2020-6814) - Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after- free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1. (CVE-2020-6819) - Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1. (CVE-2020-6820) - When reading from areas partially or fully outside the source resource with WebGL's copyTexSubImage method, the specification requires the returned values be zero. Previously, this memory was uninitialized, leading to potentially sensitive data disclosure. This vulnerability affects Thunderbird < 68.7.0, Firefox ESR < 68.7, and Firefox < 75. (CVE-2020-6821) - On 32-bit builds, an out of bounds write could have occurred when processing an image larger than 4 GB in GMPDecodeData. It is possible that with enough effort this could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.7.0, Firefox ESR < 68.7, and Firefox < 75. (CVE-2020-6822) - Mozilla developers and community members Tyson Smith and Christian Holler reported memory safety bugs present in Firefox 74 and Firefox ESR 68.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.7.0, Firefox ESR < 68.7, and Firefox < 75. (CVE-2020-6825) - A race condition when running shutdown code for Web Worker led to a use-after-free vulnerability. This resulted in a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0. (CVE-2020-12387) - A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC. This could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0. (CVE-2020-6831) - The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a request, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the command into a terminal, it could have resulted in the disclosure of local files. This vulnerability affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0. (CVE-2020-12392) - Mozilla developers and community members reported memory safety bugs present in Firefox 75 and Firefox ESR 68.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0. (CVE-2020-12395) - Mozilla developers reported memory safety bugs present in Firefox 76 and Firefox ESR 68.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9. (CVE-2020-12410) - Mozilla Developer Iain Ireland discovered a missing type check during unboxed objects removal, resulting in a crash. We presume that with enough effort that it could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9. (CVE-2020-12406) - When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a potentially exploitable crash. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9. (CVE-2020-12405) - If Thunderbird is configured to use STARTTLS for an IMAP server, and the server sends a PREAUTH response, then Thunderbird will continue with an unencrypted connection, causing email data to be sent without protection. This vulnerability affects Thunderbird < 68.9.0. (CVE-2020-12398) - Manipulating individual parts of a URL object could have caused an out-of-bounds read, leaking process memory to malicious JavaScript. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0. (CVE-2020-12418) - When processing callbacks that occurred during window flushing in the parent process, the associated window may die; causing a use-after-free condition. This could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0. (CVE-2020-12419) - When trying to connect to a STUN server, a race condition could have caused a use-after-free of a pointer, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0. (CVE-2020-12420) - When performing add-on updates, certificate chains terminating in non-built-in-roots were rejected (even if they were legitimately added by an administrator.) This could have caused add-ons to become out-of-date silently without notification to the user. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0. (CVE-2020-12421) - Use after free in ANGLE in Google Chrome prior to 81.0.4044.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (CVE-2020-6463) - Inappropriate implementation in WebRTC in Google Chrome prior to 84.0.4147.89 allowed an attacker in a privileged network position to potentially exploit heap corruption via a crafted SCTP stream. (CVE-2020-6514) - By observing the stack trace for JavaScript errors in web workers, it was possible to leak the result of a cross-origin redirect. This applied only to content that can be parsed as script. This vulnerability affects Firefox < 79, Firefox ESR < 68.11, Firefox ESR < 78.1, Thunderbird < 68.11, and Thunderbird < 78.1. (CVE-2020-15652) - Mozilla developers and community members reported memory safety bugs present in Firefox 78 and Firefox ESR 78.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 79, Firefox ESR < 68.11, Firefox ESR < 78.1, Thunderbird < 68.11, and Thunderbird < 78.1. (CVE-2020-15659) - By encoding Unicode whitespace characters within the From email header, an attacker can spoof the sender email address that Thunderbird displays. This vulnerability affects Thunderbird < 68.8.0. (CVE-2020-12397) - By holding a reference to the eval() function from an about:blank window, a malicious webpage could have gained access to the InstallTrigger object which would allow them to prompt the user to install an extension. Combined with user confusion, this could result in an unintended or malicious extension being installed. This vulnerability affects Firefox < 80, Thunderbird < 78.2, Thunderbird < 68.12, Firefox ESR < 68.12, Firefox ESR < 78.2, and Firefox for Android < 80. (CVE-2020-15664) - When aborting an operation, such as a fetch, an abort signal may be deleted while alerting the objects to be notified. This results in a use-after-free and we presume that with enough effort it could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 68.12 and Thunderbird < 68.12. (CVE-2020-15669) - By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the download file dialog to show the original site (the one suffering from the open redirect) rather than the site the file was actually downloaded from. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3. (CVE-2020-15677) - Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaScript being executed after pasting attacker-controlled data into a contenteditable element. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3. (CVE-2020-15676) - When recursing through graphical layers while scrolling, an iterator may have become invalid, resulting in a potential use-after-free. This occurs because the function APZCTreeManager::ComputeClippedCompositionBounds did not follow iterator invalidation rules. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3. (CVE-2020-15678) - Mozilla developers reported memory safety bugs present in Firefox 80 and Firefox ESR 78.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3. (CVE-2020-15673) - If an attacker intercepts Thunderbird's initial attempt to perform automatic account setup using the Microsoft Exchange autodiscovery mechanism, and the attacker sends a crafted response, then Thunderbird sends username and password over https to a server controlled by the attacker. This vulnerability affects Thunderbird < 68.10.0. (CVE-2020-15646) - Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.4, Firefox < 82, and Thunderbird < 78.4. (CVE-2020-15683) - Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (CVE-2020-15969) Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.</article></body></html>

