The version of Samba running on the remote host is 3.6.x prior to 4.12.5, 4.13.x prior to 4.13.8, or 4.14.x prior to 4.14.4.  It is, therefore, potentially affected by an unauthorized file access flaw that could allow it to read data beyond the end of the array in the case where a negative cache entry had been added to the mapping cache. This could cause the calling code to return those values into the process token that stores the group membership for a user. The flaw can impact data confidentiality and integrity by allowing unauthorized access.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Xen hypervisor installed on the remote host is affected by an issue allowing x86 guest OS users to cause a denial of service (data corruption), cause a data leak, or possibly gain privileges because an AMD IOMMU page-table entry can be half-updated.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

According to its self-reported version, the Tenable Nessus application running on the remote host is prior to 8.14.0. It is, therefore, affected by a privilege escalation vulnerability. An authenticated attacker can exploit this, via file upload, to gain administrator privileges to the system.
 Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

According to its self-reported version number, the Xen hypervisor installed on the remote host is affected by an issue allowing Intel guest OS users to gain privileges or cause a denial of service because of non-atomic modification of a live EPT PTE. When mapping guest EPT (nested paging) tables, Xen would in some circumstances use a series of non-atomic bitfield writes. Depending on the compiler version and optimisation flags, Xen might expose a dangerous partially written PTE to the hardware, which an attacker might be able to race to exploit. A guest administrator or perhaps even an unprivileged guest user might be able to cause denial of service, data corruption, or privilege escalation. Only systems using Intel CPUs are vulnerable. Systems using AMD CPUs, and Arm systems, are not vulnerable. Only systems using nested paging (hap, aka nested paging, aka in this case Intel EPT) are vulnerable. Only HVM and PVH guests can exploit the vulnerability. The presence and scope of the vulnerability depends on the precise optimisations performed by the compiler used to build Xen. If the compiler generates (a) a single 64-bit write, or (b) a series of read-modify-write operations in the same order as the source code, the hypervisor is not vulnerable. For example, in one test build using GCC 8.3 with normal settings, the compiler generated multiple (unlocked) read-modify-write operations in source-code order, which did not constitute a vulnerability. We have not been able to survey compilers; consequently we cannot say which compiler(s) might produce vulnerable code (with which code-generation options). The source code clearly violates the C rules, and thus should be considered vulnerable.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

According to its self-reported version number, the Xen hypervisor installed on the remote host is affected by a bad permissions issue. In the Ocaml xenstored implementation, the internal representation of the tree has special cases for the root node, because this node has no parent. Unfortunately, permissions were not checked for certain operations on the root node. Unprivileged guests can get and modify permissions, list, and delete the root node. (Deleting the whole xenstore tree is a host-wide denial of service.) Achieving xenstore write access is also possible. All systems using oxenstored are vulnerable. Building and using oxenstored is the default in the upstream Xen distribution, if the Ocaml compiler is available. Systems using C xenstored are not vulnerable.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

According to its self-reported version number, the Xen hypervisor installed on the remote host is affected by an issue allowing x86 HVM guest OS users to cause a hypervisor crash. An inverted conditional in x86 HVM guests' dirty video RAM tracking code allows such guests to make Xen de-reference a pointer guaranteed to point at unmapped space. A malicious or buggy HVM guest may cause the hypervisor to crash, resulting in Denial of Service (DoS) affecting the entire host.
Xen versions from 4.8 onwards are affected. Xen versions 4.7 and earlier are not affected. Only x86 systems are affected. Arm systems are not affected. Only x86 HVM guests using shadow paging can leverage the vulnerability. In addition, there needs to be an entity actively monitoring a guest's video frame buffer (typically for display purposes) in order for such a guest to be able to leverage the vulnerability. x86 PV guests, as well as x86 HVM guests using hardware assisted paging (HAP), cannot leverage the vulnerability.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

According to its self-reported version number, the Xen hypervisor installed on the remote host is affected by a denial of service (DoS) vulnerability. An x86 HVM guest with PCI pass through devices can force the allocation of all IDT vectors on the system by rebooting itself with MSI or MSI-X capabilities enabled and entries setup. Such reboots will leak any vectors used by the MSI(-X) entries that the guest might had enabled, and hence will lead to vector exhaustion on the system, not allowing further PCI pass through devices to work properly. HVM guests with PCI pass through devices can mount a DoS attack affecting the pass through of PCI devices to other guests or the hardware domain. In the latter case, this would affect the entire host.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

