The version of Microsoft Edge installed on the remote Windows host is prior to 120.0.2210.61. It is, therefore, affected by multiple vulnerabilities as referenced in the December 7, 2023 advisory.

  - Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CVE-2023-35618)

  - Microsoft Edge (Chromium-based) Information Disclosure Vulnerability (CVE-2023-36880, CVE-2023-38174)

  - Use after free in Media Stream in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)     (CVE-2023-6508)

  - Use after free in Side Panel Search in Google Chrome prior to 120.0.6099.62 allowed a remote attacker who     convinced a user to engage in specific UI interaction to potentially exploit heap corruption via specific     UI interaction. (Chromium security severity: High) (CVE-2023-6509)

  - Use after free in Media Capture in Google Chrome prior to 120.0.6099.62 allowed a remote attacker who     convinced a user to engage in specific UI interaction to potentially exploit heap corruption via specific     UI interaction. (Chromium security severity: Medium) (CVE-2023-6510)

  - Inappropriate implementation in Autofill in Google Chrome prior to 120.0.6099.62 allowed a remote attacker     to bypass Autofill restrictions via a crafted HTML page. (Chromium security severity: Low) (CVE-2023-6511)

  - Inappropriate implementation in Web Browser UI in Google Chrome prior to 120.0.6099.62 allowed a remote     attacker to potentially spoof the contents of an iframe dialog context menu via a crafted HTML page.
    (Chromium security severity: Low) (CVE-2023-6512)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5573 advisory.

  - Use after free in Media Stream in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)     (CVE-2023-6508)

  - Use after free in Side Panel Search in Google Chrome prior to 120.0.6099.62 allowed a remote attacker who     convinced a user to engage in specific UI interaction to potentially exploit heap corruption via specific     UI interaction. (Chromium security severity: High) (CVE-2023-6509)

  - Use after free in Media Capture in Google Chrome prior to 120.0.6099.62 allowed a remote attacker who     convinced a user to engage in specific UI interaction to potentially exploit heap corruption via specific     UI interaction. (Chromium security severity: Medium) (CVE-2023-6510)

  - Inappropriate implementation in Autofill in Google Chrome prior to 120.0.6099.62 allowed a remote attacker     to bypass Autofill restrictions via a crafted HTML page. (Chromium security severity: Low) (CVE-2023-6511)

  - Inappropriate implementation in Web Browser UI in Google Chrome prior to 120.0.6099.62 allowed a remote     attacker to potentially spoof the contents of an iframe dialog context menu via a crafted HTML page.
    (Chromium security severity: Low) (CVE-2023-6512)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2024:0020-1 advisory.

  - Use after free in Media Stream in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)     (CVE-2023-6508)

  - Use after free in Side Panel Search in Google Chrome prior to 120.0.6099.62 allowed a remote attacker who     convinced a user to engage in specific UI interaction to potentially exploit heap corruption via specific     UI interaction. (Chromium security severity: High) (CVE-2023-6509)

  - Use after free in Media Capture in Google Chrome prior to 120.0.6099.62 allowed a remote attacker who     convinced a user to engage in specific UI interaction to potentially exploit heap corruption via specific     UI interaction. (Chromium security severity: Medium) (CVE-2023-6510)

  - Inappropriate implementation in Autofill in Google Chrome prior to 120.0.6099.62 allowed a remote attacker     to bypass Autofill restrictions via a crafted HTML page. (Chromium security severity: Low) (CVE-2023-6511)

  - Inappropriate implementation in Web Browser UI in Google Chrome prior to 120.0.6099.62 allowed a remote     attacker to potentially spoof the contents of an iframe dialog context menu via a crafted HTML page.
    (Chromium security severity: Low) (CVE-2023-6512)

  - Type confusion in V8 in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (Chromium security severity: High) (CVE-2023-6702)

  - Use after free in Blink in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (Chromium security severity: High) (CVE-2023-6703)

  - Use after free in libavif in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to     potentially exploit heap corruption via a crafted image file. (Chromium security severity: High)     (CVE-2023-6704)

  - Use after free in WebRTC in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (Chromium security severity: High) (CVE-2023-6705)

