CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 1CVE-2017-18214 – nodejs-moment: Regular expression denial of service
https://notcve.org/view.php?id=CVE-2017-18214
04 Mar 2018 — The moment module before 2.19.3 for Node.js is prone to a regular expression denial of service via a crafted date string, a different vulnerability than CVE-2016-4055. El módulo moment en versiones anteriores a la 2.19.3 para Node.js es propenso a una denegación de servicio de expresión regular (DoS) mediante una cadena de fecha manipulada. Esta vulnerabilidad es diferente de CVE-2016-4055. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application r... • https://github.com/ossf-cve-benchmark/CVE-2017-18214 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.4EPSS: 0%CPEs: 47EXPL: 0CVE-2017-11506
https://notcve.org/view.php?id=CVE-2017-11506
09 Aug 2017 — When linking a Nessus scanner or agent to Tenable.io or other manager, Nessus 6.x before 6.11 does not verify the manager's TLS certificate when making the initial outgoing connection. This could allow man-in-the-middle attacks. Cuando se enlaza un escáner o agente Nessus a Tenable.io u otro gestor, Nessus en versiones 6.x anteriores a la 6.11 no verifica el certificado TLS del gestor cuando se realiza la conexión de salida inicial. Esto podría permitir ataques man-in-the-middle. • http://www.securitytracker.com/id/1039141 • CWE-295: Improper Certificate Validation •
CVSS: 5.4EPSS: 0%CPEs: 5EXPL: 0CVE-2017-2122
https://notcve.org/view.php?id=CVE-2017-2122
12 May 2017 — Cross-site scripting vulnerability in Nessus versions 6.8.0, 6.8.1, 6.9.0, 6.9.1 and 6.9.2 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad Cross-Site Scripting (XSS) en Nessus, en las versiones 6.8.0, 6.8.1, 6.9.1 y 6.9.2 permite a los atacantes remotos autenticados inyectar scripts web o HTML arbitrarios mediante vectores sin especificar. • http://jvn.jp/en/jp/JVN87760109/index.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2017-7850
https://notcve.org/view.php?id=CVE-2017-7850
19 Apr 2017 — Nessus 6.10.x before 6.10.5 was found to be vulnerable to a local privilege escalation issue due to insecure permissions when running in Agent Mode. Se encontró que Nessus 6.10.x en versiones anteriores a 6.10.5 era vulnerable a un problema de escalada de privilegios locales debido a permisos inseguros al ejecutar en Agent Mode. • http://www.securityfocus.com/bid/97952 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2017-7849
https://notcve.org/view.php?id=CVE-2017-7849
19 Apr 2017 — Nessus 6.10.x before 6.10.5 was found to be vulnerable to a local denial of service condition due to insecure permissions when running in Agent Mode. Se encontró que Nessus 6.10.x en versiones anteriores a 6.10.5 era vulnerable a una condición local de denegación de servicio debido a permisos inseguros al ejecutarse en Agent Mode. • http://www.securityfocus.com/bid/97951 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 7.8EPSS: 0%CPEs: 12EXPL: 0CVE-2017-7199
https://notcve.org/view.php?id=CVE-2017-7199
23 Mar 2017 — Nessus 6.6.2 - 6.10.3 contains a flaw related to insecure permissions that may allow a local attacker to escalate privileges when the software is running in Agent Mode. Version 6.10.4 fixes this issue. Nessus 6.6.2 - 6.10.3 contiene un fallo relacionado con permisos inseguros que pueden permitir a un atacante local remoto aumentar privilegios cuando el software se está ejecutando en Agent Mode. Version 6.10.4 soluciona este problema. • http://www.securityfocus.com/bid/97110 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 7.3EPSS: 0%CPEs: 4EXPL: 0CVE-2017-6543
https://notcve.org/view.php?id=CVE-2017-6543
08 Mar 2017 — Tenable Nessus before 6.10.2 (as used alone or in Tenable Appliance before 4.5.0) was found to contain a flaw that allowed a remote, authenticated attacker to upload a crafted file that could be written to anywhere on the system. This could be used to subsequently gain elevated privileges on the system (e.g., after a reboot). This issue only affects installations on Windows. Tenable Nessus en versiones anteriores a 6.10.2 (tal como se utiliza sólo o en Tenable Appliance en versiones anteriores a 4.5.0) se e... • http://www.securityfocus.com/bid/96418 •
CVSS: 5.4EPSS: 0%CPEs: 4EXPL: 0CVE-2016-9259
https://notcve.org/view.php?id=CVE-2016-9259
28 Feb 2017 — Cross-site scripting (XSS) vulnerability in Tenable Nessus before 6.9.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de XSS en Tenable Nessus en versiones anteriores a 6.9.1 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a través de vectores no especificados. • http://www.securitytracker.com/id/1037293 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2016-9260
https://notcve.org/view.php?id=CVE-2016-9260
31 Jan 2017 — Cross-site scripting (XSS) vulnerability in Tenable Nessus before 6.9 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to handling of .nessus files. Vulnerabilidad de XSS en Tenable Nessus en versiones anteriores a 6.9 permite a los usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarias a través de vectores relacionados con el manejo de archivos .nessus. • http://jvn.jp/en/jp/JVN12796388/index.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 1%CPEs: 3EXPL: 1CVE-2016-4055
https://notcve.org/view.php?id=CVE-2016-4055
23 Jan 2017 — The duration function in the moment package before 2.11.2 for Node.js allows remote attackers to cause a denial of service (CPU consumption) via a long string, aka a "regular expression Denial of Service (ReDoS)." La función duration en el paquete moment en versiones anteriores a 2.11.2 para Node.js permite a atacantes remotos provocar una denegación de servicio (consumo de CPU ) a través de una cadena larga, vulnerabilidad también conocida como "Denial of Service (ReDoS) de expresión regular". • http://www.openwall.com/lists/oss-security/2016/04/20/11 • CWE-400: Uncontrolled Resource Consumption •