The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-33a1b73e48 advisory.

  - Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the     NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to     cause the underlying server to make arbitrary GET requests. (CVE-2020-11987)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-601ee898f7 advisory.

  - Upgrade to upstream security release 3.7.3  (FEDORA-2021-601ee898f7)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 32 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-88b8fd4bf1 advisory.

  - Some more bug-fixes for the stable 0.4.x branch. --     https://lib.openmpt.org/libopenmpt/2021/03/20/security-update-0.5.7-releases-0.4.19-0.3.28/     (FEDORA-2021-88b8fd4bf1)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 32 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-2e174e8a96 advisory.

  - Upgrade to upstream security release 3.7.3  (FEDORA-2021-2e174e8a96)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-38bacf2af2 advisory.

  - Some more bug-fixes for the stable 0.4.x branch. --     https://lib.openmpt.org/libopenmpt/2021/03/20/security-update-0.5.7-releases-0.4.19-0.3.28/     (FEDORA-2021-38bacf2af2)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 32 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-57661d377a advisory.

  - This update disallows use of IP addresses with leading zeroes in the octet values, which could have been     interpreted ambiguously as either octal or decimal values. (FEDORA-2021-57661d377a)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 32 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-8953a0780d advisory.

  - The 5.11.12 stable kernel update contains a number of important fixes across the tree.
    (FEDORA-2021-8953a0780d)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-67cbea4608 advisory.

  - Format string vulnerability in panoFileOutputNamesCreate() in libpano13 2.9.20~rc2+dfsg-3 and earlier can     lead to read and write arbitrary memory values. (CVE-2021-20307)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-e71c033f88 advisory.

  - BPF JIT compilers in the Linux kernel through 5.11.12 have incorrect computation of branch displacements,     allowing them to execute arbitrary code within the kernel context. This affects     arch/x86/net/bpf_jit_comp.c and arch/x86/net/bpf_jit_comp32.c. (CVE-2021-29154)

  - An issue was discovered in the Linux kernel through 5.11.11. synic_get in arch/x86/kvm/hyperv.c has a NULL     pointer dereference for certain accesses to the SynIC Hyper-V context, aka CID-919f4ebc5987.
    (CVE-2021-30178)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-2c714d311f advisory.

  - GNU Chess 6.2.7 allows attackers to execute arbitrary code via crafted PGN (Portable Game Notation) data.
    This is related to a buffer overflow in the use of a .tmp.epd temporary file in the cmd_pgnload and     cmd_pgnreplay functions in frontend/cmd.cc. (CVE-2021-30184)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-a311bf10d4 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-2ab6f060d9 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-bedb7cc66e advisory.

  - 0.103.2 (#1947267) https://blog.clamav.net/2021/04/clamav-01032-security-patch-release.html     (FEDORA-2021-bedb7cc66e)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 32 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-4b0a8b8629 advisory.

  - Appled all the changes from the upstream 2.53.7.1 update. Fixed tab opening in background and tab choosing     on a tab close.  ----  Fix updating and support of legacy javascript extensions.  ----  Update to 2.53.7     Enable support for module scripts. (To turn it off, toggle dom.moduleScripts.enabled in about:config).
    For sending mail, now Thunderbird is advertised in User-Agent header instead of Firefox (if any).
    Some performance fixes, including from upcoming releases. (FEDORA-2021-4b0a8b8629)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 32 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-a58cb9bc7a advisory.

  - GNU Chess 6.2.7 allows attackers to execute arbitrary code via crafted PGN (Portable Game Notation) data.
    This is related to a buffer overflow in the use of a .tmp.epd temporary file in the cmd_pgnload and     cmd_pgnreplay functions in frontend/cmd.cc. (CVE-2021-30184)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-139f3fc21c advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 32 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2021-21360476b6 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-d20c8a4730 advisory.

  - decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer,     with a resultant invalid free or segmentation fault, via malformed gzip data. (CVE-2021-28831)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-8b17a2725e advisory.

  - A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects     Apache PDFBox version 2.0.22 and prior 2.0.x versions. (CVE-2021-27807)

  - A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue     affects Apache PDFBox version 2.0.22 and prior 2.0.x versions. (CVE-2021-27906)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-4c57a892d1 advisory.

  - Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus     arbitrary classes can be instantiated. (CVE-2021-28834)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-dc83ae690a advisory.

  - A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects     Apache PDFBox version 2.0.22 and prior 2.0.x versions. (CVE-2021-27807)

  - A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue     affects Apache PDFBox version 2.0.22 and prior 2.0.x versions. (CVE-2021-27906)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 32 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-edc673e864 advisory.

  - Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus     arbitrary classes can be instantiated. (CVE-2021-28834)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-d049f32a82 advisory.

  - Upgrade to version 1.1.1.k (FEDORA-2021-d049f32a82)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-8d52a8a999 advisory.

  - A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an     attacker who can convince a victim to install a seemingly verifiable package, whose signature header was     modified, to cause RPM database corruption and execute code. The highest threat from this vulnerability is     to data integrity, confidentiality, and system availability. (CVE-2021-20271)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-473e880567 advisory.

  - An out-of-bounds read vulnerability exists in the AMF File AMFParserContext::endElement() functionality of     Slic3r libslic3r 1.3.0 and Master Commit 92abbc42. A specially crafted AMF file can lead to information     disclosure. An attacker can provide a malicious file to trigger this vulnerability. (CVE-2020-28591)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-e0f30b4500 advisory.

  - An out of bounds read in function QRadialFetchSimd from crafted svg file may lead to information     disclosure or other potential consequences. This update includes the backported upstream fix and should     resolve the security issue.  (FEDORA-2021-e0f30b4500)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 32 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-9fac28274f advisory.

  - New upstream version (87.0) Release notes are available here - https://www.mozilla.org/en-     US/firefox/87.0/releasenotes/ (FEDORA-2021-9fac28274f)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-9503fffad9 advisory.

  - An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c performs undesirable out-     of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre     mitigations and obtain sensitive information from kernel memory, aka CID-f232326f6966. This affects     pointer types that do not define a ptr_limit. (CVE-2020-27170)

  - An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c has an off-by-one error     (with a resultant integer underflow) affecting out-of-bounds speculation on pointer arithmetic, leading to     side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory,     aka CID-10d2bb2e6b1d. (CVE-2020-27171)

  - An issue was discovered in fs/io_uring.c in the Linux kernel through 5.11.8. It allows attackers to cause     a denial of service (deadlock) because exit may be waiting to park a SQPOLL thread, but concurrently that     SQPOLL thread is waiting for a signal to start, aka CID-3ebba796fa25. (CVE-2021-28951)

  - An issue was discovered in the Linux kernel through 5.11.8. The sound/soc/qcom/sdm845.c soundwire device     driver has a buffer overflow when an unexpected port ID number is encountered, aka CID-1c668e1c0a0f. (This     has been fixed in 5.12-rc4.) (CVE-2021-28952)

  - A race condition was discovered in get_old_root in fs/btrfs/ctree.c in the Linux kernel through 5.11.8. It     allows attackers to cause a denial of service (BUG) because of a lack of locking on an extent buffer     before a cloning operation, aka CID-dbcc7d57bffc. (CVE-2021-28964)

  - In intel_pmu_drain_pebs_nhm in arch/x86/events/intel/ds.c in the Linux kernel through 5.11.8 on some     Haswell CPUs, userspace applications (such as perf-fuzzer) can cause a system crash because the PEBS     status in a PEBS record is mishandled, aka CID-d88d05a9e0b6. (CVE-2021-28971)

  - In drivers/pci/hotplug/rpadlpar_sysfs.c in the Linux kernel through 5.11.8, the RPA PCI Hotplug driver has     a user-tolerable buffer overflow when writing a new device name to the driver from userspace, allowing     userspace to write data to the kernel stack frame directly. This occurs because add_slot_store and     remove_slot_store mishandle drc_name '\0' termination, aka CID-cc7a0bb058b8. (CVE-2021-28972)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-1d72d8cea2 advisory.

  - An out-of-bounds read vulnerability exists in the AMF File AMFParserContext::endElement() functionality of     Slic3r libslic3r 1.3.0 and Master Commit 92abbc42. A specially crafted AMF file can lead to information     disclosure. An attacker can provide a malicious file to trigger this vulnerability. (CVE-2020-28591)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-0b784a4d02 advisory.

