The remote service accepts connections encrypted using TLS 1.1. This version of TLS is affected by multiple cryptographic flaws. An attacker can exploit these flaws to conduct man-in-the-middle attacks or to decrypt communications between the affected service and clients.

IBM MQ (formerly known as WebSphere MQ) was detected on the remote host.

IBM MQ is a messaging middleware product.

This plugin leverages one of the Ripple20 vulnerabilities (CVE-2020-11909) to determine if the Treck or Kasago TCP/IP stack is running on the remote host. It can be used for discovery of hosts in the environment that utilize the Treck or Kasago TCP/IP stack.
The plugin cannot determine if the patch for Ripple20 vulnerabilities was applied on the host.

Note that this plugin is based on a script provided by JSOF (https://www.jsof-tech.com/).

This plugin sends malformed packets to the remote host and looks for a response that could indicate a Treck/Kasago TCP/IP stack. 

If the remote host fails to respond, the plugin cannot make a determination. 

It's possible that a middle device (i.e., firewall or router) between Nessus and the target detects the malformed packets and does not forward them to the target. In this case, this plugin may not able to detect the Treck/Kasago TCP/IP stack or may produce incorrect results.

For the plugin to function effectively and not be impacted by intermediate devices on the network, the hosts being scanned should be on the same network segment as the scanner.

The Treck/Kasago network stack appears to be running on the remote host.

Note that this plugin is based on detection methods provided by JSOF (https://www.jsof-tech.com/).

This plugin uses additional methods to detect the Treck/Kasago TCP/IP stack. These methods are known to have false positives. Every trigger of the plugin needs to be investigated manually for confirmation.

The remote service accepts connections encrypted using TLS 1.3.

The remote host is running Arista CloudVision Portal, a web-based GUI for the CloudVision platform.

Note: To retrieve patch level information this plugin requires the HTTP credentials of the web console.

The Treck/Kasago network stack appears to be running on the remote  host.

Note that this plugin is based on a detection method provided by JSOF (https://www.jsof-tech.com/).

The plugin sends a special packet to the host and looks for a specific type of ICMP response packet. If the response is not received (for example, the host does not respond to the special packet or the response is blocked by a device between the scanner and the host), the plugin cannot make a determination. Failure to receive the specific type of ICMP packet in the response does not necessarily indicate that the remote host does not use the Treck/Kasago network stack.

The web interface for Citrix ShareFile Storage Zones Controller was detected on the remote host. ShareFile is a secure content collaboration, file sharing and sync solution. Storage Zones Controller provides private data storage, either an on-premises network share that you manage or a supported third-party storage system.

Salt Master for SaltStack, a security and configuration management automation platform, was detected on the remote Linux host.

SaltsSack Salt Master, a security and configuration management automation platform, is installed on the remote Linux host.

The remote service accepts connections encrypted using TLS 1.2.

Trend Micro Deep Security Agent which provides application control, anti-malware, web reputation service, firewall, intrusion prevention, integrity monitoring, and log inspection protection is installed on the remote Linux host.

The Palo Alto Expedition account is using a default password. An unauthenticated, remote attacker can exploit this gain privileged or administrator access to the system.

Multiple cross-site scripting (XSS) vulnerability exists in Palo ALto Expedition Migration Tool in versions less than or equal to 1.1.8 due to improper validation of user-supplied input before returning it to users.

  - An authenticated remote attacker may be able to inject arbitrary JavaScript or HTML in the User Mapping settings (CVE-2019-1569).

  - An authenticated remote attacker may be able to inject arbitrary JavaScript or HTML in the LDAP server settings (CVE-2019-1570).

  - An authenticated remote attacker may be able to inject arbitrary JavaScript or HTML in the Radius server settings (CVE-2019-1571).

Detects the web interface for Dell EMC Data Protection Central on the remote host.

Elastic Winlogbeat, a lightweight shipper for Windows event logs, is installed on the remote Windows host.

Apache Maven, a software project management and comprehension tool, is installed on the remote Linux / Unix host.

The remote host is running Adobe Experience Manager, a digital asset and content management software.

Note: To retrieve patch level information this plugin requires the HTTP credentials of the web console. For accurate results, you may need to enable the Adobe Experience Manager ports (by default, 4502 and/or 4503) in your Nessus scan.

Palo Alto Demisto, security orchestration software, was detected on the remote Unix / Linux host.

The web interface for Palo Alto Expedition was detected on the remote  host.  Expedition is software designed to enable migration of firewall policies and configurations.  It is possible to extract version information if login credentials are provided.

Atlassian JIRA, issue tracking software, was detected on the remote Unix / Linux host.

The web interface for Tenable Core, an operating system optimized to run certain Tenable products, was detected on the remote host.

Jenkins, an open source automation server software, is installed on the remote Linux host.

Harbor, an open source trusted cloud native registry project, is installed on the remote host.

The web interface for Harbor was detected on the remote host.

The web API for Cisco HyperFlex was detected on the remote host.

JIRA Service Desk, a help desk support software, was found on the remote host.

This plugin may require the use of thorough_tests to detect the app.

The web management interface for an OpenGear series 7x00 appliance was detected on the remote host. It is possible to extract the firmware version and model information if login credentials are provided.

Apple AirPlay, formerly AirTunes, was detected on the remote host.
It is possible to obtain information about the remote device from this service's response.