According to its self-reported version number, the Xen hypervisor installed on the remote host is affected by an issue.
Incomplete cleanup from specific special register read operations in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. An attacker, which could include a malicious untrusted user process on a trusted guest, or an untrusted guest, can sample the contents of certain off-core accesses by other cores in the system. Only x86 processors are vulnerable. ARM processors are not believed to be vulnerable.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

According to its self-reported version number, the Xen hypervisor installed on the remote host is affected by an issue allowing Arm guest OS users to cause a hypervisor crash because of a missing alignment check in VCPUOP_register_vcpu_info. The hypercall VCPUOP_register_vcpu_info is used by a guest to register a shared region with the hypervisor. The region will be mapped into Xen address space so it can be directly accessed. On Arm, the region is accessed with instructions that require a specific alignment. Unfortunately, there is no check that the address provided by the guest will be correctly aligned. As a result, a malicious guest could cause a hypervisor crash by passing a misaligned address. A malicious guest administrator may cause a hypervisor crash, resulting in a Denial of Service (DoS). All Xen versions are vulnerable. Only Arm systems are vulnerable. x86 systems are not affected.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

According to its self-reported version number, the Xen hypervisor installed on the remote host is affected by an issue.
Xenstored and guests communicate via a shared memory page using a specific protocol. When a guest violates this protocol, xenstored will drop the connection to that guest. Unfortunately, this is done by just removing the guest from xenstored's internal management, resulting in the same actions as if the guest had been destroyed, including sending an @releaseDomain event. @releaseDomain events do not say that the guest has been removed. All watchers of this event must look at the states of all guests to find the guest that has been removed. When an @releaseDomain is generated due to a domain xenstored protocol violation, because the guest is still running, the watchers will not react. Later, when the guest is actually destroyed, xenstored will no longer have it stored in its internal data base, so no further @releaseDomain event will be sent. This can lead to a zombie domain; memory mappings of that guest's memory will not be removed, due to the missing event. This zombie domain will be cleaned up only after another domain is destroyed, as that will trigger another @releaseDomain event. If the device model of the guest that violated the Xenstore protocol is running in a stub-domain, a use-after-free case could happen in xenstored, after having removed the guest from its internal data base, possibly resulting in a crash of xenstored. A malicious guest can block resources of the host for a period after its own death. Guests with a stub domain device model can eventually crash xenstored, resulting in a more serious denial of service (the prevention of any further domain management operations).

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

The NVIDIA GPU display driver software on the remote host is missing a security update. It is, therefore, affected by multiple vulnerabilities:

  - NVIDIA GPU Display Driver for Windows and Linux, all versions, contains a vulnerability in the kernel mode     layer (nvlddmkm.sys or nvidia.ko) where improper access control may lead to denial of service, information     disclosure, or data corruption (CVE-2021-1076).

  - NVIDIA GPU Display Driver for Windows and Linux, R450 and R460 driver branch, contains a vulnerability     where the software uses a reference count to manage a resource that is incorrectly updated, which may lead     to denial of service (CVE-2021-1077).

Note that Nessus has not tested for the issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Xen hypervisor installed on the remote host is affected by an issue allowing x86 guest OS users to cause a host OS denial of service, achieve data corruption, or possibly gain privileges by exploiting a race condition that leads to a use-after-free involving 2MiB and 1GiB superpages.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

The version of Oracle Business Intelligence Publisher or Oracle Analytics Server 5.5 running on the remote host is 11.1.1.9.x prior to 11.1.1.9.210215, 12.2.1.3.x prior to 12.2.1.3.210405, 12.2.1.4.x prior to 12.2.1.4.210402, or 12.2.5.5.x (OAS 5.5) prior to 12.2.5.5.210331. It is, therefore, affected by multiple vulnerabilities as noted in the April 2021 Critical Patch Update advisory, including the following:

  - An unspecified vulnerability exists in the Analytics Server component of Oracle BI Enterprise Edition     subcomponent Apache Spark. An unauthenticated, remote attacker can exploit this, via HTTP, to take over     Oracle BI Enterprise Edition. (CVE-2020-9480)

  - A denial of service vulnerability exists in the BI Platform Security component of Oracle BI Enterprise     Edition subcomponent OpenSSL. An unauthenticated, remote attacker can exploit this, via HTTPS, to hang or     repeatedly crash the product. (CVE-2020-1971)

