Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.

Trend Micro OfficeScan is installed on the remote host and is affected by an arbitrary code execution vulnerability. An attempted attack requires user authentication.

The Servelec Technologies TBox Remote Terminal Unit provides real-time remote access and control of your assets. It supports Modbus TCP/IP (Ethernet) and Modbus RTU (RS-485) protocols. 

Kibana versions before 5.6.15 and 6.6.1 have the following vulnerabilities:

- A cross-site scripting (XSS) vulnerability that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users. (CVE-2019-7608)
 - An arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system. (CVE-2019-7609)
 - An arbitrary code execution flaw in the security audit logger. If a Kibana instance has the setting xpack.security.audit.enabled set to true, an attacker could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system. (CVE-2019-7610)

The remote host shows the Snow Inventory Agent user-agent string.

The remote server has been identified as a RADIUS server.

The client is communicating with a RADIUS server via the RADIUS accounting protocol.

The client is communicating with a RADIUS server via the RADIUS authentication protocol.

The remote server has been identified as a Radius server.

The client is communicating with a Radius server via the Radius accounting protocol.

The client is communicating with a Radius server via the Radius authentication protocol.

The IANA Vendor has been detected via the RADIUS protocol.

The remote host has just initiated an SMBv2 or higher connection.

The remote host is affected by a remote code execution vulnerability in Remote Desktop Protocol (RDP). An unauthenticated, remote attacker can exploit this, via a series of specially crafted requests, to execute arbitrary code.

FHIR has been detected via HTTP in XML format. FHIR is a standard describing data formats and elements and an application programming interface for exchanging healthcare information electronically. The standard was created by the Health Level Seven International (HL7) health-care standards organization.

FHIR has been detected via HTTP in JSON format. FHIR is a standard describing data formats and elements and an application programming interface for exchanging healthcare information electronically. The standard was created by the Health Level Seven International (HL7) health-care standards organization.

One of the remote hosts is a SolarWinds Network Performance Monitor. It has been observed sending an ICMP Echo Request.

The remote host is running the Trend Micro OfficeScan agent and certain version information has been obtained from requests made to the Trend Micro OfficeScan server.

The remote host is running the NETBIOS protocol, and an operating system has been identified.

The remote server is running a NTP (protocol version 4) server service (Stratum 1) which is used to synchronize time amongst multiple machines.

The remote server is running a NTP (protocol version 4) server service (Stratum 2) which is used to synchronize time amongst multiple machines.

The remote host is a DNS client which was observed sending a Tunneled DNS request to a DNS server.

The remote host is using the Session Initiation Protocol (SIP) which is a communication protocol for video and voice calls over the Internet.

The remote host is running an ExtremeXOS device on the network. ExtremeXOS is an operating system used in newer Extreme Networks network switches. It is an Extreme Networks second generation operating system after the VxWorks based ExtremeWare.

The remote host supports the use of RC4 in one or more cipher suites. The RC4 cipher is flawed in its generation of a pseudo-random stream of bytes so that a wide variety of small biases are introduced into the stream, decreasing its randomness. If plaintext is repeatedly encrypted (e.g., HTTP cookies), and an attacker is able to obtain many (i.e., tens of millions) ciphertexts, the attacker may be able to derive the plaintext.

The remote host is using a hardcoded, non-unique SSH host key. This may allow a remote, unauthenticated attacker to carry out impersonation, man-in-the-middle, or passive decryption attacks, resulting in sensitive information exposure.

The remote host is using a hardcoded, non-unique X.509 certificate. This may allow a remote, unauthenticated attacker to carry out impersonation, man-in-the-middle, or passive decryption attacks, resulting in sensitive information exposure.

The version of ntpd running on the remote host is vulnerable to a DoS attack if the 'monlist' command is enabled. The 'monlist' command returns a list of recent hosts that have connected to the service. However, it is affected by a denial of service vulnerability in ntp_request.c that allows an unauthenticated, remote attacker to saturate network traffic to a specific IP address by using forged REQ_MON_GETLIST or REQ_MON_GETLIST_1 requests. Furthermore, an attacker can exploit this issue to conduct reconnaissance or distributed denial of service (DDoS) attacks.

The remote host is an Avanti Kiosk which may be affected by the Poseidon Malware kit. This malware could allow an attacker to steal both credit card info as well as biometric information.

The remote host is an Avanti Kiosk. These kiosks act as a Point of Sale (POS) system which allow customers to pay for drinks, snacks and other items with a credit card, fingerprint scan or cash.

One or more requests to potential Petya ransomware related malware hosts have been detected. Petya differs from typical ransomware as it does not just encrypt files, it also overwrites and encrypts the master boot record (MBR), demanding payment via cryptocurrency. Petya propagates itself similar to "WannaCry" by exploiting the MS17-010 vulnerability, also known as EternalBlue which was part of the ShadowBrokers dump.

