Version information for Symantec Content Analysis, formerly Blue Coat  Content Analysis, was retrieved from the remote host.

The web interface for Symantec Management Center, formerly Blue Coat Management Center, was detected on the remote web host. This detection covers v2.1 and up.

Note that Nessus attempts to retrieve the version information without credentials. If HTTP Basic credentials are given then an attempt to retrieve the version from the REST API will be performed first.

The web interface for Symantec Reporter was detected on the remote host.

Oracle MySQL connectors, drivers for connecting to MySQL databases, are available on the remote Linux host.

Note: Thorough tests may be required for an in-depth search of all connectors.

The Docker service running on the remote host has an exposed remote API. When Docker is configured in this manner an unauthenticated remote attacker could perform administrative Docker commands.

By identifying the command port, it was possible to detect that the remote host is a wireless presentation hardware device.

The web interface for a Grandstream Networking Solutions device, such as a router or wireless access point, was detected on the remote host.

A web server is running Python on the remote host.

Note that the web server may be running on top of Python, or just running an embedded version.

A Goverlan agent for remote control is installed on the remote host.

Ansible, an IT automation and management application, was found on the remote host.

Ansible AWX, an open-source IT automation and management application, was found on the remote host.

Splashtop Streamer, a remote control service, is installed on the remote host. 

Note: Splashtop default ports (6783, 6784, 6785) are not included in the default scan ports, and should be specified manually in the Nessus port scan range.

The web API for Kubernetes was detected on the remote host.

Oracle WebLogic Web services test client was detected on the remote host.

The web interface for HP DesignJet Printer was detected on the remote host.

TeamViewer, a remote control service, is installed on the remote Windows host.

The remote service accepts connections encrypted using TLS 1.1.
TLS 1.1 lacks support for current and recommended cipher suites.
Ciphers that support encryption before MAC computation, and authenticated encryption modes such as GCM cannot be used with TLS 1.1

As of March 31, 2020, Endpoints that are not enabled for TLS 1.2 and higher will no longer function properly with major web browsers and major vendors.

Rancher, a Kubernetes management platform, was detected based on the local Docker images available in the host.

Rancher, a Kubernetes management platform, was detected based on the web interface.

Flask, a micro web framework written in Python, is installed on the remote Linux host.

Nessus was able to detect the QLogic QConvergeConsole web interface  for a network interface management tool on the remote host.

Ansible Tower, an IT automation and management application, was found on the remote host.

Kubernetes, an open source system for managing containerized applications across multiple hosts, is installed on the remote Linux host.

The remote host is running Isilon OneFS, a NAS managment software.

The remote host is running an Apache Zookeeper server.

The remote host is running the WebLogic t3 Protocol.

Oracle WebLogic, a Java EE application server, was detected on the remote host.

The remote host is running an OpenVPN server. Based on its responses, the remote host appears to be in unauthenticated mode. This means that the tunnel is unencrypted and authentication is disabled.

This plugin checks the docker diff for any running containers that are analyzed by Container Security.
Note that this plugin does not run except through a licensed Container Security account.

The Cisco Smart Install (SMI) feature is enabled on the remote host.
If the SMI Client role enabled, it is subject to protocol misuse, which could allow an unauthenticated, remote attacker to:

  - Substitute the switch's startup-config file with a file that the     attacker prepared and force a reload of the switch after a defined     time interval.

  - Load the attacker-supplied IOS image onto the switch.

  - Execute high-privilege configuration mode CLI commands on the     switch, including do-exec CLI commands.

  - Copy arbitrary files from the switch to the attacker-controlled     TFTP server.

The remote service accepts connections encrypted using TLS 1.0. TLS 1.0 has a number of cryptographic design flaws. Modern implementations of TLS 1.0 mitigate these problems, but newer versions of TLS like 1.2 and 1.3 are designed against these flaws and should be used whenever possible.

As of March 31, 2020, Endpoints that aren’t enabled for TLS 1.2 and higher will no longer function properly with major web browsers and major vendors.

PCI DSS v3.2 requires that TLS 1.0 be disabled entirely by June 30, 2018, except for POS POI terminals (and the SSL/TLS termination points to which they connect) that can be verified as not being susceptible to any known exploits.

The remote device answered a NetworkVideoTransmitter WS-Discovery request. Therefore, it supports ONVIF.

Redis, a document-oriented database system, is running on the remote host.

Oracle GoldenGate Manager, a data integration and replication solution, is running on the remote host.

