NVIDIA GeForce Experience, a companion application for NVIDIA graphics cards, is installed on the remote Windows host.

The version of NVIDIA GeForce Experience installed on the remote Windows host is prior to 3.20.2. It is, therefore, affected by a privilege escalation vulnerability. An attacker with local system access may be able to exploit this, by corrupting a system file, to gain privileged or administrator access to the system.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Adobe Illustrator CC on the remote Windows hosts is prior to 24.0.2. It is, therefore, affected multiple memory corruption vulnerabilities which could lead to arbitrary code execution on the remote host. An unauthenticated, local attacker could exploit these issues to execute arbitrary commands on the host.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 79.0.3945.130. It is, therefore, affected by multiple vulnerabilities as referenced in the 2020_01_stable-channel-update-for-desktop_16 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Microsoft ASP.NET Core installation on the remote host is version 2.1.x < 2.1.15, 3.0.x < 3.0.2, or 3.1.x < 3.1.1.
It is, therefore, affected by multiple vulnerabilities:

  - A denial of service vulnerability exists when ASP.NET Core improperly handles web requests. An attacker who     successfully exploited this vulnerability could cause a denial of service against an ASP.NET Core web application.
    The vulnerability can be exploited remotely, without authentication. A remote unauthenticated attacker could     exploit this vulnerability by issuing specially crafted requests to the ASP.NET Core application. (CVE-2020-0602)

  - A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in     memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the     current user. If the current user is logged on with administrative user rights, an attacker could take control of     the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts     with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less     impacted than users who operate with administrative user rights. (CVE-2020-0603)

The Microsoft .NET Core SDK installation on the remote host is version 2.1.x < 2.1.511 or 2.1.608, 3.0.x < 3.0.102, or 3.1.x < 3.1.101. It is, therefore, affected by multiple vulnerabilities:

  - A denial of service vulnerability exists when ASP.NET Core improperly handles web requests. An attacker who     successfully exploited this vulnerability could cause a denial of service against an ASP.NET Core web application.
    The vulnerability can be exploited remotely, without authentication. A remote unauthenticated attacker could     exploit this vulnerability by issuing specially crafted requests to the ASP.NET Core application. (CVE-2020-0602)

  - A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in     memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the     current user. If the current user is logged on with administrative user rights, an attacker could take control of     the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts     with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less     impacted than users who operate with administrative user rights. (CVE-2020-0603)

  - A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of     a file. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the     current user. If the current user is logged on with administrative user rights, an attacker could take control of     the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts     with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less     impacted than users who operate with administrative user rights. (CVE-2020-0605, CVE-2020-0606)

The Microsoft .NET Core installation on the remote host is version 3.0.x < 3.0.2 or 3.1.x < 3.1.1. It is, therefore, affected by multiple vulnerabilities:

  - A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of     a file. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the     current user. If the current user is logged on with administrative user rights, an attacker could take control of     the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts     with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less     impacted than users who operate with administrative user rights. (CVE-2020-0605, CVE-2020-0606)

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 7 Update 251, 8 Update 241, 11 Update 6, or 13 Update 2. It is, therefore, affected by multiple vulnerabilities:

  - Oracle Java SE and Java SE Embedded are prone to a severe division by zero, over 'Multiple' protocol.
    This issue affects the 'SQLite' component.(CVE-2019-16168)

  - Oracle Java SE and Java SE Embedded are prone to format string vulnerability, leading to a read     uninitialized stack data over 'Multiple' protocol. This issue affects the 'libxst' component.
    (CVE-2019-13117, CVE-2019-13118)

  - Oracle Java SE and Java SE Embedded are prone to a remote security vulnerability. An unauthenticated     remote attacker can exploit this over 'Kerberos' protocol. This issue affects the 'Security' component.
    (CVE-2020-2601, CVE-2020-2590)

  - Oracle Java SE/Java SE Embedded are prone to a remote security vulnerability. An unauthenticated     remote attacker can exploit this overmultiple protocols. This issue affects the 'Serialization' component.
    (CVE-2020-2604, CVE-2020-2583)

