The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 68.10.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-26 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 3.2.5. It is, therefore, affected by a vulnerability as referenced in the wireshark-3.2.5 advisory.

  - The GVCP dissector could go into an infinite loop. It     may be possible to make Wireshark consume excessive CPU     resources by injecting a malformed packet onto the wire     or by convincing someone to read a malformed packet     trace file. (CVE-2020-15466)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 78.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-24 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 68.10. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-25 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Adobe Premiere Pro is installed on the remote Mac OS X host.

The version of VMware Tools installed on the remote MacOS/MacOSX host is prior to 11.1.1. It is, therefore, affected by a denial-of-service vulnerability in the Host-Guest File System (HGFS) implementation. Successful exploitation of this issue may allow attackers with non-admin privileges on guest macOS virtual machines to create a denial-of-service condition on their own VMs.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote macOS host is prior to 83.0.4103.116. It is, therefore, affected by a vulnerability as referenced in the 2020_06_stable-channel-update-for-desktop_22 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Adobe Premiere Rush is installed on the remote Mac OS X host.

Cisco Webex Meetings Desktop App is installed on the remote Mac OS X host.

The version of Google Chrome installed on the remote macOS host is prior to 83.0.4103.106. It is, therefore, affected by multiple vulnerabilities as referenced in the 2020_06_stable-channel-update-for-desktop_15 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Adobe Flash Player installed on the remote macOS or Mac OS X host is equal or prior to version 32.0.0.371. It is therefore affected by an use after free vulnerability. An unauthenticated, remote attacker can exploit this, via a specially crafted file, to execute arbitrary code within the context of the user.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 68.9.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-22 advisory.

  - NSS has shown timing differences when performing DSA     signatures, which was exploitable and could eventually     leak private keys. (CVE-2020-12399)

  - When browsing a malicious page, a race condition in our     SharedWorkerService could occur and lead to a     potentially exploitable crash. (CVE-2020-12405)

  - Mozilla developer Iain Ireland discovered a missing type     check during unboxed objects removal, resulting in a     crash. We presume that with enough effort that it could     be exploited to run arbitrary code. (CVE-2020-12406)

  - Mozilla developers Tom Tung and Karl Tomlinson reported     memory safety bugs present in Firefox 68.8. Some of     these bugs showed evidence of memory corruption and we     presume that with enough effort some of these could have     been exploited to run arbitrary code. (CVE-2020-12410)

  - If Thunderbird is configured to use STARTTLS for an IMAP     server, and the server sends a PREAUTH response, then     Thunderbird will continue with an unencrypted     connection, causing email data to be sent without     protection. (CVE-2020-12398)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote macOS host is prior to 83.0.4103.97. It is, therefore, affected by multiple vulnerabilities as referenced in the 2020_06_stable-channel-update-for-desktop advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of VMware Fusion installed on the remote macOS or Mac OS X host is 11.x prior to 11.5.5. It is, therefore, affected by multiple vulnerabilities.  Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is running a version of macOS / Mac OS X that is 10.15.x prior to 10.15.5 Supplemental Update, 10.13.x prior to 10.13.6 Security Update 2020-003. It is, therefore, affected by a remote code execution vulnerability :

  - An application may be able to execute arbitrary code     with kernel privileges (CVE-2020-9859)

Note that Nessus has not tested for this issue but has instead relied only on the operating system's self-reported version number.

Adobe XD is installed on the remote Mac OS X host.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 68.9. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-21 advisory.

  - NSS has shown timing differences when performing DSA     signatures, which was exploitable and could eventually     leak private keys. (CVE-2020-12399)

  - Mozilla developers Tom Tung and Karl Tomlinson reported     memory safety bugs present in Firefox 76 and Firefox ESR     68.8. Some of these bugs showed evidence of memory     corruption and we presume that with enough effort some     of these could have been exploited to run arbitrary     code. (CVE-2020-12405)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 77.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-20 advisory.