The remote NewStart CGSL host, running version MAIN 4.06, has thunderbird packages installed that are affected by multiple vulnerabilities: - When removing data about an origin whose tab was recently closed, a use-after-free could occur in the Quota manager, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox < ESR68.6, and Firefox ESR < 68.6. (CVE-2020-6805) - Encrypted S/MIME parts in a crafted multipart/alternative message can leak plaintext when included in a a HTML reply/forward. This vulnerability affects Thunderbird < 68.1 and Thunderbird < 60.9. (CVE-2019-11739) - Mozilla developers and community members reported memory safety bugs present in Firefox 68, Firefox ESR 68, and Firefox 60.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1. (CVE-2019-11740) - A same-origin policy violation occurs allowing the theft of cross-origin images through a combination of SVG filters and a

ID	Name	Product	Family	Severity
147315	NewStart CGSL MAIN 6.02 : expat Multiple Vulnerabilities (NS-SA-2021-0083)	Nessus	NewStart CGSL Local Security Checks	high
147312	NewStart CGSL MAIN 4.06 : thunderbird Multiple Vulnerabilities (NS-SA-2021-0002)	Nessus	NewStart CGSL Local Security Checks	critical
147278	NewStart CGSL CORE 5.04 / MAIN 5.04 : expat Multiple Vulnerabilities (NS-SA-2021-0026)	Nessus	NewStart CGSL Local Security Checks	high
146038	CentOS 8 : expat (CESA-2020:4484)	Nessus	CentOS Local Security Checks	high
145641	CentOS 8 : thunderbird (CESA-2019:3237)	Nessus	CentOS Local Security Checks	medium
145572	CentOS 8 : firefox (CESA-2019:3196)	Nessus	CentOS Local Security Checks	medium
144990	Amazon Linux AMI : expat (ALAS-2021-1459)	Nessus	Amazon Linux Local Security Checks	high
144463	Amazon Linux AMI : expat (ALAS-2020-1460) (deprecated)	Nessus	Amazon Linux Local Security Checks	high
143071	RHEL 8 : expat (RHSA-2020:4484)	Nessus	Red Hat Local Security Checks	high
142796	Oracle Linux 8 : expat (ELSA-2020-4484)	Nessus	Oracle Linux Local Security Checks	high
141963	Amazon Linux 2 : expat (ALAS-2020-1513)	Nessus	Amazon Linux Local Security Checks	high
141698	Scientific Linux Security Update : expat on SL7.x x86_64 (20201001)	Nessus	Scientific Linux Local Security Checks	high
141594	CentOS 7 : expat (CESA-2020:3952)	Nessus	CentOS Local Security Checks	high
141223	Oracle Linux 7 : expat (ELSA-2020-3952)	Nessus	Oracle Linux Local Security Checks	high
141017	RHEL 7 : expat (RHSA-2020:3952)	Nessus	Red Hat Local Security Checks	high
138081	Apple iCloud 7.x < 7.16 Multiple Vulnerabilities	Nessus	Windows	high
138078	Apple iCloud 10.x < 10.9 Multiple Vulnerabilities	Nessus	Windows	high
137716	Photon OS 2.0: Expat PHSA-2020-2.0-0254	Nessus	PhotonOS Local Security Checks	medium
137705	RHEL 6 / 7 : Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP3 (RHSA-2020:2644)	Nessus	Red Hat Local Security Checks	medium
137638	Photon OS 1.0: Expat PHSA-2020-1.0-0301	Nessus	PhotonOS Local Security Checks	medium
135896	Ubuntu 16.04 LTS : Thunderbird vulnerabilities (USN-4335-1)	Nessus	Ubuntu Local Security Checks	high
135607	EulerOS Virtualization 3.0.2.2 : expat (EulerOS-SA-2020-1445)	Nessus	Huawei Local Security Checks	high
134506	EulerOS Virtualization for ARM 64 3.0.2.0 : expat (EulerOS-SA-2020-1217)	Nessus	Huawei Local Security Checks	high
134410	NewStart CGSL MAIN 4.05 : thunderbird Multiple Vulnerabilities (NS-SA-2020-0022)	Nessus	NewStart CGSL Local Security Checks	critical
133448	SUSE SLES12 Security Update : python36 (SUSE-SU-2020:0302-1)	Nessus	SuSE Local Security Checks	high
133172	openSUSE Security Update : python3 (openSUSE-2020-86) (BEAST) (httpoxy)	Nessus	SuSE Local Security Checks	critical
