CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 1CVE-2017-18214 – nodejs-moment: Regular expression denial of service
https://notcve.org/view.php?id=CVE-2017-18214
The moment module before 2.19.3 for Node.js is prone to a regular expression denial of service via a crafted date string, a different vulnerability than CVE-2016-4055. El módulo moment en versiones anteriores a la 2.19.3 para Node.js es propenso a una denegación de servicio de expresión regular (DoS) mediante una cadena de fecha manipulada. Esta vulnerabilidad es diferente de CVE-2016-4055. • https://github.com/ossf-cve-benchmark/CVE-2017-18214 https://github.com/moment/moment/issues/4163 https://nodesecurity.io/advisories/532 https://www.tenable.com/security/tns-2019-02 https://access.redhat.com/security/cve/CVE-2017-18214 https://bugzilla.redhat.com/show_bug.cgi?id=1553413 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.4EPSS: 0%CPEs: 47EXPL: 0CVE-2017-11506
https://notcve.org/view.php?id=CVE-2017-11506
When linking a Nessus scanner or agent to Tenable.io or other manager, Nessus 6.x before 6.11 does not verify the manager's TLS certificate when making the initial outgoing connection. This could allow man-in-the-middle attacks. Cuando se enlaza un escáner o agente Nessus a Tenable.io u otro gestor, Nessus en versiones 6.x anteriores a la 6.11 no verifica el certificado TLS del gestor cuando se realiza la conexión de salida inicial. Esto podría permitir ataques man-in-the-middle. • http://www.securitytracker.com/id/1039141 https://www.tenable.com/security/tns-2017-11 • CWE-295: Improper Certificate Validation •
CVSS: 5.4EPSS: 0%CPEs: 5EXPL: 0CVE-2017-2122
https://notcve.org/view.php?id=CVE-2017-2122
Cross-site scripting vulnerability in Nessus versions 6.8.0, 6.8.1, 6.9.0, 6.9.1 and 6.9.2 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad Cross-Site Scripting (XSS) en Nessus, en las versiones 6.8.0, 6.8.1, 6.9.1 y 6.9.2 permite a los atacantes remotos autenticados inyectar scripts web o HTML arbitrarios mediante vectores sin especificar. • http://jvn.jp/en/jp/JVN87760109/index.html https://www.tenable.com/security/tns-2017-01 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2017-7849
https://notcve.org/view.php?id=CVE-2017-7849
Nessus 6.10.x before 6.10.5 was found to be vulnerable to a local denial of service condition due to insecure permissions when running in Agent Mode. Se encontró que Nessus 6.10.x en versiones anteriores a 6.10.5 era vulnerable a una condición local de denegación de servicio debido a permisos inseguros al ejecutarse en Agent Mode. • http://www.securityfocus.com/bid/97951 https://www.tenable.com/security/tns-2017-10 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2017-7850
https://notcve.org/view.php?id=CVE-2017-7850
Nessus 6.10.x before 6.10.5 was found to be vulnerable to a local privilege escalation issue due to insecure permissions when running in Agent Mode. Se encontró que Nessus 6.10.x en versiones anteriores a 6.10.5 era vulnerable a un problema de escalada de privilegios locales debido a permisos inseguros al ejecutar en Agent Mode. • http://www.securityfocus.com/bid/97952 https://www.tenable.com/security/tns-2017-10 • CWE-732: Incorrect Permission Assignment for Critical Resource •