  - Use after free in FedCM in Google Chrome prior to 120.0.6099.109 allowed a remote attacker who convinced a     user to engage in specific UI interaction to potentially exploit heap corruption via a crafted HTML page.
    (Chromium security severity: High) (CVE-2023-6706)

  - Use after free in CSS in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) (CVE-2023-6707)

  - Heap buffer overflow in WebRTC in Google Chrome prior to 120.0.6099.129 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)     (CVE-2023-7024)

  - Use after free in ANGLE in Google Chrome prior to 120.0.6099.199 allowed a remote attacker who had     compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium     security severity: High) (CVE-2024-0222)

  - Heap buffer overflow in ANGLE in Google Chrome prior to 120.0.6099.199 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)     (CVE-2024-0223)

  - Use after free in WebAudio in Google Chrome prior to 120.0.6099.199 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)     (CVE-2024-0224)

  - Use after free in WebGPU in Google Chrome prior to 120.0.6099.199 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (Chromium security severity: High) (CVE-2024-0225)

  - Insufficient data validation in Extensions in Google Chrome prior to 120.0.6099.216 allowed an attacker in     a privileged network position to install a malicious extension via a crafted HTML page. (Chromium security     severity: High) (CVE-2024-0333)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202402-14 (QtWebEngine: Multiple Vulnerabilities)

  - Use after free in Garbage Collection in Google Chrome prior to 119.0.6045.159 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)     (CVE-2023-5997)

  - Use after free in Navigation in Google Chrome prior to 119.0.6045.159 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)     (CVE-2023-6112)

  - Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had     compromised the renderer process to potentially perform a sandbox escape via a malicious file. (Chromium     security severity: High) (CVE-2023-6345)

  - Use after free in WebAudio in Google Chrome prior to 119.0.6045.199 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)     (CVE-2023-6346)

  - Use after free in Mojo in Google Chrome prior to 119.0.6045.199 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (Chromium security severity: High) (CVE-2023-6347)

  - Type Confusion in Spellcheck in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had     compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium     security severity: High) (CVE-2023-6348)

  - Use after free in libavif in Google Chrome prior to 119.0.6045.199 allowed a remote attacker to     potentially exploit heap corruption via a crafted avif file. (Chromium security severity: High)     (CVE-2023-6350, CVE-2023-6351)

  - Use after free in Media Stream in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)     (CVE-2023-6508)

  - Use after free in Side Panel Search in Google Chrome prior to 120.0.6099.62 allowed a remote attacker who     convinced a user to engage in specific UI interaction to potentially exploit heap corruption via specific     UI interaction. (Chromium security severity: High) (CVE-2023-6509)

  - Use after free in Media Capture in Google Chrome prior to 120.0.6099.62 allowed a remote attacker who     convinced a user to engage in specific UI interaction to potentially exploit heap corruption via specific     UI interaction. (Chromium security severity: Medium) (CVE-2023-6510)

  - Inappropriate implementation in Autofill in Google Chrome prior to 120.0.6099.62 allowed a remote attacker     to bypass Autofill restrictions via a crafted HTML page. (Chromium security severity: Low) (CVE-2023-6511)

  - Inappropriate implementation in Web Browser UI in Google Chrome prior to 120.0.6099.62 allowed a remote     attacker to potentially spoof the contents of an iframe dialog context menu via a crafted HTML page.
    (Chromium security severity: Low) (CVE-2023-6512)

  - Type confusion in V8 in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (Chromium security severity: High) (CVE-2023-6702)

  - Use after free in Blink in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (Chromium security severity: High) (CVE-2023-6703)

  - Use after free in libavif in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to     potentially exploit heap corruption via a crafted image file. (Chromium security severity: High)     (CVE-2023-6704)

  - Use after free in WebRTC in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (Chromium security severity: High) (CVE-2023-6705)

  - Use after free in FedCM in Google Chrome prior to 120.0.6099.109 allowed a remote attacker who convinced a     user to engage in specific UI interaction to potentially exploit heap corruption via a crafted HTML page.
    (Chromium security severity: High) (CVE-2023-6706)

  - Use after free in CSS in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) (CVE-2023-6707)

  - Heap buffer overflow in WebRTC in Google Chrome prior to 120.0.6099.129 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)     (CVE-2023-7024)

  - Use after free in ANGLE in Google Chrome prior to 120.0.6099.199 allowed a remote attacker who had     compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium     security severity: High) (CVE-2024-0222)