  - Oracle Java SE/Java SE Embedded are prone to a remote security vulnerability. Tn unauthenticated     remote attacker can exploit this over multiple protocols. This issue affects the 'Networking' component.
    (CVE-2020-2593, CVE-2020-2659)

  - Oracle Java SE are prone to a remote security vulnerability. An unauthenticated remote attacker can exploit     this over multiple protocols. This issue affects the 'Libraries' component. (CVE-2020-2654)

  - Oracle Java SE are prone to a multiple security vulnerability. An unauthenticated remote attacker can exploit     this over multiple protocols. This issue affects the 'JavaFX' component. (CVE-2020-2585)

  - Oracle Java SE are prone to a multiple security vulnerability. An unauthenticate remote attacker can exploit     this over 'HTTPS' protocols. This issue affects the 'JSSE' component. (CVE-2020-2655)

Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle Business Intelligence Publisher running on the remote host is 11.1.1.9.x prior to 11.1.1.9.200114 or 12.2.1.3.x prior to 12.2.1.3.200114 or 12.2.1.4.x prior to 12.2.1.4.200114. It is, therefore, affected by  multiple vulnerabilities as noted in the January 2020 Critical Patch Update advisory:

  - An unspecified vulnerability in the Analytics Server     and Analytics Web General (OpenSSL)) component of Oracle BI     Publisher. The vulnerability could allow an     unauthenticated attacker with network access via HTTPS     to compromise Oracle BI Publisher. A successful attack     could result in unauthorized access to critical data     or complete access to all Oracle Business Intelligence     Enterprise Edition accessible data. (CVE-2019-1559)     
  - An unspecified vulnerability in the BI Platform Security)     component of Oracle BI Publisher. The vulnerability could     allow an unauthenticated attacker with network access via     HTTPS to compromise Oracle BI Publisher. A successful     attack would require human interaction from a person other     than the attacker resulting in unauthorized read access to     a subset of Oracle BI Publisher accessible data.
    (CVE-2020-2531)

  - An unspecified vulnerability in the Analytics Server)     component of Oracle BI Publisher. An easy to exploit     vulnerability could allow an unauthenticated attacker with     network access via HTTP to compromise Oracle BI Publisher.
    A successful attack would require human interaction from a     person other than the attacker resulting in unauthorized     read access to a subset of Oracle BI Publisher accessible     data.(CVE-2020-2535)

  - An unspecified vulnerability in the Analytics Actions)     component of Oracle BI Publisher. An easy to exploit     vulnerability could allow an unauthenticated attacker with     network access via HTTP to compromise Oracle BI Publisher.
    A successful attack would require human interaction from a     person other than the attacker resulting in unauthorized     read access to a subset of Oracle BI Publisher accessible     data and unauthorized ability to cause a partial denial of     service (partial DOS) of Oracle Business Intelligence     Enterprise Edition. (CVE-2020-2537)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 68.4.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-04 advisory.

  - During the initialization of a new content process, a     pointer offset can be manipulated leading to memory     corruption and a potentially exploitable crash in the     parent process. *Note: this issue only occurs on     Windows. Other operating systems are unaffected.*. This     vulnerability affects Thunderbird < 68.4. (CVE-2019-17015)

  - When pasting a <style> tag from the clipboard into     a rich text editor, the CSS sanitizer incorrectly     rewrites a @namespace rule. This could allow for     injection into certain types of websites resulting in     data exfiltration. This vulnerability affects     Thunderbird < 68.4. (CVE-2019-17016)

  - Due to a missing case handling object types, a type     confusion vulnerability could occur, resulting in a     crash. We presume that with enough effort that it could     be exploited to run arbitrary code. This vulnerability     affects Thunderbird < 68.4. (CVE-2019-17017)

  - During the initialization of a new content process, a     race condition occurs that can allow a content process     to disclose heap addresses from the parent process.
    *Note: this issue only occurs on Windows. Other     operating systems are unaffected.*. This vulnerability     affects Thunderbird < 68.4. (CVE-2019-17021)