  - An unspecified vulnerability exists in the BI Platform Security component of Oracle BI Enterprise Edition     subcomponent Apache Tomcat.  An unauthenticated, remote attacker can exploit this, via HTTP, to result in     unauthorized update, insert, or delete access to some of Oracle BI accessible data, as well as     unauthorized read access to a subset of Oracle BI accessible data. (CVE-2019-0221)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 7 Update 301, 8 Update 291, 11 Update 11, or 16 Update 1. It is, therefore, affected by multiple vulnerabilities as referenced in the April 2021 CPU advisory:

  - A vulnerability in Java SE, SE Embedded and Oracle GraalVM Enterprise Edition allows unauthenticated remote attacker     to compromise the system which can result in an unauthorized creation, deletion or modification access to critical     data. (CVE-2021-2161)

  - A vulnerability in Java SE, SE Embedded and Oracle GraalVM Enterprise Edition allows unauthenticated remote attacker     with a human interaction from a person other than the attacker to compromise the system which can result in an     unauthorized creation, deletion or modification access to critical data. (CVE-2021-2163)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle E-Business Suite installed on the remote host is affected by multiple vulnerabilities as referenced in the April 2021 CPU advisory.

  - A vulnerability exists in the Oracle Applications Framework product of Oracle E-Business Suite (component:
    Home page). The supported version that is affected is 12.2.10. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Oracle Applications Framework.
    Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification     access to critical data or all Oracle Applications Framework accessible data as well as unauthorized     access to critical data or complete access to all Oracle Applications Framework accessible data.
    (CVE-2021-2200)

  - A vulnerability exists in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing     Administration). Supported versions that are affected are 12.2.7-12.2.10. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Oracle Marketing. Successful     attacks of this vulnerability can result in unauthorized creation, deletion or modification access to     critical data or all Oracle Marketing accessible data as well as unauthorized access to critical data or     complete access to all Oracle Marketing accessible data. (CVE-2021-2205)

  - A vulnerability exists in the Oracle Email Center product of Oracle E-Business Suite (component: Message     Display). Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.10. Easily exploitable     vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Email     Center. While the vulnerability is in Oracle Email Center, attacks may significantly impact additional     products. Successful attacks of this vulnerability can result in unauthorized access to critical data or     complete access to all Oracle Email Center accessible data as well as unauthorized update, insert or     delete access to some of Oracle Email Center accessible data. (CVE-2021-2209)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

The 13.3.0.1 versions of Application Testing Suite installed on the remote host are affected by a vulnerability as referenced in the April 2021 CPU advisory.

  - Vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager (component:
    Load Testing for Web Apps (OpenCV)). The supported version that is affected is 13.3.0.1. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Oracle Application Testing Suite. Successful attacks require human interaction from a person other than     the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Application     Testing Suite. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). (CVE-2019-5064)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle WebCenter Portal installed on the remote host is missing a security patch from the January 2021 Critical Patch Update (CPU). It is, therefore, affected by the following vulnerabilities:

  - Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework   (Apache Commons Compress)). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable   vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal.   Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently   repeatable crash (complete DOS) of Oracle WebCenter Portal (CVE-2019-12402).

  - Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework   (Netty)). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows   unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal. Successful attacks of   this vulnerability can result in takeover of Oracle WebCenter Portal (CVE-2020-11612). 

  - Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework   (Apache Tika)). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability    allows unauthenticated attacker with logon to the infrastructure where Oracle WebCenter Portal executes to    compromise Oracle WebCenter Portal. Successful attacks require human interaction from a person other than the    attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently   repeatable crash (complete DOS) of Oracle WebCenter Portal (CVE-2020-9489).

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

The version of WebLogic Server installed on the remote host is affected by multiple vulnerabilities as referenced in the April 2021 CPU advisory.

  - An unspecified vulnerability exists in the Coherence Container component. Easily exploitable vulnerability     allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server.
    Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. (CVE-2021-2135)

  - An unspecified vulnerability exists in the Core component. Easily exploitable vulnerability allows     unauthenticated attacker with network access via IIOP to compromise Oracle WebLogic Server. Successful     attacks of this vulnerability can result in takeover of Oracle WebLogic Server. (CVE-2021-2136)     
  - An unspecified vulnerability exists in the TopLink Integration component. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.
    Successful attacks of this vulnerability can result in unauthorized access to critical data or complete     access to all Oracle WebLogic Server accessible data. (CVE-2021-2157)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

The version of the Oracle Coherence installed on the remote host is missing a critical patch update. It is, therefore, affected by a vulnerability, as referenced in the April 2021 CPU advisory.

  - Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core   (jackson-databind)). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily   exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise   Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized creation,   deletion or modification access to critical data or all Oracle Coherence accessible data (CVE-2020-25649).

  - Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported   versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily   exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise   Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized access to critical   data or complete access to all Oracle Coherence accessible data (CVE-2021-2277). 

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The 12.4.0.0 versions of Enterprise Manager Ops Center installed on the remote host are affected by a vulnerablity as referenced in the April 2021 CPU advisory.

  - Vulnerability in the Enterprise Manager Ops Center product of Oracle Enterprise Manager (component:
    Satellite Framework (OpenSSL)). The supported version that is affected is 12.4.0.0. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Enterprise     Manager Ops Center. Successful attacks of this vulnerability can result in unauthorized ability to cause     a hang or frequently repeatable crash (complete DOS) of Enterprise Manager Ops Center. (CVE-2020-1971)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Virtualbox installed on the remote host is prior to 6.1.20. It is, therefore, affected by multiple  vulnerabilities as referenced in the April 2021 CPU advisory:

  - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version     that is affected is Prior to 6.1.20. Easily exploitable vulnerability allows high privileged attacker with logon to     the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability     is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this     vulnerability can result in takeover of Oracle VM VirtualBox. (CVE-2021-2250)

  - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version     that is affected is Prior to 6.1.20. Easily exploitable vulnerability allows low privileged attacker with logon to     the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability     is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this     vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle     VM VirtualBox accessible data as well as unauthorized access to critical data or complete access to all Oracle VM     VirtualBox accessible data. (CVE-2021-2264)

  - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version     that is affected is Prior to 6.1.20. Easily exploitable vulnerability allows high privileged attacker with logon to     the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of     this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS)     of Oracle VM VirtualBox. This vulnerability applies to Windows systems only. (CVE-2021-2312)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The 13.4.0.0 version of Enterprise Manager Base Platform installed on the remote host is affected by multiple vulnerabilities as referenced in the April 2021 CPU advisory.

  - Vulnerability in the Enterprise Manager for Virtualization product of Oracle Enterprise Manager     (component: Administration operations (Apache Commons BeanUtils)). The supported version that is affected     is 13.4.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Enterprise Manager for Virtualization. Successful attacks of this vulnerability can result     in unauthorized update, insert or delete access to some of Enterprise Manager for Virtualization accessible     data as well as unauthorized read access to a subset of Enterprise Manager for Virtualization accessible data     and unauthorized ability to cause a partial denial of service (partial DOS) of Enterprise Manager for     Virtualization. (CVE-2019-10086)

  - Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component:     EM on Market Place (Perl)). The supported version that is affected is 13.4.0.0. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Enterprise Manager Base Platform.     Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of Enterprise Manager Base Platform as well as unauthorized update, insert or delete access to     some of Enterprise Manager Base Platform accessible data and unauthorized read access to a subset of Enterprise     Manager Base Platform accessible data. (CVE-2020-10878)

  - Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Reporting     Framework (Apache Camel)). The supported version that is affected is 13.4.0.0. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Enterprise Manager Base Platform.     Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access     to all Enterprise Manager Base Platform accessible data. (CVE-2020-11994)

  - Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: UI Framework).
    The supported version that is affected is 13.4.0.0. Easily exploitable vulnerability allows unauthenticated attacker     with network access via HTTP to compromise Enterprise Manager Base Platform. Successful attacks require human     interaction from a person other than the attacker and while the vulnerability is in Enterprise Manager Base Platform,     attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Enterprise Manager Base Platform accessible data as well as unauthorized     read access to a subset of Enterprise Manager Base Platform accessible data. (CVE-2021-2053)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version, the version of Pulse Connect Secure running on the remote host is greater than 9.0R3 and prior to 9.1R11.4. It is, therefore, affected by multiple vulnerabilities including an authentication bypass vulnerability that can allow an unauthenticated user to perform remote arbitrary file execution on the Pulse Connect Secure gateway.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Xen hypervisor installed on the remote host is affected by an issue allowing x86 Intel HVM guest OS users to achieve unintended read/write DMA access, and possibly cause a denial of service (host OS crash) or gain privileges. This occurs because a backport missed a flush, and thus IOMMU updates were not always correct. NOTE: this issue exists because of an incomplete fix for CVE-2020-15565.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

According to its version, the installation of Tenable Nessus Agent on the remote host is no longer supported.

Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilities.

According to its self-reported version number, the installation of Tenable Nessus Network Monitor (NNM) on the remote host is no longer supported.

Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilities.

The version of Citrix Hypervisor (formerly Citrix XenServer) running on the remote host is missing a security hotfix. It is, therefore, affected by denial of service vulnerabilities. 

 - A local attacker with the ability to execute privileged mode code in a guest machine can perform a denial of service    attack against the host causing the host to crash or become unresponsive. Please refer to the vendor advisory for    mitigating factors. (CVE-2021-28038)    
 - A vulnerability was found in openvswitch. A limitation in the implementation of userspace packet parsing can allow a    malicious user to send a specially crafted packet causing the resulting megaflow in the kernel to be too wide,    potentially causing a denial of service. The highest threat from this vulnerability is to system availability.
   (CVE-2020-35498)  
 - A local attacker with the ability to execute privileged mode code in a guest machine can perform a denial of service    attack against the host causing the host to crash or become unresponsive. Please refer to the vendor advisory for    mitigating factors. (CVE-2021-28688)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Tenable.sc application installed on the remote host is version 5.16.0 or 5.17.0 and affected by the following OpenSSL denial of service vulnerability:

  - An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a     TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial     ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result,     leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation     enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1     versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not     impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j). (CVE-2021-3449)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Tenable Nessus agent running on the remote host is prior to 8.2.4. It is, therefore, affected by multiple vulnerabilities. Nessus Agent leverages third-party software to help provide underlying functionality. Two separate third-party components (OpenSSL and   sqlite) were found to contain vulnerabilities, and updated versions have been made available by the providers.

Out of caution and in line with good practice, Tenable opted to upgrade the bundled libraries to address the potential impact of these issues. Nessus Agent 8.2.4 will update OpenSSL to version 1.1.1k and sqlite to version 3.34.1 to address the identified vulnerabilities.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host contains one or more unsupported versions of Python.

Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilities.

According to its self-reported version, the Tenable Nessus application running on the remote host is 8.9.0 prior to 8.13.2. It is, therefore, affected by multiple vulnerabilities:

  - An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a     client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was     present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL     pointer dereference will result, leading to a crash and a denial of service attack. A server is only     vulnerable if it has TLSv1.2 and renegotiation enabled. (CVE-2021-3449)

  - The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a     certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to disallow     certificates in the chain that have explicitly encoded elliptic curve parameters was added as an     additional strict check. An error in the implementation of this check meant that the result of a previous     check to confirm that certificates in the chain are valid CA certificates was overwritten. This     effectively bypasses the check that non-CA certificates must not be able to issue other certificates. If a     'purpose' has been configured then there is a subsequent opportunity for checks that the certificate is a     valid CA. All of the named 'purpose' values implemented in libcrypto perform this check. Therefore, where     a purpose is set the certificate chain will still be rejected even when the strict flag has been used. A     purpose is set by default in libssl client and server certificate verification routines, but it can be     overridden or removed by an application. In order to be affected, an application must explicitly set the     X509_V_FLAG_X509_STRICT verification flag and either not set a purpose for the certificate verification     or, in the case of TLS client or server applications, override the default purpose. (CVE-2021-3450)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

According to its self-reported version, the Tenable SecurityCenter application installed on the remote host is version 5.13.x < 5.18.0 and affected by the following OpenSSL denial of service vulnerability: 

    - An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a     client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was     present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL     pointer dereference will result, leading to a crash and a denial of service attack. A server is only     vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS     clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of     these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in     OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j). (CVE-2021-3449)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of VMware vRealize Operations (vROps) Manager running on the remote web server is 7.5.x prior to 7.5.0.17771878, 8.0.0 prior to 8.0.1.17771851, or 8.1.0 prior to 8.1.1.17772462 or 8.2.0 prior to 8.2.0.17771778 or 8.3.0 prior to 8.3.0.17787340. It is, therefore, affected by a multiple vulnerablities. 

  - A malicious actor with network access to the vRealize Operations Manager API can perform a Server Side     request Forgery attack to steal administrative credentials. (CVE-2021-21975)

  - An authenticated malicious actor with network access to the vRealize Operations Manager API can write     files to arbitrary locations on the underlying photon operating system.(CVE-2021-21983)

According to its self-reported version, Cisco Jabber is affected by multiple vulnerabilities which could allow a remote, authenticated attacker to execute arbitrary programs on the underlying operating system with the privileges of the user account that is running the Cisco Jabber client software or gain access to sensitive information.