  - Heap buffer overflow in ANGLE in Google Chrome prior to 120.0.6099.199 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)     (CVE-2024-0223)

  - Use after free in WebAudio in Google Chrome prior to 120.0.6099.199 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)     (CVE-2024-0224)

  - Use after free in WebGPU in Google Chrome prior to 120.0.6099.199 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (Chromium security severity: High) (CVE-2024-0225)

  - Insufficient data validation in Extensions in Google Chrome prior to 120.0.6099.216 allowed an attacker in     a privileged network position to install a malicious extension via a crafted HTML page. (Chromium security     severity: High) (CVE-2024-0333)

  - Out of bounds write in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)     (CVE-2024-0517)

  - Type confusion in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (Chromium security severity: High) (CVE-2024-0518)

  - Out of bounds memory access in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)     (CVE-2024-0519)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-5d1b8507b8 advisory.

  - Use after free in Media Stream in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)     (CVE-2023-6508)

  - Use after free in Side Panel Search in Google Chrome prior to 120.0.6099.62 allowed a remote attacker who     convinced a user to engage in specific UI interaction to potentially exploit heap corruption via specific     UI interaction. (Chromium security severity: High) (CVE-2023-6509)

  - Use after free in Media Capture in Google Chrome prior to 120.0.6099.62 allowed a remote attacker who     convinced a user to engage in specific UI interaction to potentially exploit heap corruption via specific     UI interaction. (Chromium security severity: Medium) (CVE-2023-6510)

  - Inappropriate implementation in Autofill in Google Chrome prior to 120.0.6099.62 allowed a remote attacker     to bypass Autofill restrictions via a crafted HTML page. (Chromium security severity: Low) (CVE-2023-6511)

  - Inappropriate implementation in Web Browser UI in Google Chrome prior to 120.0.6099.62 allowed a remote     attacker to potentially spoof the contents of an iframe dialog context menu via a crafted HTML page.
    (Chromium security severity: Low) (CVE-2023-6512)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote macOS host is prior to 120.0.6099.62. It is, therefore, affected by multiple vulnerabilities as referenced in the 2023_12_stable-channel-update-for-desktop advisory.

  - Use after free in Media Stream in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)     (CVE-2023-6508)

  - Use after free in Side Panel Search in Google Chrome prior to 120.0.6099.62 allowed a remote attacker who     convinced a user to engage in specific UI interaction to potentially exploit heap corruption via specific     UI interaction. (Chromium security severity: High) (CVE-2023-6509)

  - Use after free in Media Capture in Google Chrome prior to 120.0.6099.62 allowed a remote attacker who     convinced a user to engage in specific UI interaction to potentially exploit heap corruption via specific     UI interaction. (Chromium security severity: Medium) (CVE-2023-6510)

  - Inappropriate implementation in Autofill in Google Chrome prior to 120.0.6099.62 allowed a remote attacker     to bypass Autofill restrictions via a crafted HTML page. (Chromium security severity: Low) (CVE-2023-6511)

  - Inappropriate implementation in Web Browser UI in Google Chrome prior to 120.0.6099.62 allowed a remote     attacker to potentially spoof the contents of an iframe dialog context menu via a crafted HTML page.
    (Chromium security severity: Low) (CVE-2023-6512)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-a32ad3e643 advisory.

  - Use after free in Media Stream in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)     (CVE-2023-6508)

  - Use after free in Side Panel Search in Google Chrome prior to 120.0.6099.62 allowed a remote attacker who     convinced a user to engage in specific UI interaction to potentially exploit heap corruption via specific     UI interaction. (Chromium security severity: High) (CVE-2023-6509)

  - Use after free in Media Capture in Google Chrome prior to 120.0.6099.62 allowed a remote attacker who     convinced a user to engage in specific UI interaction to potentially exploit heap corruption via specific     UI interaction. (Chromium security severity: Medium) (CVE-2023-6510)

  - Inappropriate implementation in Autofill in Google Chrome prior to 120.0.6099.62 allowed a remote attacker     to bypass Autofill restrictions via a crafted HTML page. (Chromium security severity: Low) (CVE-2023-6511)

  - Inappropriate implementation in Web Browser UI in Google Chrome prior to 120.0.6099.62 allowed a remote     attacker to potentially spoof the contents of an iframe dialog context menu via a crafted HTML page.
    (Chromium security severity: Low) (CVE-2023-6512)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 4405e9ad-97fe-11ee-86bb-a8a1599412c6 advisory.