The RESTful web service for AlienVault Open Source Security Information Management (OSSIM) is running on the remote host.
AlienVault OSSIM is a suite of security tools used to monitor and maintain a network.

Sophos XG Firewall, a next generation multi-protection firewall appliance, is running on the remote host.

IBM Spectrum Protect Mount, a virtual mount application that ships with Spectrum Protect, is running on the remote host.

Note that IBM Spectrum Protect was formerly known as IBM Tivoli Storage Manager (TSM) FastBack.

The remote host is an Apple TV device. Nessus was able to obtain its version and model information via an HTTP request for the '/server-info' resource.

Note that if 'Show potential false alarms' is enabled, this plugin may result in false positives.

The Docker service is running on the remote host. Docker is an open-source project that automates the deployment of applications inside software containers.

TeamSpeak 3, a proprietary Voice over IP (VoIP) conferencing software application, is running on the remote host.

This plugin detects the SAP RMI-P4 Protocol being used on the remote device.

The remote host is running Pgbouncer, a connection pooler service for PostgreSQL. Nessus was able to extract version information by logging into the Pgbouncer administrative console.

PowerFolder, a file sharing and backup utility, is running on the remote server.

A ProRat server was detected on the remote host. ProRat is a remote access trojan, which allows an attacker to control the remote system over the network.

The remote host is running Flexera FlexNet Publisher (formerly FLEXlm), a license management service. FlexNet Publisher is often bundled with third-party software and hardware license management software, and it may be part of a license management solution for a vendor other than Flexera.

ID	Name	Severity
125310	Symantec Content Analysis Local Detection	info
124697	Symantec Management Center Web Detection	info
124568	Symantec Reporter Web Interface Detection	info
124174	Oracle MySQL Connectors Installed (Linux)	info
124029	Docker Remote API Detection	critical
123936	Barco/AWiND WePresent Command Port Detection	info
123463	Grandstream Networking Solutions Device Web Detection	info
122364	Python Remote HTTP Detection	info
122114	Goverlan Agent Remote Detection	info
121575	Ansible Installed (Linux/UNIX)	info
121574	Ansible AWX Installed (Linux/UNIX)	info
121572	Splashtop Streamer remote detection	info
121471	Kubernetes Web API Detection	info
121396	Oracle WebLogic Web Services Test Client Detection	info
121349	HP DesignJet Printer Web Interface Detection	info
121245	TeamViewer remote detection	info
121010	TLS Version 1.1 Protocol Detection	info
119752	Rancher Docker Container Detection (Linux)	info
119613	Rancher Web Interface Detection	info
119602	Python Flask Installed (Linux)	info
118332	QLogic QConvergeConsole GUI Web Interface Detection	info
112215	Ansible Tower Installed (Linux/UNIX)	info
112063	Kubernetes Installed (Linux)	info
111678	Isilon OneFS uname Detection	info
111677	Isilon OneFS SNMP Detection	info
111676	Isilon OneFS NTP Detection	info
111675	Isilon OneFS Web Interface Detection	info
111674	Isilon OneFS FTP Detection	info
110267	Apache Zookeeper Server Detection	info
109552	Oracle WebLogic T3 Protocol Detection	info
109431	Oracle WebLogic SNMP Detection (UDP)	info
109430	Oracle WebLogic SNMP Detection (TCP)	info
107073	Unauthenticated OpenVPN Server Detection	high
106050	Docker Container File Change Detection	info
105161	Cisco Smart Install Detection	info
104743	TLS Version 1.0 Protocol Detection	medium
103869	Open Network Video Interface Forum (ONVIF) Protocol Detection	info
100635	Redis Server Detection	info
100621	Oracle GoldenGate Manager Version Detection	info
100382	AlienVault OSSIM REST API Service Detection	info
96281	Sophos XG Firewall Detection	info
96144	IBM Spectrum Protect Mount Detection	info
93741	Apple TV Version Detection	info
93561	Docker Service Detection	info
93440	TeamSpeak 3 Server Detection	info
93374	SAP RMI-P4 Protocol Detection	info
93007	Pgbouncer Service Detection	info
91817	PowerFolder Server Detection	info
90894	ProRat Detection	critical
90151	Flexera FlexNet Publisher Detection	info

Detections

Analytics

Service detection Family for Nessus

info

info

info

info

critical

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

high

info

info

medium

info

info

info

info

info

info

info

info

info

info

info

info

critical

info