  - HVM soft-reset crashes toolstack (XSA-368) (CVE-2021-28687)

  - HVM soft-reset crashes toolstack (XSA-368) [fedora-all] (CVE-2021-28687)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-a468f36bbe advisory.

  - HVM soft-reset crashes toolstack (XSA-368) (CVE-2021-28687)

  - HVM soft-reset crashes toolstack (XSA-368) [fedora-all] (CVE-2021-28687)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 32 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-265a3c7cb9 advisory.

  - .NET Core Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-24112. (CVE-2021-26701)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-3da33cdc80 advisory.

  - .NET Core Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-24112. (CVE-2021-26701)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 32 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-7cd0c1fb70 advisory.

  - update to latest upstream release  (with security fixes!) (FEDORA-2021-7cd0c1fb70)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 32 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-138728e59b advisory.

  - .NET Core Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-24112. (CVE-2021-26701)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-6945629745 advisory.

  - A use-after-free vulnerability exists in the NMR::COpcPackageReader::releaseZIP() functionality of 3MF     Consortium lib3mf 2.0.0. A specially crafted 3MF file can lead to code execution. An attacker can provide     a malicious file to trigger this vulnerability. (CVE-2021-21772)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-b73f9c96ee advisory.

  - A use-after-free vulnerability exists in the NMR::COpcPackageReader::releaseZIP() functionality of 3MF     Consortium lib3mf 2.0.0. A specially crafted 3MF file can lead to code execution. An attacker can provide     a malicious file to trigger this vulnerability. (CVE-2021-21772)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-9de542ab4c advisory.

  - A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1.
    An oob read vulnerability exists in Nef_2/PM_io_parser.h PM_io_parser::read_vertex() Face_of[] OOB read.
    An attacker can provide malicious input to trigger this vulnerability. (CVE-2020-28601)

  - A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1.
    An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser::read_sloop() slh->twin() An     attacker can provide malicious input to trigger this vulnerability. (CVE-2020-28636)

  - A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1.
    An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser::read_sloop()     slh->incident_sface. An attacker can provide malicious input to trigger this vulnerability.
    (CVE-2020-35628)

  - A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1.
    An oob read vulnerability exists in Nef_S2/SNC_io_parser.h SNC_io_parser::read_sface() sfh->volume(). An     attacker can provide malicious input to trigger this vulnerability. (CVE-2020-35636)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 32 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-26cb56b3cb advisory.

  - A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.27 handled component     references in the JP2 image format decoder. A specially crafted JP2 image file could cause an application     using the Jasper library to crash when opened. (CVE-2021-3443)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-68b0dd2373 advisory.

  - An issue was discovered in fs/io_uring.c in the Linux kernel through 5.11.8. It allows attackers to cause     a denial of service (deadlock) because exit may be waiting to park a SQPOLL thread, but concurrently that     SQPOLL thread is waiting for a signal to start, aka CID-3ebba796fa25. (CVE-2021-28951)

  - An issue was discovered in the Linux kernel through 5.11.8. The sound/soc/qcom/sdm845.c soundwire device     driver has a buffer overflow when an unexpected port ID number is encountered, aka CID-1c668e1c0a0f. (This     has been fixed in 5.12-rc4.) (CVE-2021-28952)

  - A race condition was discovered in get_old_root in fs/btrfs/ctree.c in the Linux kernel through 5.11.8. It     allows attackers to cause a denial of service (BUG) because of a lack of locking on an extent buffer     before a cloning operation, aka CID-dbcc7d57bffc. (CVE-2021-28964)

  - In intel_pmu_drain_pebs_nhm in arch/x86/events/intel/ds.c in the Linux kernel through 5.11.8 on some     Haswell CPUs, userspace applications (such as perf-fuzzer) can cause a system crash because the PEBS     status in a PEBS record is mishandled, aka CID-d88d05a9e0b6. (CVE-2021-28971)

  - In drivers/pci/hotplug/rpadlpar_sysfs.c in the Linux kernel through 5.11.8, the RPA PCI Hotplug driver has     a user-tolerable buffer overflow when writing a new device name to the driver from userspace, allowing     userspace to write data to the kernel stack frame directly. This occurs because add_slot_store and     remove_slot_store mishandle drc_name '\0' termination, aka CID-cc7a0bb058b8. (CVE-2021-28972)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-c504fa63be advisory.