The web console for Commvault was detected on the remote host.

The web interface for Symantec Content Analysis, formerly Blue Coat  Content Analysis, was detected on the remote host. This detection covers v2.3 and up.

Version information for Symantec Content Analysis, formerly Blue Coat  Content Analysis, was retrieved from the remote host.

The web interface for Symantec Management Center, formerly Blue Coat Management Center, was detected on the remote web host. This detection covers v2.1 and up.

Note that Nessus attempts to retrieve the version information without credentials. If HTTP Basic credentials are given then an attempt to retrieve the version from the REST API will be performed first.

The web interface for Symantec Reporter was detected on the remote host.

Oracle MySQL connectors, drivers for connecting to MySQL databases, are available on the remote Linux host.

Note: Thorough tests may be required for an in-depth search of all connectors.

The Docker service running on the remote host has an exposed remote API. When Docker is configured in this manner an unauthenticated remote attacker could perform administrative Docker commands.

By identifying the command port, it was possible to detect that the remote host is a wireless presentation hardware device.

The web interface for a Grandstream Networking Solutions device, such as a router or wireless access point, was detected on the remote host.

A web server is running Python on the remote host.

Note that the web server may be running on top of Python, or just running an embedded version.

A Goverlan agent for remote control is installed on the remote host.

Ansible, an IT automation and management application, was found on the remote host.

Ansible AWX, an open-source IT automation and management application, was found on the remote host.

Splashtop Streamer, a remote control service, is installed on the remote host. 

Note: Splashtop default ports (6783, 6784, 6785) are not included in the default scan ports, and should be specified manually in the Nessus port scan range.

The web API for Kubernetes was detected on the remote host.

Oracle WebLogic Web services test client was detected on the remote host.

The web interface for HP DesignJet Printer was detected on the remote host.

TeamViewer, a remote control service, is installed on the remote Windows host.

The remote service accepts connections encrypted using TLS 1.1.
TLS 1.1 lacks support for current and recommended cipher suites.
Ciphers that support encryption before MAC computation, and authenticated encryption modes such as GCM cannot be used with TLS 1.1

As of March 31, 2020, Endpoints that are not enabled for TLS 1.2 and higher will no longer function properly with major web browsers and major vendors.

Rancher, a Kubernetes management platform, was detected based on the local Docker images available in the host.

ID	Name	Severity
139414	TLS Version 1.1 Protocol Detection (PCI DSS)	High
139005	IBM MQ Service Detection	Info
138615	Treck/Kasago Network Stack Detection With IP Option.	Info
138614	Treck/Kasago Network Stack Detection	Info
138330	TLS Version 1.3 Protocol Detection	Info
137855	Arista CloudVision Portal Web Detection	Info
137703	Treck/Kasago Network Stack Detection	Info
137002	ShareFile Storage Zones Controller Web Detection	Info
136734	SaltStack Salt Master Detection	Info
136355	SaltStack Salt Master Installed (Linux)	Info
136318	TLS Version 1.2 Protocol Detection	Info
135408	Trend Micro Deep Security Agent Installed (Linux)	Info
135255	Palo Alto Default Credentials	High
135238	Palo Alto Expedition Cross-Site Scripting	Low
135097	Dell EMC Data Protection Central Web Interface Detected	Info
135096	Elastic Winlogbeat Installed (Windows)	Info
133766	Apache Maven Installed (Linux / Unix)	Info
132871	Adobe Experience Manager Web Detection	Info
132771	Palo Alto Demisto Installed (Unix / Linux)	Info
132584	Palo Alto Expedition Web Detection	Info
131566	Atlassian Jira Installed (Unix / Linux)	Info
131287	Zebra ZTC Printer Web Interface Detection	Info
131081	Tenable Core Web Interface Detection	Info
130595	Jenkins Installed (Linux)	Info
130456	Harbor Local Detection	Info
129979	Harbor Web Interface Detection	Info
129590	Cisco HyperFlex Web API Detection	Info
129386	JIRA Service Desk Installed (Linux)	Info
128037	OpenGear Web Detection	Info
127858	Apple AirPlay Web Detection	Info
125777	Commvault Web Console Detection	Info
125311	Symantec Content Analysis Web Detection	Info
125310	Symantec Content Analysis Local Detection	Info
124697	Symantec Management Center Web Detection	Info
124568	Symantec Reporter Web Interface Detection	Info
124174	Oracle MySQL Connectors Installed (Linux)	Info
124029	Docker Remote API Detection	Critical
123936	Barco/AWiND WePresent Command Port Detection	Info
123463	Grandstream Networking Solutions Device Web Detection	Info
122364	Python Remote HTTP Detection	Info
122114	Goverlan Agent Remote Detection	Info
121575	Ansible Installed (Linux/UNIX)	Info
121574	Ansible AWX Installed (Linux/UNIX)	Info
121572	Splashtop Streamer remote detection	Info
121471	Kubernetes Web API Detection	Info
121396	Oracle WebLogic Web Services Test Client Detection	Info
121349	HP DesignJet Printer Web Interface Detection	Info
121245	TeamViewer remote detection	Info
121010	TLS Version 1.1 Protocol Detection	Info
119752	Rancher Docker Container Detection (Linux)	Info

Service detection Family for Nessus