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

According to its self-reported version number, the instance of SaltStack hosted on the remote server is affected by multiple vulnerabilities:

  - The Salt-API’s SSH client is vulnerable to a shell injection by including ProxyCommand in an argument,     or via ssh_options provided in an API request. (CVE-2021-3197)

  - The Salt-API does not have eAuth credentials for the wheel_async client. Thus, an attacker can remotely     run any wheel modules on the master. (CVE-2021-25281)

  - eauth tokens can be used once after expiration. They can be used to run command against the salt master    or minions. (CVE-2021-3144)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version

A remote code execution vulnerability exists in the iControl REST API feature of F5's BIG-IP product. An unauthenticated, remote attacker can exploit this to bypass authentication and execute arbitrary commands with root privileges.

According to its self-reported version, the Tenable SecurityCenter application installed on the remote host is 5.9.x, 5.10.x, 5.11.x or 5.12.x. It is, therefore, affected by a privilege escalation vulnerability due to incorrect validation of cryptographic signatures in XML messages in the SimpleSAMLPHP third-party component. An authenticated attacker can exploit this to impersonate others or elevate privileges by creating a crafted XML message.

Note that Nessus has not tested for these issues nor the stand-alone patch but has instead relied only on the application's self-reported version number.

Nessus Agent versions 7.2.0 through 8.2.2 were found to inadvertently capture the IAM role security token on the local host during initial linking of the Nessus Agent when installed on an Amazon EC2 instance. This could allow a privileged attacker to obtain the token.

Additionally, one third-party component (OpenSSL) was found to contain vulnerabilities, and updated versions have been made available by the provider. Nessus Agent version 8.2.3 will update OpenSSL to 1.1.1j.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Nessus Network Monitor (NNM) is installed on the remote host.

The version of Nessus Network Monitor (NNM) installed on the remote host is prior to 5.13.0. It is, therefore, affected by multiple vulnerabilities.

An arbitrary code execution vulnerability exists in Microsoft Visual Studio Code. An unauthenticated, local attacker can exploit this by persuading a victim to open specially-crafted content which could exploit this vulnerability to execute arbitrary code on the system with privileges of the victim.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is prior to 6.23.0. It is, therefore, affected by multiple vulnerabilities:

  - The Alias feature in SnakeYAML 1.18 allows entity expansion during a load operation. (CVE-2017-18640)

  - The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite     loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose     the file names inside of an archive created by Compress. (CVE-2019-12402)

  - The OpenID client application in Atlassian Crowd before version 3.6.2, and from version 3.7.0 before 3.7.1     allows remote attackers to perform a Denial of Service attack via an XML Entity Expansion vulnerability. (CVE-2019-20104)

  - Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the     httputil.ReverseProxy Handler, because it reads a request body and writes a response at the same time. (CVE-2020-15586)

  - PKCE support is not implemented in accordance with the RFC for OAuth 2.0 for Native Apps. Without the use of PKCE,     an attacker is able to obtain the authorization code using a malicious app on the client-side and use it to gain     authorization to the protected resource. (CVE-2020-7692)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is prior to 7.9.0. It is affected by the following vulnerability:

  - A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009     in Undertow version 2.0.29.Final and before and was fixed in 2.0.30.Final. A remote, unauthenticated attacker could     exploit this vulnerability to read web application files from a vulnerable server. In instances where the vulnerable     server allows file uploads, an attacker could upload malicious JavaServer Pages (JSP) code within a variety of file     types and trigger this vulnerability to gain remote code execution. (CVE-2020-1745)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is prior to 6.1. It is, therefore, affected by multiple vulnerabilities:

  - A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could     allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method     of the ObjectMapper. (CVE-2017-7525)

  - JFrog Artifactory contains a Cross Site Request Forgery (CSRF) vulnerability in UI rest endpoints that can result in     Classic CSRF attack allowing an attacker to perform actions as logged in user. This attack appear to be exploitable     via maliciously crafted flash component. (CVE-2018-1000206)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is prior to 7.7.0. It is, therefore, affected by multiple vulnerabilities:

  - An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not     release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made,     an OutOfMemoryException could occur leading to a denial of service. (CVE-2020-13934)

  - The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6,     9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop.
    Multiple requests with invalid payload lengths could lead to a denial of service. (CVE-2020-13935)