  - NSS has shown timing differences when performing DSA     signatures, which was exploitable and could eventually     leak private keys. (CVE-2020-12399)

  - When browsing a malicious page, a race condition in our     SharedWorkerService could occur and lead to a     potentially exploitable crash. (CVE-2020-12405)

  - Mozilla Developer Iain Ireland discovered a missing type     check during unboxed objects removal, resulting in a     crash. We presume that with enough effort that it could     be exploited to run arbitrary code. (CVE-2020-12406)

  - Mozilla Developer Nicolas Silva found that when using     WebRender, Firefox would under certain conditions leak     arbitrary GPU memory to the visible screen. The leaked     memory content was visible to the user, but not     observable from web content. (CVE-2020-12407)

  - When browsing a document hosted on an IP address, an     attacker could insert certain characters to flip domain     and path information in the address bar.
    (CVE-2020-12408)

  - Mozilla developers Tom Tung and Karl Tomlinson reported     memory safety bugs present in Firefox 76 and Firefox ESR     68.8. Some of these bugs showed evidence of memory     corruption and we presume that with enough effort some     of these could have been exploited to run arbitrary     code. (CVE-2020-12409)

  - Mozilla developers :Gijs (he/him), Randell Jesup     reported memory safety bugs present in Firefox 76. Some     of these bugs showed evidence of memory corruption and     we presume that with enough effort some of these could     have been exploited to run arbitrary code.
    (CVE-2020-12411)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is running a version of macOS / Mac OS X that is 10.15.x prior to 10.15.5, 10.13.x prior to 10.13.6 Security Update 2020-003, 10.14.x prior to 10.14.6 Security Update 2020-003. It is, therefore, affected by multiple vulnerabilities:

  - In ksh version 20120801, a flaw was found in the way it     evaluates certain environment variables. An attacker     could use this flaw to override or bypass environment     restrictions to execute shell commands. Services and     applications that allow remote unauthenticated attackers     to provide one of those environment variables could     allow them to exploit this issue remotely.
    (CVE-2019-14868)

  - In Zsh before 5.8, attackers able to execute commands     can regain privileges dropped by the --no-PRIVILEGED     option. Zsh fails to overwrite the saved uid, so the     original privileges can be restored by executing     MODULE_PATH=/dir/with/module zmodload with a module that     calls setuid(). (CVE-2019-20044)

  - An out-of-bounds read was addressed with improved input     validation. This issue is fixed in iOS 13.3.1 and iPadOS     13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS     6.1.2. Processing a maliciously crafted image may lead     to arbitrary code execution. (CVE-2020-3878)

Note that Nessus has not tested for this issue but has instead relied only on the operating system's self-reported version number.

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 3.0.11. It is, therefore, affected by a DoS vulnerability as referenced in the wireshark-3.0.11 advisory.

  - It may be possible to make Wireshark crash by     injecting a malformed packet onto the wire or by     convincing someone to read a malformed packet trace     file. (wireshark-bug-16476)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 3.2.4. It is, therefore, affected by a DoS vulnerability as referenced in the wireshark-3.2.4 advisory.

  - It may be possible to make Wireshark crash by     injecting a malformed packet onto the wire or by     convincing someone to read a malformed packet trace     file. (wireshark-bug-16476)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 2.6.17. It is, therefore, affected by a DoS vulnerability as referenced in the wireshark-2.6.17 advisory.

  - It may be possible to make Wireshark crash by     injecting a malformed packet onto the wire or by     convincing someone to read a malformed packet trace     file. (wireshark-bug-16476)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote macOS host is prior to 83.0.4103.61. It is, therefore, affected by multiple vulnerabilities as referenced in the 2020_05_stable-channel-update-for-desktop_19 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Adobe Reader installed on the remote macOS host is a version prior or equal to 2015.006.30518, 2017.011.30166, or 2020.006.20042. It is, therefore, affected by multiple vulnerabilities.

  - Null Pointer potentially leading to Application denial-     of-service (CVE-2020-9610)

  - Heap Overflow potentially leading to Arbitrary Code     Execution (CVE-2020-9612)

  - Race Condition potentially leading to Security feature     bypass (CVE-2020-9615)

  - Out-of-bounds write potentially leading to Arbitrary     Code Execution (CVE-2020-9594, CVE-2020-9597)

  - Security bypass potentially leading to Security feature     bypass (CVE-2020-9592, CVE-2020-9596, CVE-2020-9613,     CVE-2020-9614)

  - Stack exhaustion potentially leading to Application     denial-of-service (CVE-2020-9611)