133071	NewStart CGSL CORE 5.05 / MAIN 5.05 : thunderbird Multiple Vulnerabilities (NS-SA-2020-0003)	Nessus	NewStart CGSL Local Security Checks	medium
133036	SUSE SLED15 / SLES15 Security Update : python3 (SUSE-SU-2020:0114-1) (BEAST) (httpoxy)	Nessus	SuSE Local Security Checks	critical
132829	EulerOS Virtualization for ARM 64 3.0.5.0 : expat (EulerOS-SA-2020-1075)	Nessus	Huawei Local Security Checks	medium
132416	Apple iTunes < 12.10.3 Multiple Vulnerabilities (credentialed check)	Nessus	Windows	high
132415	Apple iTunes < 12.10.3 Multiple Vulnerabilities (uncredentialed check)	Nessus	Peer-To-Peer File Sharing	high
132264	Amazon Linux 2 : thunderbird (ALAS-2019-1376)	Nessus	Amazon Linux Local Security Checks	medium
132045	Apple TV < 13.3 Multiple Vulnerabilities	Nessus	Misc.	high
132024	Apple iOS < 13.3 Multiple Vulnerabilities	Nessus	Mobile Devices	high
132011	Ubuntu 18.04 LTS / 19.10 : Thunderbird regression (USN-4202-2)	Nessus	Ubuntu Local Security Checks	medium
131957	macOS 10.15.x < 10.15.2 / 10.14.x < 10.14.6 Security Update 2019-002 / 10.13.x < 10.13.6 Security Update 2019-007	Nessus	MacOS X Local Security Checks	high
131587	EulerOS 2.0 SP2 : expat (EulerOS-SA-2019-2433)	Nessus	Huawei Local Security Checks	high
131405	NewStart CGSL CORE 5.04 / MAIN 5.04 : thunderbird Multiple Vulnerabilities (NS-SA-2019-0215)	Nessus	NewStart CGSL Local Security Checks	medium
131268	GLSA-201911-08 : Expat: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
131139	Debian DSA-4571-1 : thunderbird - security update	Nessus	Debian Local Security Checks	medium
131136	Debian DLA-1997-1 : thunderbird security update	Nessus	Debian Local Security Checks	medium
130977	CentOS 6 : thunderbird (CESA-2019:3756)	Nessus	CentOS Local Security Checks	medium
130937	openSUSE Security Update : MozillaThunderbird (openSUSE-2019-2464)	Nessus	SuSE Local Security Checks	medium
130936	openSUSE Security Update : MozillaThunderbird (openSUSE-2019-2452)	Nessus	SuSE Local Security Checks	medium
130890	openSUSE Security Update : MozillaFirefox / MozillaFirefox-branding-SLE (openSUSE-2019-2459)	Nessus	SuSE Local Security Checks	medium
130885	openSUSE Security Update : MozillaFirefox / MozillaFirefox-branding-SLE (openSUSE-2019-2451)	Nessus	SuSE Local Security Checks	medium
130854	EulerOS 2.0 SP5 : expat (EulerOS-SA-2019-2145)	Nessus	Huawei Local Security Checks	high
130812	EulerOS 2.0 SP8 : expat (EulerOS-SA-2019-2103)	Nessus	Huawei Local Security Checks	medium
130772	Debian DLA-1987-1 : firefox-esr security update	Nessus	Debian Local Security Checks	medium
130750	Scientific Linux Security Update : thunderbird on SL6.x i386/x86_64 (20191106)	Nessus	Scientific Linux Local Security Checks	medium
130742	RHEL 6 : thunderbird (RHSA-2019:3756)	Nessus	Red Hat Local Security Checks	medium
130718	EulerOS 2.0 SP3 : expat (EulerOS-SA-2019-2256)	Nessus	Huawei Local Security Checks	high
130500	openSUSE Security Update : chromium / re2 (openSUSE-2019-2420)	Nessus	SuSE Local Security Checks	medium
130450	SUSE SLED12 / SLES12 Security Update : MozillaFirefox (SUSE-SU-2019:2872-1)	Nessus	SuSE Local Security Checks	critical
130449	SUSE SLED15 / SLES15 Security Update : MozillaFirefox, MozillaFirefox-branding-SLE (SUSE-SU-2019:2871-1)	Nessus	SuSE Local Security Checks	medium
130436	CentOS 7 : thunderbird (CESA-2019:3210)	Nessus	CentOS Local Security Checks	medium
130434	CentOS 7 : firefox (CESA-2019:3193)	Nessus	CentOS Local Security Checks	medium
130415	Oracle Linux 8 : thunderbird (ELSA-2019-3237)	Nessus	Oracle Linux Local Security Checks	medium