  - New upstream version (87.0) Release notes are available here - https://www.mozilla.org/en-     US/firefox/87.0/releasenotes/ (FEDORA-2021-c504fa63be)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-e68317166d advisory.

  - Tor before 0.4.5.7 allows a remote participant in the Tor directory protocol to exhaust CPU resources on a     target, aka TROVE-2021-001. (CVE-2021-28089)

  - Tor before 0.4.5.7 allows a remote attacker to cause Tor directory authorities to exit with an assertion     failure, aka TROVE-2021-002. (CVE-2021-28090)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-51b2657092 advisory.

  - A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.27 handled component     references in the JP2 image format decoder. A specially crafted JP2 image file could cause an application     using the Jasper library to crash when opened. (CVE-2021-3443)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-e49da8a226 advisory.

  - An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c performs undesirable out-     of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre     mitigations and obtain sensitive information from kernel memory, aka CID-f232326f6966. This affects     pointer types that do not define a ptr_limit. (CVE-2020-27170)

  - An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c has an off-by-one error     (with a resultant integer underflow) affecting out-of-bounds speculation on pointer arithmetic, leading to     side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory,     aka CID-10d2bb2e6b1d. (CVE-2020-27171)

  - An issue was discovered in fs/fuse/fuse_i.h in the Linux kernel before 5.11.8. A stall on CPU can occur     because a retry loop continually finds the same bad inode, aka CID-775c5033a0d1. (CVE-2021-28950)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-50f63a0161 advisory.

  - The ID number user profile field required additional sanitizing to prevent a stored XSS risk in moodle     before 3.10.2, 3.9.5, 3.8.8, 3.5.17. (CVE-2021-20279)

  - Text-based feedback answers required additional sanitizing to prevent stored XSS and blind SSRF risks in     moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17. (CVE-2021-20280)

  - It was possible for some users without permission to view other users' full names to do so via the online     users block in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17. (CVE-2021-20281)

  - When creating a user account, it was possible to verify the account without having access to the     verification email link/secret in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17. (CVE-2021-20282)

  - The web service responsible for fetching other users' enrolled courses did not validate that the     requesting user had permission to view that information in each course in moodle before 3.10.2, 3.9.5,     3.8.8, 3.5.17. (CVE-2021-20283)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-431b232659 advisory.

  - The ID number user profile field required additional sanitizing to prevent a stored XSS risk in moodle     before 3.10.2, 3.9.5, 3.8.8, 3.5.17. (CVE-2021-20279)

  - Text-based feedback answers required additional sanitizing to prevent stored XSS and blind SSRF risks in     moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17. (CVE-2021-20280)

  - It was possible for some users without permission to view other users' full names to do so via the online     users block in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17. (CVE-2021-20281)

  - When creating a user account, it was possible to verify the account without having access to the     verification email link/secret in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17. (CVE-2021-20282)

  - The web service responsible for fetching other users' enrolled courses did not validate that the     requesting user had permission to view that information in each course in moodle before 3.10.2, 3.9.5,     3.8.8, 3.5.17. (CVE-2021-20283)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-1b22f31541 advisory.

  - .NET Core Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-24112. (CVE-2021-26701)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-4b43992608 advisory.

  - A flaw was found in upx canPack in p_lx_elf.cpp in UPX 3.96. This flaw allows attackers to cause a denial     of service (SEGV or buffer overflow and application crash) or possibly have unspecified other impacts via     a crafted ELF. The highest threat from this vulnerability is to system availability. (CVE-2021-20285)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-acd448b558 advisory.

  -  With the upgrade of python-cryptography in f33+, the PKCS7_get0_clients api was dropped.  It has been     replaced by a cleaner and easier api, which roca-detect now uses.  The consequence was that PKCS7 keys     would be silently ignored.  To test, run   $ roca-detect /usr/lib/python3.*/site-     packages/roca/tests/data/pkcs701.p7s  It should see 1 PKCS7 key.   (FEDORA-2021-acd448b558)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 32 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-dff7e97510 advisory.