  - A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35     and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were     made on concurrent HTTP/2 connections, the server could become unresponsive. (CVE-2020-11996)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is prior to 7.8.1. It is, therefore, affected by multiple vulnerabilities:

  - A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow     an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method     of the ObjectMapper. (CVE-2017-15095)

  - FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because     of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted     JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the Spring     libraries are available in the classpath. (CVE-2017-17485)

  - A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could     allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method     of the ObjectMapper. (CVE-2017-7525)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the version of JFrog Artifactory installed on the remote machine is prior to 6.23.1. It is, therefore, affected by multiple vulnerabilities:

  - CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to     trigger excessive memory allocation during a decode operation, because the nonce array length associated with     'new byte' may depend on untrusted input within the header of encoded data. (CVE-2020-7226)   
  - The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation,     and resultant OutOfMemoryError error, via crafted ASN.1 data. This is fixed in 1.64. (CVE-2019-17359)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle Access Manager Webgate installed on the remote host is affected by the following vulnerability as noted in the October 2020 CPU advisory :
  - Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Web Server     Plugin (RSA BSafe)). The supported version that is affected is 11.1.2.3.0. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTPS to compromise     Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle     Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).
  Note that Nessus has not attempted to exploit this issue but has instead relied only on the application's self-reported version number.

The version of Oracle Business Intelligence Publisher or Oracle Analytics Server 5.5 running on the remote host is 11.1.1.9.x prior to 11.1.1.9.210119, 12.2.1.3.x prior to 12.2.1.3.201216, 12.2.1.4.x prior to 12.2.1.4.201216, or 12.2.5.5.x (OAS 5.5) prior to 12.2.5.5.201216. It is, therefore, affected by multiple vulnerabilities as noted in the January 2021 Critical Patch Update advisory:

  - An unspecified vulnerability exists in the BI Publisher product of Oracle Fusion Middleware (component: BI     Publisher Security). An unauthenticated, remote attacker can exploit this, via HTTP, which can result in     unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data as well     as unauthorized update, insert or delete access to some of Oracle BI Publisher accessible data and unauthorized     ability to cause a partial denial of service (partial DOS) of Oracle BI Publisher. (CVE-2021-2013)

  - An unspecified vulnerability exists in the BI Publisher product of Oracle Fusion Middleware (component:     Administration). An unauthenticated, remote attacker can exploit this, via HTTP, which can result in     unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data as     well as unauthorized update, insert or delete access to some of Oracle BI Publisher accessible data and     unauthorized ability to cause a partial denial of service (partial DOS) of Oracle BI Publisher. (CVE-2021-2049)   
  - An unspecified vulnerability exists in the BI Publisher product of Oracle Fusion Middleware (component:     E-Business Suite - XDO). An unauthenticated, remote attacker can exploit this, via HTTP, which can result in     unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data as well as     unauthorized update, insert or delete access to some of Oracle BI Publisher accessible data and unauthorized     ability to cause a partial denial of service (partial DOS) of Oracle BI Publisher. (CVE-2021-2050, CVE-2021-2051)   
  - An unspecified vulnerability exists in the BI Publisher product of Oracle Fusion Middleware (component: BI     Publisher Security). An unauthenticated, remote attacker can exploit this, via HTTP, which can result in     unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data as well as     unauthorized update, insert or delete access to some of Oracle BI Publisher accessible data and unauthorized     ability to cause a partial denial of service (partial DOS) of Oracle BI Publisher. (CVE-2021-2051)

