9 results (0.006 seconds)

CVSS: 5.0EPSS: 0%CPEs: 2EXPL: 0

nessusd_www_server.nbin in the Nessus Web Server plugin 1.2.4 for Nessus allows remote attackers to obtain sensitive information via a request to the /feed method, which reveals the version in a response. nessusd_www_server.nbin en el plugin Nessus Web Server v1.2.4 para Nessus permite a atacantes remotos obtener información sensible a través de una petición al método /feed, que revela la versión en una respuesta. • http://www.securityfocus.com/archive/1/512645/100/0/threaded https://discussions.nessus.org/message/7245#7245 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0

Cross-site scripting (XSS) vulnerability in nessusd_www_server.nbin in the Nessus Web Server plugin 1.2.4 for Nessus allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en nessusd_www_server.nbin del complemento Nessus Web Server v1.2.4 de Nessus. Permite a atacantes remotos inyectar codigo de script web o código HTML a través de vectores de ataque sin especificar. • http://secunia.com/advisories/40722 http://www.securityfocus.com/archive/1/512645/100/0/threaded http://www.securitytracker.com/id?1024248 https://discussions.nessus.org/message/7245#7245 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0

Cross-site scripting (XSS) vulnerability in the Windows GUI in Nessus Vulnerability Scanner before 3.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en la interfaz gráfica para Windows de Nessus Vulnerability Scanner anterior a 3.0.6 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección a través de vectores no especificados. • http://osvdb.org/37011 http://secunia.com/advisories/25856 http://www.nessus.org/news http://www.securityfocus.com/bid/24677 http://www.securitytracker.com/id?1018318 http://www.vupen.com/english/advisories/2007/2362 https://exchange.xforce.ibmcloud.com/vulnerabilities/35118 •

CVSS: 2.6EPSS: 5%CPEs: 9EXPL: 0

Nessus before 2.2.8, and 3.x before 3.0.3, allows user-assisted attackers to cause a denial of service (memory consumption) via a NASL script that calls split with an invalid sep parameter. NOTE: a design goal of the NASL language is to facilitate sharing of security tests by guaranteeing that a script "can not do anything nasty." This issue is appropriate for CVE only if Nessus users have an expectation that a split statement will not use excessive memory. • http://securityreason.com/securityalert/817 http://securitytracker.com/id?1015996 http://www.osvdb.org/25084 http://www.securityfocus.com/archive/1/431987/100/0/threaded http://www.securityfocus.com/archive/1/431993/100/0/threaded http://www.securityfocus.com/archive/1/431994/100/0/threaded http://www.vupen.com/english/advisories/2006/1541 https://exchange.xforce.ibmcloud.com/vulnerabilities/26034 https://usn.ubuntu.com/279-1 • CWE-399: Resource Management Errors •

CVSS: 2.1EPSS: 0%CPEs: 1EXPL: 0

Nessus 2.0.10a stores account passwords in plaintext in .nessusrc files, which allows local users to obtain passwords. NOTE: the original researcher reports that the vendor has disputed this issue • http://archives.neohapsis.com/archives/fulldisclosure/2004-03/1363.html http://securitytracker.com/id?1009575 http://www.osvdb.org/4816 https://exchange.xforce.ibmcloud.com/vulnerabilities/15644 • CWE-255: Credentials Management Errors •