  - Out-of-bounds read potentially leading to Information     disclosure (CVE-2020-9599, CVE-2020-9600, CVE-2020-9601,     CVE-2020-9602, CVE-2020-9603, CVE-2020-9608,     CVE-2020-9609)

  - Buffer error potentially leading to Arbitrary Code     Execution (CVE-2020-9604, CVE-2020-9605)

  - Use-after-free potentially leading to Arbitrary Code     Execution (CVE-2020-9606, CVE-2020-9607)

  - Invalid memory access potentially leading to Information     disclosure (CVE-2020-9593, CVE-2020-9595, CVE-2020-9598)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Adobe Acrobat installed on the remote macOS host is a version prior or equal to 2015.006.30518, 2017.011.30166, or 2020.006.20042. It is, therefore, affected by multiple vulnerabilities.

  - Null Pointer potentially leading to Application denial-     of-service (CVE-2020-9610)

  - Heap Overflow potentially leading to Arbitrary Code     Execution (CVE-2020-9612)

  - Race Condition potentially leading to Security feature     bypass (CVE-2020-9615)

  - Out-of-bounds write potentially leading to Arbitrary     Code Execution (CVE-2020-9594, CVE-2020-9597)

  - Security bypass potentially leading to Security feature     bypass (CVE-2020-9592, CVE-2020-9596, CVE-2020-9613,     CVE-2020-9614)

  - Stack exhaustion potentially leading to Application     denial-of-service (CVE-2020-9611)

  - Out-of-bounds read potentially leading to Information     disclosure (CVE-2020-9599, CVE-2020-9600, CVE-2020-9601,     CVE-2020-9602, CVE-2020-9603, CVE-2020-9608,     CVE-2020-9609)

  - Buffer error potentially leading to Arbitrary Code     Execution (CVE-2020-9604, CVE-2020-9605)

  - Use-after-free potentially leading to Arbitrary Code     Execution (CVE-2020-9606, CVE-2020-9607)

  - Invalid memory access potentially leading to Information     disclosure (CVE-2020-9593, CVE-2020-9595, CVE-2020-9598)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Microsoft Office application installed on the remote macOS or Mac OS X host is missing a security update. It is, therefore, affected by the following vulnerability:

  - A remote code execution vulnerability exists in     Microsoft Excel software when the software fails to     properly handle objects in memory. An attacker who     successfully exploited the vulnerability could run     arbitrary code in the context of the current user. If     the current user is logged on with administrative user     rights, an attacker could take control of the affected     system. An attacker could then install programs; view,     change, or delete data; or create new accounts with full     user rights.  (CVE-2020-0901)

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 76.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-16 advisory.

  - A race condition when running shutdown code for Web     Worker led to a use-after-free vulnerability. This     resulted in a potentially exploitable crash.
    (CVE-2020-12387)

  - The Firefox content processes did not sufficiently     lockdown access control which could result in a sandbox     escape.Note: this issue only affects Firefox on     Windows operating systems. (CVE-2020-12388,     CVE-2020-12389)

  - A buffer overflow could occur when parsing and     validating SCTP chunks in WebRTC. This could have led to     memory corruption and a potentially exploitable crash.
    (CVE-2020-6831)

  - Incorrect origin serialization of URLs with IPv6     addresses could lead to incorrect security checks     (CVE-2020-12390)

  - Documents formed using data: URLs in an     object element failed to inherit the CSP of     the creating context. This allowed the execution of     scripts that should have been blocked, albeit with a     unique opaque origin. (CVE-2020-12391)

  - The 'Copy as cURL' feature of Devtools' network tab did     not properly escape the HTTP POST data of a request,     which can be controlled by the website. If a user used     the 'Copy as cURL' feature and pasted the command into a     terminal, it could have resulted in the disclosure of     local files. (CVE-2020-12392)

  - The 'Copy as cURL' feature of Devtools' network tab did     not properly escape the HTTP method of a request, which     can be controlled by the website. If a user used the     'Copy as cURL' feature and pasted the command into a     terminal, it could have resulted in command injection     and arbitrary command execution.Note: this issue     only affects Firefox on Windows operating systems.
    (CVE-2020-12393)

  - A logic flaw in our location bar implementation could     have allowed a local attacker to spoof the current     location by selecting a different origin and removing     focus from the input element. (CVE-2020-12394)