  - An unspecified vulnerability exists in the BI Publisher product of Oracle Fusion Middleware (component:     Web Server). An unauthenticated, remote attacker can exploit this, via HTTP, which can result in unauthorized     access to critical data or complete access to all Oracle BI Publisher accessible data as well as unauthorized     update, insert or delete access to some of Oracle BI Publisher accessible data. (CVE-2021-2062)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Severity
149350	Samba 3.6.x < 4.12.15 / 4.13.x < 4.13.8 / 4.14.x < 4.14.4 Unauthorized File Access	medium
149297	Xen unsafe AMD IOMMU page table updates (XSA-347)	medium
149280	Tenable Nessus 8.x.x < 8.14.0 Privilege Escalation (TNS-2021-07)	low
149089	Xen Paging Tables Race Condition (XSA-328)	medium
149088	Xen oxenstored Bad Permissions (XSA-353)	high
149087	Xen Inverted Conditional DoS (XSA-319)	medium
149086	Xen IRQ Vector Leak DoS (XSA-360)	medium
149085	Xen Speculative Side Channel Information Disclosure (XSA-320)	low
149066	Xen Missing Alignment Check DoS (XSA-327)	medium
149065	Xen Xenstore Use-After-Free DoS (XSA-325)	medium
149046	NVIDIA Linux GPU Display (April 2021)	medium
149033	Xen x86 Race Condition Use-After-Free (XSA-345)	medium
148980	Oracle Business Intelligence Publisher Multiple Vulnerabilities (Apr 2021 CPU)	high
148961	Oracle Java SE 1.7.0_301 / 1.8.0_291 / 1.11.0_11 / 1.16.0_1 Multiple Vulnerabilities (Unix Apr 2021 CPU)	medium
148952	Oracle E-Business Suite Multiple Vulnerabilities (Apr 2021 CPU)	high
148934	Oracle Application Testing Suite (Apr 2021 CPU)	medium
148925	Oracle WebCenter Portal Multiple Vulnerabilities (Apr 2021 CPU)	medium
148924	Oracle WebLogic Server Multiple Vulnerabilities (Apr 2021 CPU)	high
148923	Oracle Coherence (Apr 2021 CPU)	medium
148912	Oracle Enterprise Manager Ops Center (Apr 2021 CPU)	high
148897	Oracle VM VirtualBox (April 2021 CPU)	medium
148895	Oracle Enterprise Manager Cloud Control (Apr 2021 CPU)	high
148847	Pulse Connect Secure < 9.1R11.4 (SA44784)	high
148843	Xen Missed Flush DoS or Privilege Escalation (XSA-366)	medium
148832	Nessus Agent Unsupported Version Detection	critical
148711	Tenable Nessus Network Monitor Unsupported Version Detection	critical
148674	Citrix Hypervisor <= 8.2 LTSR DoS (CTX306565)	high
148404	Tenable.sc 5.16.0 / 5.17.0 OpenSSL DoS (TNS-2021-06)	medium
148392	Tenable Nessus Agent < 8.2.4 Multiple Vulnerabilities (TNS-2021-08)	medium
148367	Python Unsupported Version Detection	critical
148297	Tenable Nessus 8.9.0 < 8.13.2 Multiple Vulnerabilities (TNS-2021-05)	medium
148280	Tenable SecurityCenter 5.13.x < 5.18.0 DoS (TNS-2021-06)	medium
148255	VMware vRealize Operations Manager 7.5.x / 8.x Multiple Vulnerabilities (VMSA-2021-0004)	high
148137	Cisco Jabber Multiple Vulnerabilities (cisco-sa-cisco-jabber-PWrTATTC)	high
148112	SaltStack < 3002.5 Multiple Vulnerabilities	high
148022	F5 BIG-IP RCE (CVE-2021-22986)	critical
147896	Tenable SecurityCenter 5.9.x to 5.12.x SimpleSAMLPHP Privilege Escalation (TNS-2020-01)	medium
147895	Tenable Nessus Agent < 8.2.3 Multiple Vulnerabilities (TNS-2021-04)	low
147730	Nessus Network Monitor Installed (Linux credentialed check)	info
147729	Nessus Network Monitor < 5.13.0 Multiple Vulnerabilities (TNS-2021-02)	medium
147727	Security Update for Microsoft Visual Studio Code (March 2021)	medium
147722	JFrog < 6.23.0 Multiple Vulnerabilities	medium
147721	JFrog < 7.9.0 File Inclusion Vulnerability	high
147720	JFrog < 6.1 Multiple Vulnerabilities	high
147719	JFrog < 7.7.0 Multiple Vulnerabilities	medium
147718	JFrog < 7.8.1 Multiple Vulnerabilities	high
147717	JFrog Artifactory < 6.23.1 Multiple Vulnerabilities	medium
147662	OpenSSH < 8.5	medium
147640	Oracle Access Manager Webgate Information Disclosure (Oct 2020 CPU)	high
147639	Oracle Business Intelligence Publisher Multiple Vulnerabilities (Jan 2021 CPU)	medium

Misc. Family for Nessus

medium

medium

low

medium

high

medium

medium

low

medium

medium

medium

medium

high

medium

high

medium

medium

high

medium

high

medium

high

high

medium

critical

critical

high

medium

medium

critical

medium

medium

high

high

high

critical

medium

low

info

medium

medium

medium

high

high

medium

high

medium

medium

high

medium