  - A flaw was found in upx canPack in p_lx_elf.cpp in UPX 3.96. This flaw allows attackers to cause a denial     of service (SEGV or buffer overflow and application crash) or possibly have unspecified other impacts via     a crafted ELF. The highest threat from this vulnerability is to system availability. (CVE-2021-20285)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Severity
148731	Fedora 33 : batik (2021-33a1b73e48)	high
148730	Fedora 33 : singularity (2021-601ee898f7)	high
148729	Fedora 32 : libopenmpt (2021-88b8fd4bf1)	high
148728	Fedora 32 : singularity (2021-2e174e8a96)	high
148727	Fedora 33 : libopenmpt (2021-38bacf2af2)	high
148726	Fedora 32 : perl-Net-CIDR-Lite (2021-57661d377a)	high
148725	Fedora 32 : kernel (2021-8953a0780d)	high
148724	Fedora 33 : libpano13 (2021-67cbea4608)	critical
148723	Fedora 33 : kernel (2021-e71c033f88)	high
148722	Fedora 33 : gnuchess (2021-2c714d311f)	high
148721	Fedora 32 : python39 (2021-a311bf10d4)	medium
148720	Fedora 33 : python3.8 (2021-2ab6f060d9)	medium
148719	Fedora 33 : clamav (2021-bedb7cc66e)	high
148718	Fedora 32 : seamonkey (2021-4b0a8b8629)	high
148717	Fedora 32 : gnuchess (2021-a58cb9bc7a)	high
148716	Fedora 33 : xorg-x11-server (2021-139f3fc21c)	high
148715	Fedora 32 : kernel / kernel-headers / kernel-tools (2021-21360476b6)	high
148253	Fedora 33 : 1:busybox (2021-d20c8a4730)	high
148238	Fedora 33 : pdfbox (2021-8b17a2725e)	medium
148232	Fedora 33 : rubygem-kramdown (2021-4c57a892d1)	critical
148231	Fedora 32 : pdfbox (2021-dc83ae690a)	medium
148230	Fedora 32 : rubygem-kramdown (2021-edc673e864)	critical
148229	Fedora 33 : 1:openssl (2021-d049f32a82)	high
148228	Fedora 33 : rpm (2021-8d52a8a999)	high
148214	Fedora 33 : slic3r (2021-473e880567)	medium
148213	Fedora 33 : 1:qt (2021-e0f30b4500)	high
148208	Fedora 32 : firefox (2021-9fac28274f)	high
148205	Fedora 32 : kernel (2021-9503fffad9)	high
148204	Fedora 32 : slic3r (2021-1d72d8cea2)	medium
148202	Fedora 33 : xen (2021-0b784a4d02)	medium
148199	Fedora 32 : xen (2021-a468f36bbe)	medium
148198	Fedora 32 : dotnet3.1 (2021-265a3c7cb9)	critical
148197	Fedora 33 : dotnet3.1 (2021-3da33cdc80)	critical
148178	Fedora 32 : tor (2021-7cd0c1fb70)	high
148174	Fedora 32 : dotnet5.0 (2021-138728e59b)	critical
148163	Fedora 32 : lib3mf (2021-6945629745)	high
148161	Fedora 33 : lib3mf (2021-b73f9c96ee)	high
148158	Fedora 33 : CGAL (2021-9de542ab4c)	critical
148157	Fedora 32 : jasper (2021-26cb56b3cb)	medium
148156	Fedora 33 : kernel (2021-68b0dd2373)	high
148154	Fedora 33 : firefox (2021-c504fa63be)	high
148087	Fedora 33 : tor (2021-e68317166d)	high
148085	Fedora 33 : jasper (2021-51b2657092)	medium
148051	Fedora 33 : kernel (2021-e49da8a226)	medium
147959	Fedora 32 : moodle (2021-50f63a0161)	medium
147958	Fedora 33 : moodle (2021-431b232659)	medium
147957	Fedora 33 : dotnet5.0 (2021-1b22f31541)	critical
147945	Fedora 33 : upx (2021-4b43992608)	medium
147943	Fedora 33 : roca-detect (2021-acd448b558)	high
147942	Fedora 32 : upx (2021-dff7e97510)	medium

Detections

Analytics

Fedora Local Security Checks Family for Nessus

high

high

high

high

high

high

high

critical

high

high

medium

medium

high

high

high

high

high

high

medium

critical

medium

critical

high

high

medium

high

high

high

medium

medium

medium

critical

critical

high

critical

high

high

critical

medium

high

high

high

medium

medium

medium

medium

critical

medium

high

medium