PowerFolder, a file sharing and backup utility, is running on the remote server.

A ProRat server was detected on the remote host. ProRat is a remote access trojan, which allows an attacker to control the remote system over the network.

The remote host is running Flexera FlexNet Publisher (formerly FLEXlm), a license management service. FlexNet Publisher is often bundled with third-party software and hardware license management software, and it may be part of a license management solution for a vendor other than Flexera.

Crestron QM-RMC was detected. Crestron QM-RMC is a device for networking together physical hardware for the purpose of remote control.

The remote service accepts connections encrypted using TLS 1.0. This version of TLS is affected by multiple cryptographic flaws. An attacker can exploit these flaws to conduct man-in-the-middle attacks or to decrypt communications between the affected service and clients.

Gearman, an open source job queuing and processing service, was detected on the remote host.

The remote host is running IBM Spectrum Protect for Workstations, a backup and data protection server. This product was formerly known as IBM Tivoli Storage Manager FastBack.

The remote service provides collaborative-coding and chat platform.

An NTP server is listening on port 123. If not securely configured, it may provide information about its version, current date, current time, and possibly system information.

The rsync server on the host can be remotely written to.

The remote host is running a postfix policyd service.

A Tinc VPN server was detected on the remote host. Tinc is an open source virtual private networking service that can create a secure tunnel between two or more hosts.

The remote host is an HP OfficeJet printer.

The remote host is running a management protocol for HP LeftHand OS (formerly known as SAN/iQ). This management protocol is used for remote administration of storage systems.

The remote device has the NAT-PMP protocol enabled.  This protocol allows any application on the local subnet to request port mappings from the outside to the inside. 

Make sure the use of this service is done in accordance to your security policy.  Letting any application create dynamic mappings is usually not recommended.

The remote device has the NAT-PMP protocol enabled. This protocol may allow any application on an internal subnet to request port mappings from the outside to the inside.

If this service is reachable from the outside your network, it may allow a remote attacker to gain more information about your network and possibly to break into it by creating dynamic port mappings.

The remote host is running a SAProuter server, which is used to proxy requests between SAP systems and performs access control.

The remote service supports MikroTik MAC Telnet Protocol, a proprietary protocol used to remotely administer MikroTik's RouterOS network devices.

The remote service supports MikroTik Neighbor Discovery Protocol (MNDP), used by MikroTik to locate devices in the Layer 2 broadcast domain.

The remote service is a RES Workspace Manager Relay Server.  It communicates with a central database of RES Workspace Manager, a workspace virtualization platform, or another RES Workspace Manager Relay Server and provides caching services to RES Workspace Manager Agents and other RES Workspace Manager Relay Servers.  It is used to reduce load on the RES Workspace Manager central database and improve scalability in all kinds of distributed network topologies.

The remote service is a RES Workspace Manager Agent.  It communicates with a central database of RES Workspace Manager, a workspace virtualization platform, and provides transaction services to the RES Workspace Composer.  It usually indicates that this machine has the RES Workspace Composer installed.  The RES Workspace Composer is the uniform workspace that the end users of the RES Workspace Manager Workspace virtualization platform interact with.

The remote host is running the Juniper NSM GUI Server.  The NSM GUI accepts connections from users using the NSM GUI Client, which allows for administration of the NSM servers.

The remote host is an HP switch. It is possible to read the model, serial number, and/or software version by connecting to the switch via SSH or by using SNMP.

The remote host is running a Poison Ivy client.  Poison Ivy is a Remote Administration Tool (RAT) used to control computers infected by malware. The 'client' is the component used to control those computers.  It is associated with malicious activity.

The memcached interface for Hazelcast, an open source data clustering solution, was detected on the remote host.

The wire protocol for Hazelcast, an open source data clustering solution, was found listening on the remote host.

The remote service understands the Bonjour (also known as ZeroConf or mDNS) protocol, which allows anyone to uncover information from the remote host such as its operating system type and exact version, its hostname, and the list of services it is running. 

This plugin attempts to discover mDNS used by hosts residing on the same network segment as Nessus.

The remote host exposes the ADB (Android Debug Bridge) control port of an Android emulator allowing full, unauthenticated, root access to the emulated Android device.

The Nagios Remote Plugin Executor (NRPE) was detected on the remote host.  This application allows a user to execute Nagios plugins and monitor remote machines.

A document-oriented database system is listening on the remote port.

A Git daemon using the Git protocol is running on the remote host.

This script checks the remote VNC server protocol version and the available 'security types' to determine if any unencrypted 'security-types' are in use or available.

The CXML service for EMC Data Protection Advisor, an automated analysis and alerting system for backup and replication infrastructure, was detected on the remote host.

One of the network services provided by the hydra daemon was detected on the remote host. This daemon runs on the HP LeftHand OS (formerly SAN/iQ) and is used in products such as the HP Virtual SAN appliance.
This service is used for management and control.

The HP LeftHand OS (formerly SAN/iQ) console discovery service, used by systems such as the HP Virtual SAN Appliance, is running on the remote host. This service allows management applications to discover storage nodes.

VMware vCenter is running on the remote host. It is an enterprise- grade computer virtualization product from VMware, Inc.

The remote host seems to be enabled to do Internet Key Exchange (IKE).
This is typically indicative of a VPN server. VPN servers are used to connect remote hosts into internal resources.