  - Mozilla developers and community members Alexandru     Michis, Jason Kratzer, philipp, Ted Campbell, Bas     Schouten, Andr Bargull, and Karl Tomlinson reported     memory safety bugs present in Firefox 75 and Firefox ESR     68.7. Some of these bugs showed evidence of memory     corruption and we presume that with enough effort some     of these could have been exploited to run arbitrary     code. (CVE-2020-12395)

  - Mozilla developers and community members Frederik Braun,     Andrew McCreight, C.M.Chang, and Dan Minor reported     memory safety bugs present in Firefox 75. Some of these     bugs showed evidence of memory corruption and we presume     that with enough effort some of these could have been     exploited to run arbitrary code. (CVE-2020-12396)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 68.8.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-18 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 68.8. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-17 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote macOS host is prior to 81.0.4044.138. It is, therefore, affected by multiple vulnerabilities as referenced in the 2020_05_stable-channel-update-for-desktop advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote macOS host is prior to 81.0.4044.129. It is, therefore, affected by multiple vulnerabilities as referenced in the 2020_04_stable-channel-update-for-desktop_27 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote macOS host is prior to 81.0.4044.122. It is, therefore, affected by multiple vulnerabilities as referenced in the 2020_04_stable-channel-update-for-desktop_21 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Palo Alto GlobalProtect Agent installed on the remote macOS or Mac OS X host is 5.0.x prior to 5.0.9, or 5.1.x prior to 5.1.1. It is, therefore, affected by an information disclosure vulnerability due to extra information provided when the troubleshooting log level is set to 'Dump'. An authenticated, local attacker can exploit this to disclose potentially sensitive information, including VPN cookie information.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Foxit Reader is installed on the remote Mac OS X host.

Foxit PhantomPDF is installed on the remote Mac OS X host.

The version of Wireshark installed on the remote macOS / Mac OS X host is 2.6.x prior to 2.6.16, 3.0.x prior to 3.0.10, or 3.2.x prior to 3.2.3.
It is, therefore, affected by a vulnerability in the BACapp dissector where injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file can crash Wireshark.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An integer overflow condition exists in libssh2 before 1.8.1  due to the way packets are read from the server. An authenticated, local attacker can exploit this if they have already compromised an SSH server. The attacker may be able to execute code on the system of users who connect to the SSH server.

Palo Alto GlobalProtect Agent, a VPN client, is installed on the remote macOS host.

The version of Google Chrome installed on the remote macOS host is prior to 81.0.4044.113. It is, therefore, affected by a vulnerability as referenced in the 2020_04_stable-channel-update-for-desktop_15 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Microsoft Office application installed on the remote macOS or Mac OS X host is missing a security update. It is, therefore, affected by a remote code execution vulnerability in Microsoft Word software due to failure to properly handle objects in memory. An attacker could use a specially crafted file to perform actions in the security context of the current user. To exploit this issue, an attacker would have to convince the user to click a link, typically by way of an enticement in an email or Instant Messenger message, and then convince the user to open the specially crafted file.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 68.7.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-14 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote macOS host is prior to 81.0.4044.92. It is, therefore, affected by multiple vulnerabilities as referenced in the 2020_04_stable-channel-update-for-desktop_7 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apple Xcode installed on the remote macOS or Mac OS X host is prior to 10.2. It is, therefore, affected by a memory corruption issue due to improper input checking. An unauthenticated, remote attacker can exploit this to execute arbitrary code with kernel privileges.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 75.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-12 advisory. 

  - Mozilla developers and community members Tyson Smith and Christian Holler reported     memory safety bugs present in Firefox 74 and Firefox ESR 68.6. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of     these could have been exploited to run arbitrary code. (CVE-2020-6825) 

  - When reading from areas partially or fully outside the source resource with WebGL's     copyTexSubImage method, the specification requires the returned values be zero.     Previously, this memory was uninitialized, leading to potentially sensitive data     disclosure. (CVE-2020-6821)

  - On 32-bit builds, an out of bounds write could have occurred when processing an image     larger than 4 GB in GMPDecodeData. It is possible that with enough effort this could     have been exploited to run arbitrary code. (CVE-2020-6822) 

  - A malicious extension could have called browser.identity.launchWebAuthFlow,     controlling the redirect_uri, and through the Promise returned, obtain the Auth     code and gain access to the user's account at the service provider. (CVE-2020-6823)