  - When pasting a <style> tag from the clipboard into     a rich text editor, the CSS sanitizer does not escape     < and > characters. Because the resulting string     is pasted directly into the text node of the element     this does not result in a direct injection into the     webpage; however, if a webpage subsequently copies the     node's innerHTML, assigning it to another innerHTML,     this would result in an XSS vulnerability. Two WYSIWYG     editors were identified with this behavior, more may     exist. This vulnerability affects Thunderbird < 68.4.
    (CVE-2019-17022)

    Mozilla developers Jason Kratzer, Christian Holler, and     Bob Clary reported memory safety bugs present in     Thunderbird 68.3. Some of these bugs showed evidence of     memory corruption and we presume that with enough effort     some of these could have been exploited to run arbitrary     code. (CVE-2019-17024)

  - Incorrect alias information in IonMonkey JIT compiler for     setting array elements could lead to a type confusion. We     are aware of targeted attacks in the wild abusing this flaw.
    (CVE-2019-17026)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The VMware Horizon View Agent installed on the remote host is 7.x prior to 7.5.4, 7.10.1, or 7.11.0. It is, therefore, affected by a DLL hijacking vulnerability due to insecure loading of a DLL by Cortado Thinprint. An authenticated, local attacker with normal user privileges can exploit this to escalate their privileges to administrator on a Windows machine where View Agent is installed.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Cisco WebEx Network Recording Player and Cisco Webex Player installed on the remote host is affected by arbitrary code execution vulnerabilities due to insufficient validation of certain elements with a Webex recording stored in either the Advanced Recording Format (ARF) or the Webex Recording Format (WRF). An unauthenticated, remote attacker can exploit these, by sending a user a malicious ARF or WRF file through a link or email attachment and persuading the user to open the file with the affected software on a local system, in order to execute arbitrary code on the affected system with the privileges of the targeted user. 

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 79.0.3945.117. It is, therefore, affected by multiple vulnerabilities as referenced in the 2020_01_stable-channel-update-for-desktop advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote Windows host is prior to 72.0.1.
 It is, therefore, affected by the vulnerability as referenced in the mfsa2020-03 advisory.

  - Incorrect alias information in IonMonkey JIT compiler     for setting array elements could lead to a type     confusion. We are aware of targeted attacks in the wild     abusing this flaw. (CVE-2019-17026)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote Windows host is prior to 68.4.1.  It is, therefore, affected by the vulnerability as referenced in the mfsa2020-03 advisory.

  - Incorrect alias information in IonMonkey JIT compiler     for setting array elements could lead to a type     confusion. We are aware of targeted attacks in the wild     abusing this flaw. (CVE-2019-17026)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote Windows host is prior to 68.4. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-02 advisory.

  - During the initialization of a new content process, a     pointer offset can be manipulated leading to memory     corruption and a potentially exploitable crash in the     parent process. Note: this issue only occurs on     Windows. Other operating systems are unaffected.
    (CVE-2019-17015)

  - When pasting a <style> tag from the     clipboard into a rich text editor, the CSS sanitizer     incorrectly rewrites a @namespace rule. This could allow     for injection into certain types of websites resulting     in data exfiltration. (CVE-2019-17016)

  - Due to a missing case handling object types, a type     confusion vulnerability could occur, resulting in a     crash. We presume that with enough effort that it could     be exploited to run arbitrary code. (CVE-2019-17017)

  - During the initialization of a new content process, a     race condition occurs that can allow a content process     to disclose heap addresses from the parent process.
    Note: this issue only occurs on Windows. Other     operating systems are unaffected. (CVE-2019-17021)

  - When pasting a <style> tag from the     clipboard into a rich text editor, the CSS sanitizer     does not escape < and > characters. Because the     resulting string is pasted directly into the text node     of the element this does not result in a direct     injection into the webpage; however, if a webpage     subsequently copies the node's innerHTML, assigning it     to another innerHTML, this would result in an XSS     vulnerability. Two WYSIWYG editors were identified with     this behavior, more may exist. (CVE-2019-17022)

  - Mozilla developers Jason Kratzer, Christian Holler, and     Bob Clary reported memory safety bugs present in Firefox     71 and Firefox ESR 68.3. Some of these bugs showed     evidence of memory corruption and we presume that with     enough effort some of these could have been exploited to     run arbitrary code. (CVE-2019-17024)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote Windows host is prior to 72.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-01 advisory, including the following:

  - During the initialization of a new content process, a pointer offset can be manipulated leading to     memory corruption and a potentially exploitable crash in the parent process. (CVE-2019-17015)

  - When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly     rewrites a @namespace rule. This could allow for injection into certain types of websites resulting in     data exfiltration. (CVE-2019-17016)

  - Due to a missing case handling object types, a type confusion vulnerability could occur, resulting in a     crash. We presume that with enough effort that it could be exploited to run arbitrary code.
    (CVE-2019-17017)

  - When in Private Browsing Mode on Windows 10, the Windows keyboard may retain word suggestions to improve     the accuracy of the keyboard. (CVE-2019-17018)

  - When Python was installed on Windows, a python file being served with the MIME type of text/plain could     be executed by Python instead of being opened as a text file when the Open option was selected upon     download. (CVE-2019-17019)

  - If an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the     Content Security Policy will not be applied to the contents of the XSL stylesheet. If the XSL sheet e.g.
    includes JavaScript, it would bypass any of the restrictions of the Content Security Policy applied to     the XML document. (CVE-2019-17020)

  - During the initialization of a new content process, a race condition occurs that can allow a content     process to disclose heap addresses from the parent process. (CVE-2019-17021)

  - When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer does not escape     < and > characters. Because the resulting string is pasted directly into the text node of the element     this does not result in a direct injection into the webpage; however, if a webpage subsequently copies     the node's innerHTML, assigning it to another innerHTML, this would result in an XSS vulnerability. Two     WYSIWYG editors were identified with this behavior, more may exist. (CVE-2019-17022)     
  - After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3,     resulting in an invalid state transition in the TLS State Machine. If the client gets into this state,     incoming Application Data records will be ignored. (CVE-2019-17023)

  - Mozilla developers Jason Kratzer, Christian Holler, and Bob Clary reported memory safety bugs present in     Firefox 71 and Firefox ESR 68.3. Some of these bugs showed evidence of memory corruption and we presume     that with enough effort some of these could have been exploited to run arbitrary code. (CVE-2019-17024)

  - Mozilla developers Karl Tomlinson, Jason Kratzer, Tyson Smith, Jon Coppeard, and Christian Holler     reported memory safety bugs present in Firefox 71. Some of these bugs showed evidence of memory     corruption and we presume that with enough effort some of these could have been exploited to run     arbitrary code. (CVE-2019-17025)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of the Foxit 3D plugin installed on the remote Windows host is prior to 9.7.0.29430. It is, therefore affected by a NULL pointer dereference flaw due to improper validation of image data when parsing certain files with incorrect image information. An unauthenticated, remote attacker can exploit this, by convincing a user into opening a specially crafted image, to cause a denial of service condition when the application attempts to read or write memory with a NULL pointer.

U3DBrowser Plugin, a Foxit Reader and PhantomPDF plugin that allows viewing embedded 3D annotations in PDF files, is installed on the remote Windows host.

The version of Apple iTunes installed on the remote Windows host is prior to 12.10.3. It is, therefore, affected by multiple vulnerabilities as referenced in the HT210793 advisory.

  - In libexpat before 2.2.8, crafted XML input could fool     the parser into changing from DTD parsing to document     parsing too early; a consecutive call to     XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber)     then resulted in a heap-based buffer over-read.
    (CVE-2019-15903)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version, the IBM MQ server installed on the remote host is 8.0.x prior to 8.0.0.13, 9.0.x prior to 9.0.0.8, 9.1.0.x LTS prior to 9.1.0.4 LTS, or 9.1.4 CD and is therefore affected by an unspecified flaw related to channels handling that can allow denial of service.

The remote host has not properly mitigated a series of known speculative execution vulnerabilities. It, therefore, may be affected by :
  - Branch Target Injection (BTI) (CVE-2017-5715)
  - Bounds Check Bypass (BCB) (CVE-2017-5753)
  - Rogue Data Cache Load (RDCL) (CVE-2017-5754)
  - Rogue System Register Read (RSRE) (CVE-2018-3640)
  - Speculative Store Bypass (SSB) (CVE-2018-3639)
  - L1 Terminal Fault (L1TF) (CVE-2018-3615, CVE-2018-3620, CVE-2018-3646)
  - Microarchitectural Data Sampling Uncacheable Memory (MDSUM) (CVE-2019-11091)
  - Microarchitectural Store Buffer Data Sampling (MSBDS) (CVE-2018-12126)
  - Microarchitectural Load Port Data Sampling (MLPDS) (CVE-2018-12127)
  - Microarchitectural Fill Buffer Data Sampling (MFBDS) (CVE-2018-12130)
  - TSX Asynchronous Abort (TAA) (CVE-2019-11135)

The version of Google Chrome installed on the remote Windows host is prior to 79.0.3945.88. It is, therefore, affected by a vulnerability as referenced in the 2019_12_stable-channel-update-for-desktop_17 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Adobe Reader installed on the remote Windows host is a version prior or equal to 2015.006.30505, 2017.011.30152, or 2019.021.20056. It is, therefore, affected by multiple vulnerabilities. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Adobe Acrobat installed on the remote Windows host is a version prior or equal to 2015.006.30505, 2017.011.30152, or 2019.021.20056. It is, therefore, affected by multiple vulnerabilities. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Steam Client has been detected on the remote Windows host.

The version of Adobe Photoshop CC installed on the remote Windows host is prior to 20.0.8 (2019.0.8), 21.0.2 (2020.0.2).
It is, therefore, affected by multiple unspecified memory corruption vulnerabilities exist. An attacker can exploit this to execute arbitrary code.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Adobe ColdFusion installed on the remote Windows host is prior to 2018.x update 7. It is, therefore, affected by a vulnerability as referenced in the APSB19-58 advisory.

  - Insecure inherited permissions of default installation     directory potentially leading to Privilege Escalation     (CVE-2019-8256)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 68.3. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-38 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 79.0.3945.79. It is, therefore, affected by multiple vulnerabilities as referenced in the 2019_12_stable-channel-update-for-desktop advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Wireshark installed on the remote Windows host is prior to 2.6.13. It is, therefore, affected by a vulnerability as referenced in the wireshark-2.6.13 advisory.

  - The CMS dissector could crash. It may be possible to     make Wireshark crash by injecting a malformed packet     onto the wire or by convincing someone to read a     malformed packet trace file. (CVE-2019-19553)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Wireshark installed on the remote Windows host is prior to 3.0.7. It is, therefore, affected by a vulnerability as referenced in the wireshark-3.0.7 advisory.

  - The CMS dissector could crash. It may be possible to     make Wireshark crash by injecting a malformed packet     onto the wire or by convincing someone to read a     malformed packet trace file. (CVE-2019-19553)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Foxit Studio Photo application installed on the remote Windows host is affected by an out-of-bounds read error in the preview creation of EPS files due to improper validation of user-supplied              data. An unauthenticated, remote attacker can exploit this, to disclose potentially sensitive information or cause the application to stop responding.

According to its self-reported version, the Foxit Studio Photo application installed on the remote Windows host is affected by multiple vulnerabilities: 

  - An out-of-bounds read error exist in the TIF file handler when processing InkNames of TIFFSetField due to     improper validation of user-supplied data. An unauthenticated, remote attacker can exploit this, by     convincing a user to open a specially crafted file to execute arbitrary code in the context of the current     process.

  - An out-of-bounds write error exists in the TIF file handler due to improper validation of user-supplied     data. An unauthenticated, remote attacker can exploit this, by convincing a user to open a specially     crafted file to execute arbitrary code in the context of the current process or cause the application to     stop responding.

  - An out-of-bounds read error exists in the EPS file handler due to improper validation of user-supplied     data. An unauthenticated, remote attacker can exploit this, by convincing a user to open a specially     crafted file to disclose potentially sensitive information or cause the application to stop responding.

Adobe Media Encoder, software for working with multimedia files, was found on the remote Windows host.

The remote Windows host is running a version of Microsoft Windows Admin Center that is missing a security update. It is, therefore, affected by an elevation of privilege vulnerability due to improper impersonating of operations in certain situations. An unauthenticated, remote attacker can exploit this issue to gain privileged or administrator access to the system.

The version of Firefox installed on the remote Windows host is prior to 71.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-36 advisory.

  - When encrypting with a block cipher, if a call to     NSC_EncryptUpdate was made with data smaller than the block     size, a small out of bounds write could occur. This could     have caused heap corruption and a potentially exploitable     crash. (CVE-2019-11745)

  - Improper refcounting of soft token session objects could     cause a use-after-free and crash (likely limited to a denial     of service). (CVE-2019-11756)

  - When setting a thread name on Windows in WebRTC, an     incorrect number of arguments could have been supplied,     leading to stack corruption and a potentially exploitable     crash.
    Note: this issue only occurs on Windows. Other operating     systems are unaffected. (CVE-2019-13722)

  - When using nested workers, a use-after-free could occur     during worker destruction. This resulted in a potentially     exploitable crash. (CVE-2019-17008)

  - When running, the updater service wrote status and log     files to an unrestricted location; potentially allowing     an unprivileged process to locate and exploit a     vulnerability in file handling in the updater service.
  - Note: This attack requires local system access and only     affects Windows. Other operating systems are not affected.
    (CVE-2019-17009)

  - Under certain conditions, when checking the Resist     Fingerprinting preference during device orientation checks,     a race condition could have caused a use-after-free and a     potentially exploitable crash. (CVE-2019-17010)

  - Under certain conditions, when retrieving a document from     a DocShell in the antitracking code, a race condition     could cause a use-after-free condition and a potentially     exploitable crash. (CVE-2019-17011)

  - Mozilla developers Christoph Diehl, Nathan Froyd, Jason     Kratzer, Christian Holler, Karl Tomlinson, Tyson Smith     reported memory safety bugs present in Firefox 70 and     Firefox ESR 68.2. Some of these bugs showed evidence of     memory corruption and we presume that with enough effort     some of these could have been exploited to run arbitrary code.
    (CVE-2019-17012)

  - Mozilla developers and community members Philipp, Diego     Calleja, Mikhail Gavrilov, Jason Kratzer, Christian     Holler, Markus Stange, Tyson Smith reported memory safety     bugs present in Firefox 70. Some of these bugs showed     evidence of memory corruption and we presume that with     enough effort some of these could have been exploited to     run arbitrary code. (CVE-2019-17013)

  - If an image had not loaded correctly (such as when it is     not actually an image), it could be dragged and dropped     cross-domain, resulting in a cross-origin information leak.
    (CVE-2019-17014)     Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote Windows host is prior to 68.3. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-37 advisory, including the following:

  - When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the     block size, a small out of bounds write could occur. This could have caused heap corruption and a     potentially exploitable crash. (CVE-2019-11745)

  - When using nested workers, a use-after-free could occur during worker destruction. This resulted in a     potentially exploitable crash. (CVE-2019-17008)

  - Mozilla developers Christoph Diehl, Nathan Froyd, Jason Kratzer, Christian Holler, Karl Tomlinson, Tyson     Smith reported memory safety bugs present in Firefox 70 and Firefox ESR 68.2. Some of these bugs showed     evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. (CVE-2019-17012)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Symantec Critical System Protection (SCSP) installed on the remote Windows host is 8.0 prior to 8.0 MP2. It is, therefore, affected by an unspecified authentication bypass vulnerability.