Make sure that the use of this VPN endpoint is done in accordance with your corporate security policy.

Note that if the remote host is not configured to allow the Nessus host to perform IKE/IPSEC negotiations, Nessus won't be able to detect the IKE service.

Also note that this plugin does not run over IPv6.

The remote host is running Erlang Port Mapper Daemon, which acts as a name server on all hosts involved in distributed Erlang computations.

The remote host is running an AMQP server, which provides messaging and queuing services for other applications.

The remote service is an EMC AutoStart ftAgent, which manages AutoStart defined resources.  ftAgent is a component of the EMC AutoStart, a software product to provide high availability service to enterprise applications.

The remote port is used by Winbox, a remote management tool, to administer devices running MikroTik RouterOS.

A Java Debug Wire Protocol (JDWP) server was detected on the remote host.  This is a network protocol that allows debugging of a remote Java virtual machine.  Authentication is not required to access this service.  A remote, unauthenticated attacker could connect to this service and execute arbitrary Java code.

Depending on the application being debugged, it is possible that this service will stop running after it has been detected by Nessus. As such, this plugin only runs if 'Safe checks' have been disabled.

The remote host is a printer that allows information to be obtained via PJL.

The remote service supports BJNP, a proprietary USB over IP network printing protocol from Canon.

The remote service is an EMC SMARTS application server.  It's used in various EMC Ionix products.  It's also used as the Fault Device Manager broker (brstart.exe) in Cisco Unified Service Monitor, Cisco Unified Operations Manager, and CiscoWorks LAN Management Solution. In addition, Cisco Device Fault Manager server (sm_server.exe) and Voice Health Monitor server (sm_server.exe) are seen to implement this service.

This plugin attempts to collect the banner from services listening on well-known SMTP ports.  It is not expected to report anything.

The remote service is a signon server for an IBM iSeries system.

CmdProcessor.exe is one of the processes spawned by the Trend Micro Control Manager.  It's responsible for sending XML instructions, formed by other processes, to managed products and processing product registration.  It also sends alerts, performs scheduled tasks, and applies Outbreak Prevention Policies. 

By sending a request to CmdProcessor.exe, which is listening on the default port 20101, the process can be detected.

The lockdown service, part of Apple iOS, was detected on the remote host.  This service is used to communicate with iOS devices for several tasks (e.g., Wi-Fi sync). 

Note that this plugin will only work against devices that have ever had Wi-Fi sync enabled (iOS versions 5 and later).

ID	Name	Severity
91817	PowerFolder Server Detection	info
90894	ProRat Detection	critical
90151	Flexera FlexNet Publisher Detection	info
87597	Crestron QM-RMC Service Detection	info
84470	TLS Version 1.0 Protocol Detection (PCI DSS)	high
83465	Gearman Server Detection	info
83300	IBM Tivoli Storage Manager FastBack Server Detection	info
83139	sobby Server Detection	info
10884	Network Time Protocol (NTP) Server Detection	info
78428	rsync Writeable Module Detection	info
78083	Postfix Policyd Protocol Detection	info
76255	Tinc VPN Service Detection	info
74268	HP OfficeJet Printer Detection	info
73460	HP LeftHand OS Management Protocol Detection	info
73125	NAT-PMP Detection (local network)	info
73124	NAT-PMP Detection (remote network)	high
72262	SAProuter Detection	info
71175	MikroTik MAC Telnet Protocol Detection	info
71077	MikroTik Neighbor Discovery Protocol Detection	info
70291	RES Workspace Manager Relay Server Detection	info
70290	RES Workspace Manager Agent Detection	info
69870	Juniper NSM GUI Server Detection	info
69322	HP Switch Identification	info
69320	Poison Ivy Detection	info
67023	Hazelcast Memcached Interface Detection	info
67022	Hazelcast Wire Protocol Detection	info
66717	mDNS Detection (Local Network)	info
66382	Android Emulator ADB Port on Remote Host	high
66360	Nagios NRPE Plugin Detect	info
65914	MongoDB Detection	info
65822	Git Protocol Detection	info
65792	VNC Server Unencrypted Communication Detection	info
64701	EMC Data Protection Advisor CXML Service Detection	info
64632	HP LeftHand OS hydra Detection	info
64631	HP LeftHand OS Console Discovery Detection	info
63061	VMware vCenter Detect	info
62695	IPSEC Internet Key Exchange (IKE) Version 2 Detection	info
62351	Erlang Port Mapper Daemon Detection	info
62349	Advanced Message Queuing Protocol Detection	info
61489	EMC AutoStart ftAgent Detection	info
59731	MikroTik RouterOS Winbox Detection	info
58400	Java Debug Wire Protocol Detection	high
60030	Apple Profile Manager Detection	info
58184	HP Printer PJL Interface Detection	info
58147	BJNP Detection	info
58003	EMC SMARTS Application Server Detection	info
57914	Service Detection : SMTP Server on a Well-Known Port	info
57847	IBM iSeries Server Detection	info
57764	Trend Micro Control Manager CmdProcessor.exe Detection	info
57461	Apple iOS Lockdown Detection	info

Detections

Analytics

Service detection Family for Nessus

info

critical

info

info

high

info

info

info

info

info

info

info

info

info

info

high

info

info

info

info

info

info

info

info

info

info

info

high

info

info

info

info

info

info

info

info

info

info

info

info

info

high

info

info

info

info

info

info

info

info