  - Use after free in Media Stream in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)     (CVE-2023-6508)

  - Use after free in Side Panel Search in Google Chrome prior to 120.0.6099.62 allowed a remote attacker who     convinced a user to engage in specific UI interaction to potentially exploit heap corruption via specific     UI interaction. (Chromium security severity: High) (CVE-2023-6509)

  - Use after free in Media Capture in Google Chrome prior to 120.0.6099.62 allowed a remote attacker who     convinced a user to engage in specific UI interaction to potentially exploit heap corruption via specific     UI interaction. (Chromium security severity: Medium) (CVE-2023-6510)

  - Inappropriate implementation in Autofill in Google Chrome prior to 120.0.6099.62 allowed a remote attacker     to bypass Autofill restrictions via a crafted HTML page. (Chromium security severity: Low) (CVE-2023-6511)

  - Inappropriate implementation in Web Browser UI in Google Chrome prior to 120.0.6099.62 allowed a remote     attacker to potentially spoof the contents of an iframe dialog context menu via a crafted HTML page.
    (Chromium security severity: Low) (CVE-2023-6512)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 120.0.6099.62. It is, therefore, affected by multiple vulnerabilities as referenced in the 2023_12_stable-channel-update-for-desktop advisory.

  - Use after free in Media Stream in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)     (CVE-2023-6508)

  - Use after free in Side Panel Search in Google Chrome prior to 120.0.6099.62 allowed a remote attacker who     convinced a user to engage in specific UI interaction to potentially exploit heap corruption via specific     UI interaction. (Chromium security severity: High) (CVE-2023-6509)

  - Use after free in Media Capture in Google Chrome prior to 120.0.6099.62 allowed a remote attacker who     convinced a user to engage in specific UI interaction to potentially exploit heap corruption via specific     UI interaction. (Chromium security severity: Medium) (CVE-2023-6510)

  - Inappropriate implementation in Autofill in Google Chrome prior to 120.0.6099.62 allowed a remote attacker     to bypass Autofill restrictions via a crafted HTML page. (Chromium security severity: Low) (CVE-2023-6511)

  - Inappropriate implementation in Web Browser UI in Google Chrome prior to 120.0.6099.62 allowed a remote     attacker to potentially spoof the contents of an iframe dialog context menu via a crafted HTML page.
    (Chromium security severity: Low) (CVE-2023-6512)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
186681	Microsoft Edge (Chromium) < 120.0.2210.61 Multiple Vulnerabilities	Nessus	Windows	12/7/2023	5/3/2024	critical
186704	Debian DSA-5573-1 : chromium - security update	Nessus	Debian Local Security Checks	12/9/2023	12/12/2023	high
189103	openSUSE 15 Security Update : chromium (openSUSE-SU-2024:0020-1)	Nessus	SuSE Local Security Checks	1/17/2024	1/17/2024	high
190672	GLSA-202402-14 : QtWebEngine: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	2/18/2024	2/18/2024	critical
186680	Fedora 39 : chromium (2023-5d1b8507b8)	Nessus	Fedora Local Security Checks	12/7/2023	12/15/2023	high
189844	GLSA-202401-34 : Chromium, Google Chrome, Microsoft Edge: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	1/31/2024	2/7/2024	critical
186599	Google Chrome < 120.0.6099.62 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	12/5/2023	5/3/2024	high
186701	Fedora 38 : chromium (2023-a32ad3e643)	Nessus	Fedora Local Security Checks	12/8/2023	12/12/2023	high
186716	FreeBSD : chromium -- multiple security fixes (4405e9ad-97fe-11ee-86bb-a8a1599412c6)	Nessus	FreeBSD Local Security Checks	12/11/2023	12/12/2023	high
186600	Google Chrome < 120.0.6099.62 Multiple Vulnerabilities	Nessus	Windows	12/5/2023	5/3/2024	high

Detections

Analytics

Plugins Search

critical

high

high

critical

high

critical

high

high

high

high