130414	Oracle Linux 7 : thunderbird (ELSA-2019-3210)	Nessus	Oracle Linux Local Security Checks	medium
130386	Scientific Linux Security Update : thunderbird on SL7.x x86_64 (20191029)	Nessus	Scientific Linux Local Security Checks	medium
130382	RHEL 8 : thunderbird (RHSA-2019:3237)	Nessus	Red Hat Local Security Checks	medium
130371	RHEL 7 : thunderbird (RHSA-2019:3210)	Nessus	Red Hat Local Security Checks	medium
130365	Mozilla Thunderbird < 68.2	Nessus	Windows	medium
130364	Mozilla Thunderbird < 68.2	Nessus	MacOS X Local Security Checks	medium
130288	Debian DSA-4549-1 : firefox-esr - security update	Nessus	Debian Local Security Checks	medium
130275	Google Chrome < 78.0.3904.70 Multiple Vulnerabilities	Nessus	Windows	medium
130274	Google Chrome < 78.0.3904.70 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	medium
130248	RHEL 8 : firefox (RHSA-2019:3196)	Nessus	Red Hat Local Security Checks	medium
130247	Oracle Linux 8 : firefox (ELSA-2019-3196)	Nessus	Oracle Linux Local Security Checks	medium
130200	Ubuntu 16.04 LTS / 18.04 LTS / 19.04 / 19.10 : Firefox vulnerabilities (USN-4165-1)	Nessus	Ubuntu Local Security Checks	medium
130190	RHEL 7 : firefox (RHSA-2019:3193)	Nessus	Red Hat Local Security Checks	medium
130184	Oracle Linux 7 : firefox (ELSA-2019-3193)	Nessus	Oracle Linux Local Security Checks	medium
130172	Mozilla Firefox ESR 68.x < 68.2 Multiple vulnerabilities	Nessus	Windows	medium
130171	Mozilla Firefox ESR 68.x < 68.2 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	medium
130170	Mozilla Firefox < 70.0 Multiple Vulnerabilities	Nessus	Windows	medium
130169	Mozilla Firefox < 70.0 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	medium
130158	Slackware 14.2 / current : mozilla-firefox (SSA:2019-295-01)	Nessus	Slackware Local Security Checks	medium
130079	Slackware 14.0 / 14.1 / 14.2 / current : python (SSA:2019-293-01)	Nessus	Slackware Local Security Checks	medium
130077	FreeBSD : python 3.7 -- multiple vulnerabilities (9b7491fb-f253-11e9-a50c-000c29c4dc65)	Nessus	FreeBSD Local Security Checks	medium
129620	Fedora 31 : expat (2019-613edfe68b)	Nessus	Fedora Local Security Checks	medium
129511	Fedora 29 : expat (2019-672ae0f060)	Nessus	Fedora Local Security Checks	medium
129457	openSUSE Security Update : expat (openSUSE-2019-2205)	Nessus	SuSE Local Security Checks	medium
129456	openSUSE Security Update : expat (openSUSE-2019-2204)	Nessus	SuSE Local Security Checks	medium
129322	Fedora 30 : expat (2019-9505c6b555)	Nessus	Fedora Local Security Checks	medium
129288	SUSE SLED12 / SLES12 Security Update : expat (SUSE-SU-2019:2440-1)	Nessus	SuSE Local Security Checks	medium
129283	SUSE SLED15 / SLES15 Security Update : expat (SUSE-SU-2019:2429-1)	Nessus	SuSE Local Security Checks	medium
129108	Debian DSA-4530-1 : expat - security update	Nessus	Debian Local Security Checks	medium
128963	Slackware 14.0 / 14.1 / 14.2 / current : expat (SSA:2019-259-01)	Nessus	Slackware Local Security Checks	medium
128874	Ubuntu 16.04 LTS / 18.04 LTS / 19.04 : Expat vulnerability (USN-4132-1)	Nessus	Ubuntu Local Security Checks	medium

CVE-2019-15903

MEDIUM

Description

References

Details

Risk Information

CVSS v2.0

CVSS v3.0

Vulnerable Software

Configuration 1

Tenable Plugins

high

critical

high

high

medium

medium

high

high

high

high

high

high

high

high

high

high

high

medium

medium

medium

high

high

high

critical

high

critical

medium

critical

medium

high

high

medium

high

high

medium

high

high

medium

high

medium

medium

medium

medium

medium

medium

medium

high

medium

medium

medium

medium

high

medium

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium