Nessus was able to find evidence of the last key that was opened when the Registry Editor was closed for each user.

Nessus was able to generate a list of all files found in $Recycle.Bin subdirectories.

Nessus was able to gather evidence of files opened by file type from the remote host.

Nessus was able to generate a list of files opened using the Microsoft Paint program.

Nessus was able to generate a report on files that were opened using the shell dialog box or saved using the shell dialog box. This is the box that appears when you attempt to save a document or open a document in Windows Explorer.

Nessus was able to gather evidence of files that were opened using any Microsoft Office application. The report was extracted from Office MRU (Most Recently Used) registry keys.

Nessus was able to query the MUIcache registry key to find evidence of program execution.

Nessus was able to find evidence of program execution using Windows Explorer registry logs and settings.

Nessus was able to generate a report of mapped network drives on the remote Windows host.

Nessus was able to generate a list URLs that were manually typed into the Internet Explorer address bar.

Nessus was able to query the system to generate a list of files opened by Foxit programs.

Nessus was able to generate a list of URLs that set Flash cookies on the remote host.

Nessus was able to enumerate the directory paths that users visited by manually typing the full directory path into Windows Explorer. The generated folder list report contains folders local to the system, folders from past mounted network drives, and folders from mounted devices.

Nessus was able to query the registry to find the most recent program to use Direct3D for each user on the remote Windows host.

Nessus was able to enumerate folders that were opened in Windows Explorer. Microsoft Windows maintains folder settings using a registry key known as shellbags or BagMRU. The generated folder list report contains folders local to the system, folders from past mounted network drives, and folders from mounted devices.

Nessus was able to generate a report on the application compatibility cache on the remote Windows host.

Nessus was able to query Adobe settings on the remote Windows host to find recently opened Adobe file information.

Nessus was able to query 7-Zip settings on the remote Windows host to find recently accessed compressed files.

The version of Apple iTunes installed on the remote Windows host is prior to 12.4.2. It is, therefore, affected by multiple vulnerabilities :

  - Multiple memory corruption issues exist in the libxslt     component due to improper validation of user-supplied     input. An unauthenticated, remote attacker can exploit     this to cause a denial of service condition or the     execution of arbitrary code. (CVE-2016-1684,     CVE-2016-4607, CVE-2016-4608, CVE-2016-4609,     CVE-2016-4610, CVE-2016-4612)

  - Multiple memory corruption issues exist in the libxml2     component that allow a remote attacker to cause a denial     of service condition or the execution of arbitrary code.
    (CVE-2016-1836, CVE-2016-4447, CVE-2016-4448,     CVE-2016-4483, CVE-2016-4614, CVE-2016-4615,     CVE-2016-4616, CVE-2016-4619)

  - An XXE (Xml eXternal Entity) injection vulnerability     exists in the libxml2 component due to an incorrectly     configured XML parser accepting XML external entities     from an untrusted source. A remote attacker can exploit     this, via a specially crafted XML file, to disclose     arbitrary files and user information. (CVE-2016-4449)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Nessus was able to collect the time of the last password change for active accounts on the remote Windows host and generate a report as a CSV attachment.

Nessus was able to collect details of active accounts on the remote Windows host and generate a report as a CSV attachment.

Nessus was able to collect details of active sessions on the remote Windows host and generate a report as a CSV attachment.

Nessus was able to collect group details for currently active accounts on the remote Windows host and generate a report as a CSV attachment.

Nessus was able to collect details of SMB sessions from the remote Windows host and generate a report as a CSV attachment.

Nessus was able to collect details for NetBIOS over TCP/IP from the remote Windows host and generate a report as a CSV attachment.

Nessus was able to collect details of the DNS cache from the remote Windows host and generate a report as a CSV attachment.

Nessus was able to collect ARP table information from the remote Windows host and generate a report as a CSV attachment.

Nessus was able to collect time zone information from the remote Windows host and generate a report as a CSV attachment.

Nessus was able to collect system and user level Windows scripting host settings from the remote Windows host and generate a report as a CSV attachment.

Nessus was able to collect and report the PowerShell execution policy for the remote Windows host.

Nessus was able to collect and report the remote host's last boot time as an ISO 8601 timestamp.

Nessus was able to collect the hosts file from the remote Windows host and report it as attachment.

Nessus was able to collect system and active account environment variables on the remote Windows host and generate a report as a CSV attachment.

Nessus was able to collect available device logs from the remote Windows host and add them as attachments.

Nessus was able to collect AppLocker configuration information on the remote Windows host and generate a report as a CSV attachment.

Nessus was able to collect Office macro configuration information for active accounts on the remote Windows host and generate a report as a CSV attachment.

Microsoft Visio, a diagramming and vector graphics application, is installed on the remote Windows host.

According to its version, the installation of Microsoft Visio on the remote Windows host is no longer supported.

Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilities.

Citrix Studio, an extension for XenApp and XenDesktop, is installed on the remote Windows host.

The version of Adobe Reader installed on the remote Windows host is a version prior to 15.006.30198 or 15.017.20050. It is, therefore, affected by multiple vulnerabilities.

  - Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC     Classic before 15.006.30198, and Acrobat and Acrobat Reader DC Continuous before 15.017.20050 on Windows     and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability     than CVE-2016-4255. (CVE-2016-6938)

  - Integer overflow in Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before     15.006.30198, and Acrobat and Acrobat Reader DC Continuous before 15.017.20050 on Windows and OS X allows     attackers to execute arbitrary code via unspecified vectors. (CVE-2016-4210)

  - Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC     Classic before 15.006.30198, and Acrobat and Acrobat Reader DC Continuous before 15.017.20050 on Windows     and OS X allows attackers to execute arbitrary code via unspecified vectors. (CVE-2016-4255)

  - Heap-based buffer overflow in Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC     Classic before 15.006.30198, and Acrobat and Acrobat Reader DC Continuous before 15.017.20050 on Windows     and OS X allows attackers to execute arbitrary code via unspecified vectors. (CVE-2016-4209)

  - Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and     Acrobat and Acrobat Reader DC Continuous before 15.017.20050 on Windows and OS X allow attackers to bypass     JavaScript API execution restrictions via unspecified vectors. (CVE-2016-4215)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Adobe Acrobat installed on the remote Windows host is a version prior to 11.0.17, 15.006.30198, or 15.017.20050. It is, therefore, affected by multiple vulnerabilities.

  - Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC     Classic before 15.006.30198, and Acrobat and Acrobat Reader DC Continuous before 15.017.20050 on Windows     and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability     than CVE-2016-4255. (CVE-2016-6938)

  - Integer overflow in Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before     15.006.30198, and Acrobat and Acrobat Reader DC Continuous before 15.017.20050 on Windows and OS X allows     attackers to execute arbitrary code via unspecified vectors. (CVE-2016-4210)

  - Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC     Classic before 15.006.30198, and Acrobat and Acrobat Reader DC Continuous before 15.017.20050 on Windows     and OS X allows attackers to execute arbitrary code via unspecified vectors. (CVE-2016-4255)

  - Heap-based buffer overflow in Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC     Classic before 15.006.30198, and Acrobat and Acrobat Reader DC Continuous before 15.017.20050 on Windows     and OS X allows attackers to execute arbitrary code via unspecified vectors. (CVE-2016-4209)

  - Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and     Acrobat and Acrobat Reader DC Continuous before 15.017.20050 on Windows and OS X allow attackers to bypass     JavaScript API execution restrictions via unspecified vectors. (CVE-2016-4215)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Adobe Flash Player installed on the remote Windows host is equal or prior to version 22.0.0.192. It is, therefore, affected by multiple Vulnerabilities :

  - Multiple memory corruption issues exist that allow a     remote attacker to execute arbitrary code.
    (CVE-2016-4172, CVE-2016-4175, CVE-2016-4179,     CVE-2016-4180, CVE-2016-4181, CVE-2016-4182,     CVE-2016-4183, CVE-2016-4184, CVE-2016-4185,     CVE-2016-4186, CVE-2016-4187, CVE-2016-4188,     CVE-2016-4189, CVE-2016-4190, CVE-2016-4217,     CVE-2016-4218, CVE-2016-4219, CVE-2016-4220,     CVE-2016-4221, CVE-2016-4233, CVE-2016-4234,     CVE-2016-4235, CVE-2016-4236, CVE-2016-4237,     CVE-2016-4238, CVE-2016-4239, CVE-2016-4240,     CVE-2016-4241, CVE-2016-4242, CVE-2016-4243,     CVE-2016-4244, CVE-2016-4245, CVE-2016-4246)

  - Multiple use-after-free errors exist that allow a remote     attacker to execute arbitrary code. (CVE-2016-4173,     CVE-2016-4174, CVE-2016-4222, CVE-2016-4226,     CVE-2016-4227, CVE-2016-4228, CVE-2016-4229,     CVE-2016-4230, CVE-2016-4231, CVE-2016-4248,     CVE-2016-7020)

  - Multiple stack corruption issues exist that allow a     remote attacker to execute arbitrary code.
    (CVE-2016-4176, CVE-2016-4177)

  - A security bypass vulnerability exists that allows a     remote attacker to disclose sensitive information.
    (CVE-2016-4178)

  - Multiple type confusion errors exist that allow a remote     attacker to execute arbitrary code. (CVE-2016-4223,     CVE-2016-4224, CVE-2016-4225)

  - An unspecified memory leak issue exists that allows an     attacker to have an unspecified impact. (CVE-2016-4232)

  - A race condition exists that allows a remote attacker to     disclose sensitive information. (CVE-2016-4247)

  - A heap buffer overflow condition exists that allows a     remote attacker to execute arbitrary code.
    (CVE-2016-4249)

Nessus detected one or more files on the remote Windows host that match a Yara rule.

Note that Nessus has only scanned files with the following extensions:

.application, .asp, .aspx, .bat, .chm, .class, .cmd, .com, .cpl, .csh, .dll, .doc, .docx, .drv, .exe, .gadget, .hta, .inf, .ins, .inx, .isu, .jar, .job, .jpeg, .jpg, .jse, .jsp, .lnk, .msc, .msi, .msp, .mst, .paf, .pdf, .php, .pif, .ppt, .pptx, .ps1, .ps1xml, .ps2, .ps2xml, .psc1, .psc2, .reg, .rgs, .scf, .scr, .sct, .shb, .shs, .swf, .sys, .u3p, .vbe, .vbs, .vbscript, .wsf, .xls, xlsx

The version of LibreOffice installed on the remote Windows host is prior to 5.1.4. It is, therefore, affected by a use-after-free error during Rich Text Format (RTF) file parsing due to improper validation of the RTF character style index. An unauthenticated, remote attacker can exploit this, by convincing a user to open a specially crafted RTF file, to execute arbitrary code.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of SolarWinds Storage Resource Monitor (SRM) Profiler (formerly SolarWinds Storage Manager) running on the remote host is prior to 6.2.3 Hotfix 1. It is, therefore, affected by a remote code execution vulnerability in ScriptServlet due to a failure to sanitize user-supplied input to the addNewRule() method of RulesMetaData. An unauthenticated, remote attacker can exploit this, via SQL injection, to disclose or manipulate arbitrary data in the back-end database or to execute arbitrary code with SYSTEM privileges.

The version of Symantec Mail Security for Exchange or Domino installed on the remote Windows host is affected by multiple vulnerabilities in the decomposer engine :

  - An array indexing error exists in the UnRAR component in     the Unpack::ShortLZ() function in unpack15.cpp that is     triggered when decompressing RAR files. An     unauthenticated, remote attacker can exploit this, via a     specially crafted RAR file, to corrupt memory, resulting     in the execution of arbitrary code. (CVE-2016-2207)

  - An overflow condition exists when handling PowerPoint     documents due to improper validation of user-supplied     input when handling a misaligned stream-cache. An     unauthenticated, remote attacker can exploit this, via a     specially crafted PPT file, to cause a stack-based     buffer overflow, resulting in the execution of arbitrary     code. (CVE-2016-2209)

  - An overflow condition exists in the     CSymLHA::get_header() function in Dec2LHA.dll that is     triggered when decompressing LZH and LHA archives. An     unauthenticated, remote attacker can exploit this, via a     specially crafted file, to cause a stack-based buffer     overflow, resulting in the execution of arbitrary code.
    (CVE-2016-2210)

  - Multiple flaws exist in the libmspack library due to     improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit these     issues, via a specially crafted file, to crash processes     linked against the library or execute arbitrary code.
    (CVE-2016-2211)

  - An overflow condition exists in the     CMIMEParser::UpdateHeader() function due to improper     validation of user-supplied input when parsing MIME     messages. An unauthenticated, remote attacker can     exploit this, via a specially crafted MIME message, to     cause a heap-based buffer overflow, resulting in a     denial of service condition or the execution of     arbitrary code. (CVE-2016-3644)

  - An array indexing error exists in the scan engine     decomposer in the LPkOldFormatDecompressor::UnShrink()     function that is triggered when decoding ZIP archives.
    An unauthenticated, remote attacker can exploit this,     via a specially crafted ZIP file, to cause a denial of     service condition or the execution of arbitrary code.
    (CVE-2016-3645)

  - An integer overflow condition exists in the     Attachment::setDataFromAttachment() function in     Dec2TNEF.dll that is triggered when decoding TNEF files.
    An unauthenticated, remote attacker can exploit this,     via a specially crafted TNEF file, to cause a denial of     service condition or the execution of arbitrary code.
    (CVE-2016-3646)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Symantec Endpoint Protection Client installed on the remote host is 12.1 prior to 12.1 RU6 MP5. It is, therefore, affected by multiple vulnerabilities :

  - An array indexing error exists in the UnRAR component in     the Unpack::ShortLZ() function in unpack15.cpp that is     triggered when decompressing RAR files. An     unauthenticated, remote attacker can exploit this, via a     specially crafted RAR file, to corrupt memory, resulting     in the execution of arbitrary code. (CVE-2016-2207)

  - An overflow condition exists when handling PowerPoint     documents due to improper validation of user-supplied     input when handling a misaligned stream-cache. An     unauthenticated, remote attacker can exploit this, via a     specially crafted PPT file, to cause a stack-based     buffer overflow, resulting in the execution of arbitrary     code. (CVE-2016-2209)

  - An overflow condition exists in the     CSymLHA::get_header() function in Dec2LHA.dll that is     triggered when decompressing LZH and LHA archives. An     unauthenticated, remote attacker can exploit this, via a     specially crafted file, to cause a stack-based buffer     overflow, resulting in the execution of arbitrary code.
    (CVE-2016-2210)

  - Multiple flaws exist in the libmspack library due to     improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit these     issues, via a specially crafted file, to crash processes     linked against the library or execute arbitrary code.
    (CVE-2016-2211)

  - An overflow condition exists in the     CMIMEParser::UpdateHeader() function due to improper     validation of user-supplied input when parsing MIME     messages. An unauthenticated, remote attacker can     exploit this, via a specially crafted MIME message, to     cause a heap-based buffer overflow, resulting in a     denial of service condition or the execution of     arbitrary code. (CVE-2016-3644)

  - An array indexing error exists in the scan engine     decomposer in the LPkOldFormatDecompressor::UnShrink()     function that is triggered when decoding ZIP archives.
    An unauthenticated, remote attacker can exploit this,     via a specially crafted ZIP file, to cause a denial of     service condition or the execution of arbitrary code.
    (CVE-2016-3645)

  - An integer overflow condition exists in the     Attachment::setDataFromAttachment() function in     Dec2TNEF.dll that is triggered when decoding TNEF files.
    An unauthenticated, remote attacker can exploit this,     via a specially crafted TNEF file, to cause a denial of     service condition or the execution of arbitrary code.
    (CVE-2016-3646)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Symantec Endpoint Protection Manager (SEPM) installed on the remote host is prior to 12.1 RU6 MP5. It is, therefore, affected by the following vulnerabilities :

  - A race condition exists in the SEP client that allows a     local attacker to bypass security restrictions,     resulting in the ability to download or upload files on     the client system. (CVE-2015-8801)

  - A server-side request forgery vulnerability exists in     the authentication interface that allows an attacker to     bypass access controls and scan unauthorized content on     the internal network. (CVE-2016-3647)

  - An unspecified flaw exists that allows an attacker to     bypass lock threshold limits, resulting in the ability     to recover management console passwords using     brute-force methods. (CVE-2016-3648)

  - An unspecified flaw exists when handling GET object     requests that allows an attacker to disclose information     related to valid administrator accounts. (CVE-2016-3649)

  - An unspecified flaw exists that allows an attacker to     disclose server credentials. (CVE-2016-3650)

  - An unspecified flaw exists related to PHP JSESSIONID     that allows an attacker to execute arbitrary code.
    (CVE-2016-3651)

  - Multiple cross-site scripting vulnerabilities exist due     to improper validation of user-supplied input to the     'createModalDialogFromURL', 'createWindowFromURL',     'createWindowFromForm', and 'createIEWindowFromForm'     parameters in the notificationpopup.php script. An     unauthenticated, remote attacker can exploit these     issues, via a specially crafted request, to execute     arbitrary script code in a user's browser session.
    (CVE-2016-3652)

  - A cross-site request forgery vulnerability exists in the     sr-save.php script due to a failure to require multiple     steps, explicit confirmation, or a unique token when     performing certain sensitive actions. An     unauthenticated, remote attacker can exploit this, via a     specially crafted link, to cause a user to send schedule     reports. (CVE-2016-3653)

  - A flaw exists in the externalurl.php script due to     improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit this, via a     specially crafted link, to redirect a user to an     arbitrary website. (CVE-2016-5304)

  - An unspecified flaw exists in a PHP script that allows     an attacker to conduct DOM-based link manipulation.
    (CVE-2016-5305)

  - An information disclosure vulnerability exists due to a     failure to enable HTTP Strict Transport Security on port     8445. (CVE-2016-5306)

  - A directory traversal vulnerability exists in the     management console that allows an attacker to access     files and directories on the web root. (CVE-2016-5307)

The version of Wireshark installed on the remote Windows host is 2.0.x prior to 2.0.4. It is, therefore, affected by multiple denial of service vulnerabilities :

  - An infinite loop exists in the SPOOLs dissector. A     remote attacker, via a specially crafted packet or trace     file, can exploit this to exhaust CPU resources,     resulting in a denial of service condition.
    (CVE-2016-5350)

  - A flaw exists in the IEEE 802.11 dissector that is     triggered when handling a malformed packet or trace     file. A remote attacker can exploit this to cause a     denial of service condition. (CVE-2016-5351)

  - An out-of-bounds read error exists in the     AirPDcapDecryptWPABroadcastKey() function in airpdcap.c     that allows a remote attacker to disclose memory     contents or cause a denial of service condition.
    (CVE-2016-5352)

  - A flaw exists in the UMTS FP dissector that is triggered     when handling a malformed packet or trace file. A remote     attacker can exploit this to cause a denial of service     condition. (CVE-2016-5353)

  - A flaw exists in multiple USB dissectors that is     triggered when a handling malformed packet or trace     file. A remote attacker can exploit this to cause a     denial of service condition. (CVE-2016-5354)

  - A flaw exists in the Toshiba file parser that is     triggered when handling a malformed packet trace file. A     remote attacker can exploit this, by convincing a user     to open a specially crafted packet trace file, to cause     a denial of service condition. (CVE-2016-5355)

  - A flaw exists in the CoSine file parser that is     triggered when handling a malformed packet trace file. A     remote attacker can exploit this to cause a denial of     service condition. (CVE-2016-5356)

  - A flaw exists in the NetScreen file parser that is     triggered when handling a malformed packet trace file. A     remote attacker can exploit this to cause a denial of     service condition. (CVE-2016-5357)

  - A flaw exists in the Ethernet dissector that is     triggered when handling a malformed packet or trace     file. A remote attacker can exploit this to cause a     denial of service condition. (CVE-2016-5358)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Wireshark installed on the remote Windows host is 1.12.x prior to 1.12.12. It is, therefore, affected by multiple denial of service vulnerabilities :

  - An infinite loop exists in the SPOOLs dissector. A     remote attacker, via a specially crafted packet or trace     file, can exploit this to exhaust CPU resources,     resulting in a denial of service condition.
    (CVE-2016-5350)

  - A flaw exists in the IEEE 802.11 dissector that is     triggered when handling a malformed packet or trace     file. A remote attacker can exploit this to cause a     denial of service condition. (CVE-2016-5351)

  - A flaw exists in the UMTS FP dissector that is triggered     when handling a malformed packet or trace file. A remote     attacker can exploit this to cause a denial of service     condition. (CVE-2016-5353)

  - A flaw exists in multiple USB dissectors that is     triggered when a handling malformed packet or trace     file. A remote attacker can exploit this to cause a     denial of service condition. (CVE-2016-5354)

  - A flaw exists in the Toshiba file parser that is     triggered when handling a malformed packet trace file. A     remote attacker can exploit this, by convincing a user     to open a specially crafted packet trace file, to cause     a denial of service condition. (CVE-2016-5355)

  - A flaw exists in the CoSine file parser that is     triggered when handling a malformed packet trace file. A     remote attacker can exploit this to cause a denial of     service condition. (CVE-2016-5356)

  - A flaw exists in the NetScreen file parser that is     triggered when handling a malformed packet trace file. A     remote attacker can exploit this to cause a denial of     service condition. (CVE-2016-5357)

  - An integer overflow condition exists in the WBXML     dissector. A remote attacker can exploit this, via a     specially crafted packet or trace file, to exhaust CPU     resources, resulting in a denial of service condition.
    (CVE-2016-5359)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Severity
92430	Registry Editor Last Accessed	info
92429	Recycle Bin Files	info
92428	Recent File History	info
92427	Microsoft Paint Recent File History	info
92426	OpenSaveMRU History	info
92425	Microsoft Office File History	info
92424	MUICache Program Execution History	info
92423	Windows Explorer Recently Executed Programs	info
92422	Windows Mapped Network Drives	info
92421	Internet Explorer Typed URLs	info
92420	Foxit History	info
92419	Flash Cookie History	info
92418	Windows Explorer Typed Paths	info
92417	Direct3D Recent Program	info
92416	BagMRU Folder History	info
92415	Application Compatibility Cache	info
92414	Adobe Recent Files	info
92413	7-Zip Recent Files	info
92410	Apple iTunes < 12.4.2 Multiple Vulnerabilities (credentialed check)	critical
92377	Microsoft Windows Current Users Last Password Change	info
92376	Microsoft Windows Current Users	info
92375	Microsoft Windows Current Sessions	info
92374	Microsoft Windows Current Groups	info
92373	Microsoft Windows SMB Sessions	info
92372	Microsoft Windows NetBIOS over TCP/IP Info	info
92371	Microsoft Windows DNS Cache	info
92370	Microsoft Windows ARP Table	info
92369	Microsoft Windows Time Zone Information	info
92368	Microsoft Windows Scripting Host Settings	info
92367	Microsoft Windows PowerShell Execution Policy	info
92366	Microsoft Windows Last Boot Time	info
92365	Microsoft Windows Hosts File	info
92364	Microsoft Windows Environment Variables	info
92363	Microsoft Windows Device Logs	info
92362	Microsoft Windows AppLocker Configuration	info
92361	Microsoft Office Macros Configuration	info
92220	Microsoft Visio Installed (credentialed check)	info
92219	Microsoft Visio Unsupported Version Detection	critical
92039	Citrix Studio Installed	info
92035	Adobe Reader < 15.006.30198 / 15.017.20050 Multiple Vulnerabilities (APSB16-26)	critical
92034	Adobe Acrobat < 11.0.17 / 15.006.30198 / 15.017.20050 Multiple Vulnerabilities (APSB16-26)	critical
92012	Adobe Flash Player <= 22.0.0.192 Multiple Vulnerabilities (APSB16-25)	critical
91990	Malicious File Detection Using Yara	critical
91974	LibreOffice < 5.1.4 RTF Character Style Index RCE	high
91917	SolarWinds Storage Resource Monitor Profiler < 6.2.3 Hotfix 1 RulesMetaData SQLi RCE	critical
91915	Symantec Mail Security for Exchange / Domino Decomposer Engine Multiple Vulnerabilities (SYM16-010)	high
91895	Symantec Endpoint Protection Client 12.1.x < 12.1 RU6 MP5 Multiple Vulnerabilities (SYM16-010)	high
91894	Symantec Endpoint Protection Manager 12.1.x < 12.1 RU6 MP5 Multiple Vulnerabilities (SYM16-011)	high
91821	Wireshark 2.0.x < 2.0.4 Multiple DoS	high
91820	Wireshark 1.12.x < 1.12.12 Multiple DoS	high

Detections

Analytics

Windows Family for Nessus

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

critical

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

critical

info

critical

critical

critical

critical

high

critical

high

high

high

high

high