The version of Google Chrome installed on the remote Windows host is prior to 73.0.3683.103. It is, therefore, affected by an heap corruption vulnerability as referenced in the 2019_04_stable-channel-update-for-desktop advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Sophos Anti-Virus, a commercial antivirus software package for Windows, is installed on the remote host.

The version of Microsoft Visual Studio Code installed on the remote Windows host is prior to 1.39.1. It is, therefore, affected by the following vulnerability:

  - An elevation of privilege vulnerability exists in Visual Studio Code when it exposes a debug listener to     users of a local computer. A local attacker who successfully exploited the vulnerability could inject     arbitrary code to run in the context of the current user. If the current user is logged on with     administrative user rights, an attacker could take control of the affected system. An attacker could then     install programs; view, change, or delete data; or create new accounts with full user rights.

Windows Admin Center, a browser-based management platform, is installed on the remote Windows host.

Foxit Studio Photo has been detected on the remote Windows host.

The remote host is running a version of Fortinet FortiClient prior to 6.2.0. It is, therefore, affected by an information disclosure man-in-the-middle vulnerability in the FortiGuard services communication protocol due to the use of a hardcoded cryptographic key. A remote attacker with knowledge of the hardcoded key can exploit this via the network to eavesdrop and modify information sent and received from FortiGuard servers.

The version of Symantec Endpoint Protection (SEP) Client installed on the remote host is 12.x prior to 12.1.7454.7000 or 14.x prior to 14.2.5323.2000.  It is, therefore, affected by multiple vulnerabilities.

  - An authentication bypass vulnerability exists in the second layer     of password protection. An authenticated, local attacker can     exploit this to bypass authentication and execute arbitrary     actions with local administrator privileges. (CVE-2019-12756)

  - A privilege escalation vulnerability exists. An unauthenticated,     local attacker can exploit this to gain privileged access to the     system. (CVE-2019-12757, CVE-2019-18372)

  - A remote command execution vulnerability exists due to an unsigned     code execution vulnerability. An unauthenticated, remote attacker     can exploit this to execute code without a resident proper digital     signature. (CVE-2019-12758)   Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version, Cisco Webex Teams is affected by a DLL hijacking vulnerability. An authenticated, local attacker can exploit this, by crafting a malicious DLL file and placing it in a specific location, to execute arbitrary code on the target machine with the privileges of another user account. Please refer to the Cisco BIDs and Cisco Security Advisory for more information.

Atlassian JIRA, issue tracking software, was detected on the remote Windows host.