Foscam C1 IP Camera installs with hardcoded default FTP user credentials. The 'r' account has a password of 'r'. This allows a remote attacker to trivially access the FTP service on port 50021 and gain access to the mounted Micro-SD card.

Versions of Cisco a flaw that is triggered when handling Cluster Management Protocol-specific Telnet options while establishing a Telnet session on a device which accepts Telnet connections. This may allow a remote attacker to potentially execute arbitrary code or cause a DoS.

The remote host has just accepted an SSL/TLS connection.

The remote host has just accepted a TLS 1.2 connection.

The remote host has just accepted a TLS 1.1 connection.

The remote host has just accepted a TLS 1.3 connection.

The remote host has just accepted a TLS 1.0 connection.

The remote host has just accepted an SSLv3 connection.

The remote host has just accepted an SMBv2 or higher connection.

The remote host supports Server Message Block Protocol version 1 (SMBv1). Microsoft recommends that users discontinue the use of SMBv1 due to the lack of security features that were included in later SMB versions. Additionally, the Shadow Brokers group has an exploit that affects SMB however, it is unknown if the exploit affects SMBv1 or another version. In response to this, US-CERT recommends that users disable SMBv1 per SMB best practices to mitigate these potential issues. Additionally, the ETERNALBLUE exploit uses SMBv1.

The host is using h.225.0, a common VoIP protocol, and IP address information was identified from this traffic. This may indicate a host behind NAT.

Internet Printing Protocol (IPP) is an HTTP/S based printing protocol that supports various levels of authentication and enables secure printing within an organization. While responding to an IPP request, the remote host has exposed details about the printer and/or print server.

ID	Name	Severity
701276	Oracle WebLogic Server 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, and 12.2.1.4.0 T3 Access Attack	critical
701274	Trend Micro Apex One and OfficeScan XG Arbitrary Code Execution	high
701264	Servelec Technologies TBox Remote Terminal Unit	info
701234	Kibana 5.x < 5.6.15 / 6.x < 6.6.1 Multiple Vulnerabilities	critical
701223	Snow Inventory Agent Detection (User-Agent)	info
701143	RADIUS Accounting Protocol Detection (Server)	info
701142	RADIUS Accounting Protocol Detection (Client)	info
701141	RADIUS Authentication Protocol Detection (Server)	info
701140	RADIUS Authentication Protocol Detection (Client)	info
701138	Radius Accounting Protocol Detection	info
701137	Radius Accounting Protocol Detection	info
701136	Radius Authentication Protocol Detection	info
701135	Radius Authentication Protocol Detection	info
7293	IANA Vendor Detection (RADIUS Protocol)	info
700731	SMBv2+ Client Detection	info
7286	Windows RDP RCE (BlueKeep)	critical
700663	FHIR (Fast Healthcare Interoperability Resources) over HTTP detection in XML format	info
700662	FHIR (Fast Healthcare Interoperability Resources) over HTTP detection in JSON format.	info
700475	SolarWinds Network Performance Monitor ICMP Detection	info
7285	Trend Micro Client Version Information	info
7284	Windows Browser Operating System Detection	info
700238	Windows MAILSLOT Browser Service Host Announcement Detection	info
700232	NTP Server Protocol Version 4 Detection	info
700231	NTP Server Protocol Version 4 Detection	info
7283	DNS Client Tunneled Queries	info
700199	SIP Server Detection	info
700193	ExtremeXOS Device Version Detection via SNMP	info
700192	ExtremeXOS Device Detection via SNMP	info
7282	SSL RC4 Cipher Suites Supported (Bar Mitzvah)	medium
7281	Hardcoded SSH Host Key Detection	info
7280	Hardcoded SSL Certificate Detection	info
700174	Network Time Protocol Daemon (ntpd) 'monlist' DoS	medium
700158	Avanti Kiosk Poseidon Infection	high
700157	Avanti Kiosk Detection	info
700152	Petya Ransomware Malicious Host Detection	info
700147	Foscam C1 Hardcoded FTP Credentials (CVE-2016-8731)	medium
700129	Cisco IOS Denilal of Service (DoS) attack attempt	critical
700113	SSL/TLS Detection (UDP)	info
700112	SSL/TLS Detection	info
700111	TLS 1.2 Detection (UDP)	info
700110	TLS 1.1 Detection (UDP)	info
700108	TLS 1.3 Detection	info
700107	TLS 1.2 Detection	info
700106	TLS 1.1 Detection	info
700105	TLS 1.0 Detection	info
700104	SSLv3 Detection	info
700101	SMBv2+ Server Detection	info
700100	SMBv1 Server Detection	info
7275	h.225.0 IP Address Detection	info
7274	IPP Printer Information Detection	info

Detections

Analytics

Generic Family for Nessus Network Monitor

critical

high

info

critical

info

info

info

info

info

info

info

info

info

info

info

critical

info

info

info

info

info

info

info

info

info

info

info

info

medium

info

info

medium

high

info

info

medium

critical

info

info

info

info

info

info

info

info

info

info

info

info

info