The lwIP TCP/IP stack was detected on the remote host.

The Keil TCPnet TCP/IP stack was detected on the remote host.

The FNET TCP/IP stack was detected on the remote host.

The Nut/Net TCP/IP stack was detected on the remote host.

The uIP/Contiki TCP/IP stack was detected on the remote host.

The uC/TCP-IP stack was detected on the remote host.

The SSH server on the remote host accepts password authentication.

Detects the web interface for SonicWall Email Security on the remote host.

SaltsSack Salt Minion, a security and configuration management automation platform, is installed on the remote Linux host.

Detects the web interface for JetBrains TeamCity on the remote host.

Junos Space Security Director web interface detected on remote host.

The web interface for SAP Solution Manager was detected on the remote  host.  SAP Solution Manager is application lifecycle management software.

Note: This plugin does not report anything. Instead, it collects information stored in host tags for the future development of this plugin.

VMware Workspace ONE Access, (formerly VMware Identity Manager) an OS virtualization solution that allows the running of multiple operating systems on the same host, is installed on the remote host.

The remote host is a MobileIron Core appliance, the administrative console for security and management policies for the MobileIron Platform.

It is possible to obtain the version and build via the API.

Note that basic HTTP credentials are required to retrieve version information.

The remote host is a MobileIron Core appliance, the administrative console for security and management policies for the MobileIron Platform.

Nessus was able to detect that the remote service supports DTLS  (Datagram Transport Layer Security) by sending a ClientHello and  receiving a HelloVerifyRequest reply.

The remote service accepts connections encrypted using TLS 1.1. This version of TLS is affected by multiple cryptographic flaws. An attacker can exploit these flaws to conduct man-in-the-middle attacks or to decrypt communications between the affected service and clients.

IBM MQ (formerly known as WebSphere MQ) was detected on the remote host.

IBM MQ is a messaging middleware product.

This plugin leverages one of the Ripple20 vulnerabilities (CVE-2020-11909) to determine if the Treck or Kasago TCP/IP stack is running on the remote host. It can be used for discovery of hosts in the environment that utilize the Treck or Kasago TCP/IP stack.
The plugin cannot determine if the patch for Ripple20 vulnerabilities was applied on the host.

Note that this plugin is based on a script provided by JSOF (https://www.jsof-tech.com/).

This plugin sends malformed packets to the remote host and looks for a response that could indicate a Treck/Kasago TCP/IP stack. 

If the remote host fails to respond, the plugin cannot make a determination. 

It's possible that a middle device (i.e., firewall or router) between Nessus and the target detects the malformed packets and does not forward them to the target. In this case, this plugin may not able to detect the Treck/Kasago TCP/IP stack or may produce incorrect results.

For the plugin to function effectively and not be impacted by intermediate devices on the network, the hosts being scanned should be on the same network segment as the scanner.

The Treck/Kasago network stack appears to be running on the remote host.

Note that this plugin is based on detection methods provided by JSOF (https://www.jsof-tech.com/).

This plugin uses additional methods to detect the Treck/Kasago TCP/IP stack. These methods are known to have false positives. Every trigger of the plugin needs to be investigated manually for confirmation.

The remote service accepts connections encrypted using TLS 1.3.

The remote host is running Arista CloudVision Portal, a web-based GUI for the CloudVision platform.

Note: To retrieve patch level information this plugin requires the HTTP credentials of the web console.

The Treck/Kasago network stack appears to be running on the remote  host.

Note that this plugin is based on a detection method provided by JSOF (https://www.jsof-tech.com/).

The plugin sends a special packet to the host and looks for a specific type of ICMP response packet. If the response is not received (for example, the host does not respond to the special packet or the response is blocked by a device between the scanner and the host), the plugin cannot make a determination. Failure to receive the specific type of ICMP packet in the response does not necessarily indicate that the remote host does not use the Treck/Kasago network stack.

The web interface for Citrix ShareFile Storage Zones Controller was detected on the remote host. ShareFile is a secure content collaboration, file sharing and sync solution. Storage Zones Controller provides private data storage, either an on-premises network share that you manage or a supported third-party storage system.

Salt Master for SaltStack, a security and configuration management automation platform, was detected on the remote Linux host.

SaltsSack Salt Master, a security and configuration management automation platform, is installed on the remote Linux host.

The remote service accepts connections encrypted using TLS 1.2.

Trend Micro Deep Security Agent which provides application control, anti-malware, web reputation service, firewall, intrusion prevention, integrity monitoring, and log inspection protection is installed on the remote Linux host.

The Palo Alto Expedition account is using a default password. An unauthenticated, remote attacker can exploit this gain privileged or administrator access to the system.

Multiple cross-site scripting (XSS) vulnerability exists in Palo ALto Expedition Migration Tool in versions less than or equal to 1.1.8 due to improper validation of user-supplied input before returning it to users.

  - An authenticated remote attacker may be able to inject arbitrary JavaScript or HTML in the User Mapping settings (CVE-2019-1569).

  - An authenticated remote attacker may be able to inject arbitrary JavaScript or HTML in the LDAP server settings (CVE-2019-1570).

  - An authenticated remote attacker may be able to inject arbitrary JavaScript or HTML in the Radius server settings (CVE-2019-1571).