  - Initially, a user opens a Private Browsing Window and generates a password for a site,     then closes the Private Browsing Window but leaves Firefox open. Subsequently, if the     user had opened a new Private Browsing Window, revisited the same site, and generated     a new password - the generated passwords would have been identical, rather than     independent. (CVE-2020-6824) 

  - Mozilla developers Tyson Smith, Bob Clary, and Alexandru Michis reported memory     safety bugs present in Firefox 74. Some of these bugs showed evidence of memory     corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. (CVE-2020-6826)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 68.7. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-13 advisory.

  - A malicious Android application could craft an Intent     that would have been processed by Firefox for Android     and potentially result in a file overwrite in the user's     profile directory. One exploitation vector for this     would be to supply a user.js file providing arbitrary     malicious preference values. Control of arbitrary     preferences can lead to sufficient compromise such that     it is generally equivalent to arbitrary code     execution. Note: This issue only affects Firefox for     Android. Other operating systems are unaffected.
    (CVE-2020-6828)

  - When following a link that opened an intent://-schemed     URL, causing a custom tab to be opened, Firefox for     Android could be tricked into displaying the incorrect     URI.  Note: This issue only affects Firefox for     Android. Other operating systems are unaffected.
    (CVE-2020-6827)

  - When reading from areas partially or fully outside the     source resource with WebGL's     copyTexSubImage method, the specification     requires the returned values be zero. Previously, this     memory was uninitialized, leading to potentially     sensitive data disclosure. (CVE-2020-6821)

  - On 32-bit builds, an out of bounds write could have     occurred when processing an image larger than 4 GB in     GMPDecodeData. It is possible that with     enough effort this could have been exploited to run     arbitrary code. (CVE-2020-6822)

  - Mozilla developers Tyson Smith and Christian Holler     reported memory safety bugs present in Firefox 74 and     Firefox ESR 68.6. Some of these bugs showed evidence of     memory corruption and we presume that with enough effort     some of these could have been exploited to run arbitrary     code. (CVE-2020-6825)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 74.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-11 advisory.

  - Under certain conditions, when running the nsDocShell     destructor, a race condition can cause a use-after-free.
    We are aware of targeted attacks in the wild abusing     this flaw. (CVE-2020-6819)

  - Under certain conditions, when handling a     ReadableStream, a race condition can cause a use-after-     free. We are aware of targeted attacks in the wild     abusing this flaw. (CVE-2020-6820)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 68.6.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-11 advisory.

  - Under certain conditions, when running the nsDocShell     destructor, a race condition can cause a use-after-free.
    We are aware of targeted attacks in the wild abusing     this flaw. (CVE-2020-6819)

  - Under certain conditions, when handling a     ReadableStream, a race condition can cause a use-after-     free. We are aware of targeted attacks in the wild     abusing this flaw. (CVE-2020-6820)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Zoom Client for Meetings installed on the remote macOS or Mac OS X host is prior to 4.6.9.19273.0402 and is therefore affected by multiple vulnerabilities.

  - Local Privilege Escalation: A local authenticated attacker could leverage this vulnerability to gain addition privileges on the local system.

  - Unauthorized access: A local authenticated attacker can gain access to another user's webcam and microphone.

  - Access Control Bypass: A remote authenticated attacker could gain access to the chat in a webinar when the chat has been disabled.

