Page 6 of 61 results (0.009 seconds)

CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 1

04 Mar 2018 — The moment module before 2.19.3 for Node.js is prone to a regular expression denial of service via a crafted date string, a different vulnerability than CVE-2016-4055. El módulo moment en versiones anteriores a la 2.19.3 para Node.js es propenso a una denegación de servicio de expresión regular (DoS) mediante una cadena de fecha manipulada. Esta vulnerabilidad es diferente de CVE-2016-4055. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application r... • https://github.com/ossf-cve-benchmark/CVE-2017-18214 • CWE-400: Uncontrolled Resource Consumption •

CVSS: 7.3EPSS: 0%CPEs: 4EXPL: 0

08 Mar 2017 — Tenable Nessus before 6.10.2 (as used alone or in Tenable Appliance before 4.5.0) was found to contain a flaw that allowed a remote, authenticated attacker to upload a crafted file that could be written to anywhere on the system. This could be used to subsequently gain elevated privileges on the system (e.g., after a reboot). This issue only affects installations on Windows. Tenable Nessus en versiones anteriores a 6.10.2 (tal como se utiliza sólo o en Tenable Appliance en versiones anteriores a 4.5.0) se e... • http://www.securityfocus.com/bid/96418 •

CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0

31 Jan 2017 — Cross-site scripting (XSS) vulnerability in Tenable Nessus before 6.9 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to handling of .nessus files. Vulnerabilidad de XSS en Tenable Nessus en versiones anteriores a 6.9 permite a los usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarias a través de vectores relacionados con el manejo de archivos .nessus. • http://jvn.jp/en/jp/JVN12796388/index.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 7.8EPSS: 3%CPEs: 3EXPL: 1

23 Jan 2017 — The duration function in the moment package before 2.11.2 for Node.js allows remote attackers to cause a denial of service (CPU consumption) via a long string, aka a "regular expression Denial of Service (ReDoS)." La función duration en el paquete moment en versiones anteriores a 2.11.2 para Node.js permite a atacantes remotos provocar una denegación de servicio (consumo de CPU ) a través de una cadena larga, vulnerabilidad también conocida como "Denial of Service (ReDoS) de expresión regular". • http://www.openwall.com/lists/oss-security/2016/04/20/11 • CWE-400: Uncontrolled Resource Consumption •

CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0

05 Jan 2017 — Cross-site scripting (XSS) vulnerability in Tenable Nessus before 6.9.3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de XSS en Tenable Nessus en versiones anteriores a 6.9.3 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a través de vectores no especificados. • http://www.securityfocus.com/bid/95307 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0

03 Jul 2007 — Cross-site scripting (XSS) vulnerability in the Windows GUI in Nessus Vulnerability Scanner before 3.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en la interfaz gráfica para Windows de Nessus Vulnerability Scanner anterior a 3.0.6 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección a través de vectores no especificados. • http://osvdb.org/37011 •

CVSS: 7.5EPSS: 1%CPEs: 9EXPL: 0

29 Apr 2006 — Nessus before 2.2.8, and 3.x before 3.0.3, allows user-assisted attackers to cause a denial of service (memory consumption) via a NASL script that calls split with an invalid sep parameter. NOTE: a design goal of the NASL language is to facilitate sharing of security tests by guaranteeing that a script "can not do anything nasty." This issue is appropriate for CVE only if Nessus users have an expectation that a split statement will not use excessive memory. • http://securityreason.com/securityalert/817 • CWE-399: Resource Management Errors •

CVSS: 7.0EPSS: 0%CPEs: 13EXPL: 0

31 Dec 2004 — A race condition in nessus-adduser in Nessus 2.0.11 and possibly earlier versions, if the TMPDIR environment variable is not set, allows local users to gain privileges. • http://secunia.com/advisories/12127 •

CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0

06 Jun 2003 — Multiple buffer overflows in libnasl in Nessus before 2.0.6 allow local users with plugin upload privileges to cause a denial of service (core dump) and possibly execute arbitrary code via (1) a long proto argument to the scanner_add_port function, (2) a long user argument to the ftp_log_in function, (3) a long pass argument to the ftp_log_in function. Múltiples desbordamientos de búfer en Nessus anterior a la 2.0.6 permiten que usuarios locales con privilegios de carga de plugin provoquen una denegación de... • http://marc.info/?l=bugtraq&m=105364059803427&w=2 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •

CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0

06 Jun 2003 — Multiple unknown vulnerabilities in Nessus before 2.0.6, in libnessus and possibly libnasl, a different set of vulnerabilities than those identified by CVE-2003-0372 and CVE-2003-0373, aka "similar issues in other nasl functions as well as in libnessus." Múltiples vulnerabilidades desconocidas en Nessus anterior a la 2.0.6, en libnessus y posiblemente libnsl (un conjunto diferente de las señaladas en CAN-2003-0372 y CAN-2003-0373). • http://marc.info/?l=bugtraq&m=105364059803427&w=2 •