Detects the web interface for Dell EMC Data Protection Central on the remote host.

Elastic Winlogbeat, a lightweight shipper for Windows event logs, is installed on the remote Windows host.

Apache Maven, a software project management and comprehension tool, is installed on the remote Linux / Unix host.

The remote host is running Adobe Experience Manager, a digital asset and content management software.

Note: To retrieve patch level information this plugin requires the HTTP credentials of the web console. For accurate results, you may need to enable the Adobe Experience Manager ports (by default, 4502 and/or 4503) in your Nessus scan.

Palo Alto Cortex XSOAR (formerly Demisto), security orchestration software, was detected on the remote Unix / Linux host.

The web interface for Palo Alto Expedition was detected on the remote  host.  Expedition is software designed to enable migration of firewall policies and configurations.  It is possible to extract version information if login credentials are provided.

Atlassian JIRA, issue tracking software, was detected on the remote Unix / Linux host.

A Tenable Core Web Interface was detected on the remote host.

Jenkins, an open source automation server software, is installed on the remote Linux host.

Harbor, an open source trusted cloud native registry project, is installed on the remote host.

The web interface for Harbor was detected on the remote host.

The web API for Cisco HyperFlex was detected on the remote host.

Jira Service Desk is now part of Jira Service Management. Jira Service Desk, a help desk support software, was found on the remote host.

This plugin may require the use of thorough_tests to detect the app.

The web management interface for an OpenGear series 7x00 appliance was detected on the remote host. It is possible to extract the firmware version and model information if login credentials are provided.

Apple AirPlay, formerly AirTunes, was detected on the remote host.
It is possible to obtain information about the remote device from this service's response.

The web console for Commvault was detected on the remote host.

The web interface for Symantec Content Analysis, formerly Blue Coat  Content Analysis, was detected on the remote host. This detection covers v2.3 and up.

Version information for Symantec Content Analysis, formerly Blue Coat  Content Analysis, was retrieved from the remote host.

The web interface for Symantec Management Center, formerly Blue Coat Management Center, was detected on the remote web host. This detection covers v2.1 and up.

Note that Nessus attempts to retrieve the version information without credentials. If HTTP Basic credentials are given then an attempt to retrieve the version from the REST API will be performed first.

ID	Name	Severity
149500	lwIP TCP/IP Stack - HTTP Detection	info
149499	Keil TCPnet TCP/IP Stack - HTTP Detection	info
149498	FNET TCP/IP Stack - HTTP Detection	info
149497	Nut/Net TCP/IP Stack - HTTP Detection	info
149496	uIP/Contiki TCP/IP Stack - HTTP Detection	info
149495	uC/TCP-IP Stack - HTTP Detection	info
149334	SSH Password Authentication Accepted	info
148994	SonicWall Email Security Web Interface Detected	info
148692	SaltStack Salt Minion Installed (Linux)	info
148245	JetBrains TeamCity Web Interface Detection	info
148031	Junos Space Security Director Detection	info
145445	SAP Solution Manager Web Detection	info
143554	VMware Workspace ONE Access HTTP Detection	info
141341	MobileIron Core API Detection	info
141340	MobileIron Core Detection	info
140575	DTLS Service Detection	info
139414	TLS Version 1.1 Protocol Detection (PCI DSS)	high
139005	IBM MQ Service Detection	info
138615	Treck/Kasago Network Stack Detection With IP Option.	info
138614	Treck/Kasago Network Stack Detection	info
138330	TLS Version 1.3 Protocol Detection	info
137855	Arista CloudVision Portal Web Detection	info
137703	Treck/Kasago Network Stack Detection	info
137002	ShareFile Storage Zones Controller Web Detection	info
136734	SaltStack Salt Master Detection	info
136355	SaltStack Salt Master Installed (Linux)	info
136318	TLS Version 1.2 Protocol Detection	info
135408	Trend Micro Deep Security Agent Installed (Linux)	info
135255	Palo Alto Default Credentials	critical
135238	Palo Alto Expedition Cross-Site Scripting	medium
135097	Dell EMC Data Protection Central Web Interface Detected	info
135096	Elastic Winlogbeat Installed (Windows)	info
133766	Apache Maven Installed (Linux / Unix)	info
132871	Adobe Experience Manager Web Detection	info
132771	Palo Alto Cortex XSOAR Installed (Unix / Linux)	info
132584	Palo Alto Expedition Web Detection	info
131566	Atlassian Jira Installed (Unix / Linux)	info
131287	Zebra ZTC Printer Web Interface Detection	info
131081	Tenable Core Web Interface Detection	info
130595	Jenkins Installed (Linux)	info
130456	Harbor Local Detection	info
129979	Harbor Web Interface Detection	info
129590	Cisco HyperFlex Web API Detection	info
129386	JIRA Service Desk Installed (Linux)	info
128037	OpenGear Web Detection	info
127858	Apple AirPlay Web Detection	info
125777	Commvault Web Console Detection	info
125311	Symantec Content Analysis Web Detection	info
125310	Symantec Content Analysis Local Detection	info
124697	Symantec Management Center Web Detection	info

Detections

Analytics

Service detection Family for Nessus

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

high

info

info

info

info

info

info

info

info

info

info

info

critical

medium

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info