The version of Google Chrome installed on the remote macOS host is prior to 80.0.3987.162. It is, therefore, affected by multiple vulnerabilities as referenced in the 2020_03_stable-channel-update-for-desktop_31 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of VMware Fusion installed on the remote macOS or Mac OS X host is 11.0.x prior to 11.5.2. It is, therefore, affected by multiple vulnerabilities.  Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Severity
138095	Mozilla Thunderbird < 68.10.0	High
138086	Wireshark 3.2.x < 3.2.5 A Vulnerability (macOS)	Low
138084	Mozilla Firefox < 78.0	Critical
138082	Mozilla Firefox ESR < 68.10	High
137879	Adobe Premiere Pro Installed (Mac OS X)	Info
137839	VMware Tools < 11.1.1 Denial-of-Service Vulnerability (VMSA-2020-0014) (macOS)	Low
137700	Google Chrome < 83.0.4103.116 Vulnerability	Critical
137653	Adobe Premiere Rush Installed (Mac OS X)	Info
137650	Cisco Webex Meetings Desktop App Installed (Mac OS X)	Info
137634	Google Chrome < 83.0.4103.106 Multiple Vulnerabilities	Critical
137252	Adobe Flash Player for Mac <= 32.0.0.371 (APSB20-30)	Critical
137086	Mozilla Thunderbird < 68.9.0	High
137080	Google Chrome < 83.0.4103.97 Multiple Vulnerabilities	Medium
137076	VMware Fusion 11.x < 11.5.5 Multiple Vulnerabilities (VMSA-2020-0011)	Medium
137071	macOS 10.15.x < 10.15.5 Supplemental Update / 10.13.x < 10.13.6 Security Update 2020-003	High
137068	Adobe XD Installed (Mac OS X)	Info
137050	Mozilla Firefox ESR < 68.9	High
137048	Mozilla Firefox < 77.0	High
136930	macOS 10.15.x < 10.15.5 / 10.14.x < 10.14.6 Security Update 2020-003 / 10.13.x < 10.13.6 Security Update 2020-003	High
136925	Wireshark 3.0.x < 3.0.11 NFS Dissector Vulnerability (macOS)	Medium
136923	Wireshark 3.2.x < 3.2.4 NFS Dissector DoS Vulnerability (macOS)	Medium
136921	Wireshark 2.6.x < 2.6.17 NFS dissector Vulnerability (macOS)	Medium
136742	Google Chrome < 83.0.4103.61 Multiple Vulnerabilities	Medium
136561	Adobe Reader <= 2015.006.30518 / 2017.011.30166 / 2020.006.20042 Multiple Vulnerabilities (APSB20-24) (macOS)	Medium
136560	Adobe Acrobat <= 2015.006.30518 / 2017.011.30166 / 2020.006.20042 Multiple Vulnerabilities (APSB20-24) (macOS)	Medium
136559	Security Updates for Microsoft Office Products (May 2020) (macOS)	High
136403	Mozilla Firefox < 76.0	Critical
136358	Mozilla Thunderbird < 68.8.0	Critical
136356	Mozilla Firefox ESR < 68.8	Critical
136347	Google Chrome < 81.0.4044.138 Multiple Vulnerabilities	High
136121	Google Chrome < 81.0.4044.129 Multiple Vulnerabilities	Medium
135916	Google Chrome < 81.0.4044.122 Multiple Vulnerabilities	Medium
135903	Palo Alto GlobalProtect Agent 5.0.x < 5.0.9 / 5.1.x < 5.1.1 Information Disclosure	Low
135900	Foxit Reader Installed (Mac OS X)	Info
135899	Foxit PhantomPDF Installed (Mac OS X)	Info
135856	Wireshark 2.6.x < 2.6.16 / 3.0.x < 3.0.10 / 3.2.x < 3.2.3 BACapp Dissector DoS (macOS)	Medium
135851	libssh2 < 1.8.1 Integer Overflow Vulnerability.	High
135755	Palo Alto GlobalProtect Agent Installed (macOS)	Info
135703	Google Chrome < 81.0.4044.113 Vulnerability	Medium
135589	Security Updates for Microsoft Office Products (April 2020) (macOS)	High
135412	Mozilla Thunderbird < 68.7.0	High
135400	Google Chrome < 81.0.4044.92 Multiple Vulnerabilities	Medium
135296	Apple Xcode < 10.2 Code Execution (macOS)	High
135275	Mozilla Firefox < 75.0 Multiple Vulnerabilities (mfsa2020-12)	High
135273	Mozilla Firefox ESR < 68.7 Multiple Vulnerabilities (mfsa2020-13)	High
135200	Mozilla Firefox < 74.0.1	Medium
135199	Mozilla Firefox ESR < 68.6.1	Medium
135189	Zoom Client for Meetings < 4.6.9.19273.0402 Multiple Issues (macOS)	Medium
135093	Google Chrome < 80.0.3987.162 Multiple Vulnerabilities	Medium
134974	VMware Fusion 11.0.x < 11.5.2 Multiple Vulnerabilities (VMSA-2020-0005)	High

MacOS X Local Security Checks Family for Nessus