According to its version, the Foxit PhantomPDF application (formally known as Phantom) installed on the remote Windows host is prior to 9.7. It is, therefore affected by  multiple vulnerabilities: Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 78.0.3904.108. It is, therefore, affected by multiple vulnerabilities as referenced in the 2019_11_stable-channel-update-for-desktop_18 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Severity
133059	NVIDIA GeForce Experience Installed	Info
133058	NVIDIA GeForce Experience < 3.20.2 Local Privilege Escalation Vulnerability	Medium
133056	Adobe Illustrator CC < 24.0.2 Multiple Vulnerabilites (APSB20-03)	Critical
133053	Google Chrome < 79.0.3945.130 Multiple Vulnerabilities	Medium
133049	Security Update for Microsoft ASP.NET Core (January 2020)	Medium
132994	Security Update for .NET Core SDK (January 2020)	High
132993	Security Update for .NET Core (January 2020)	High
132992	Oracle Java SE 1.7.0_251 / 1.8.0_241 / 1.11.0_6 / 1.13.0_2 Multiple Vulnerabilities (Jan 2020 CPU)	Medium
132991	Oracle Business Intelligence Publisher Multiple Vulnerabilities (Jan 2020 CPU)	High
132774	Mozilla Thunderbird < 68.4.1	Medium
132753	VMware Horizon View Agent 7.x < 7.5.4 / 7.10.1 / 7.11.0 Privilege Escalation (VMSA-2019-0023)	Medium
132718	Cisco Webex Network Recording Player and Cisco Webex Player (cisco-sa-20191106-webex-player)	High
132717	Google Chrome < 79.0.3945.117 Multiple Vulnerabilities	Medium
132715	Mozilla Firefox < 72.0.1	High
132714	Mozilla Firefox ESR < 68.4.1	High
132711	Mozilla Firefox ESR < 68.4 Multiple Vulnerabilities	Medium
132709	Mozilla Firefox < 72.0 Multiple Vulnerabilities	Medium
132633	Foxit 3D Plugin Beta 9.7.0.29430 NULL Pointer Dereference Vulnerability	High
132586	Foxit 3D Plugin (U3DBrowser) Installed (Windows)	Info
132416	Apple iTunes < 12.10.3 Multiple Vulnerabilities (credentialed check)	Medium
132341	IBM MQ < 8.0.0.13 / 9.0.0.8 LTS / 9.1.0.4 LTS / 9.1.4 CD Channels DoS (CVE-2019-4560)	Medium
132101	Windows Speculative Execution Configuration Check	Medium
132097	Google Chrome < 79.0.3945.88 Vulnerability	Medium
132037	Adobe Reader <= 2015.006.30505 / 2017.011.30152 / 2019.021.20056 Multiple Vulnerabilities (APSB19-55)	Critical
132036	Adobe Acrobat <= 2015.006.30505 / 2017.011.30152 / 2019.021.20056 Multiple Vulnerabilities (APSB19-55)	Critical
132025	Steam Client Installed (Windows)	Info
132022	Adobe Photoshop CC 20.x <= 20.0.7 / 21.x <= 21.0.1 Multiple Vulnerabilities (APSB19-56)	High
132019	Adobe ColdFusion < 2018.x < 2018u7 Vulnerability (APSB19-58)	High
131956	Mozilla Thunderbird < 68.3	Medium
131954	Google Chrome < 79.0.3945.79 Multiple Vulnerabilities	Medium
131950	Wireshark 2.6.x < 2.6.13 A Vulnerability	Medium
131948	Wireshark 3.0.x < 3.0.7 A Vulnerability	Medium
131942	Foxit Studio Photo < 3.6.6.916 Out-of-Bounds Read Vulnerability	High
131941	Foxit Studio Photo < 3.6.6.913 Multiple Vulnerabilities	High
131836	Adobe Media Encoder Installed (Windows)	Info
131835	Security Update for Microsoft Windows Admin Center (March 2019)	High
131773	Mozilla Firefox < 71.0	Medium
131767	Mozilla Firefox ESR 68.x < 68.3 Multiple vulnerabilities	Medium
131765	Symantec Critical System Protection 8.0 < 8.0 MP2 Authentication Bypass (SYMSA1498)	High
131738	Google Chrome < 73.0.3683.103 Heap Corruption	Medium
131725	Sophos Anti-Virus Installed (Windows)	Info
131318	Security Update for Microsoft Visual Studio Code (CVE-2019-1414)	Medium
131317	Windows Admin Center Installed	Info
131316	Foxit Studio Photo Installed (Windows)	Info
131285	Fortinet FortiClient < 6.2.0 Information Disclosure MitM (FG-IR-18-100)	Medium
131233	Symantec Endpoint Protection Client 12.x < 12.1.7454.7000 / 14.x < 14.2.5323.2000 Multiple Vulnerabilities (SYMSA1488)	High
131232	Cisco Webex Teams for Windows DLL Hijacking Vulnerability (cisco-sa-20191120-webex-teams-dll)	Medium
131193	Atlassian JIRA Installed (Windows)	Info
131191	Foxit PhantomPDF < 9.7 Multiple Vulnerabilities	Medium
131190	Google Chrome < 78.0.3904.108 Multiple Vulnerabilities	Medium

Windows Family for Nessus