The remote Windows host is missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - Win32k Elevation of Privilege Vulnerability (CVE-2021-27072)

  - Microsoft Internet Messaging API Remote Code Execution Vulnerability (CVE-2021-27089)

  - RPC Endpoint Mapper Service Elevation of Privilege Vulnerability (CVE-2021-27091)

  - Windows Kernel Information Disclosure Vulnerability (CVE-2021-27093, CVE-2021-28309)

  - Windows Early Launch Antimalware Driver Security Feature Bypass Vulnerability (CVE-2021-27094,     CVE-2021-28447)

  - Windows Media Video Decoder Remote Code Execution Vulnerability (CVE-2021-27095, CVE-2021-28315)

  - NTFS Elevation of Privilege Vulnerability (CVE-2021-27096)

  - Windows Installer Spoofing Vulnerability (CVE-2021-26413)

  - Windows Installer Elevation of Privilege Vulnerability (CVE-2021-26415, CVE-2021-28440)

  - Windows WLAN AutoConfig Service Security Feature Bypass Vulnerability (CVE-2021-28316)

  - Microsoft Windows Codecs Library Information Disclosure Vulnerability (CVE-2021-28317)

  - Windows GDI+ Information Disclosure Vulnerability (CVE-2021-28318)

  - Windows DNS Information Disclosure Vulnerability (CVE-2021-28323, CVE-2021-28328)

  - Windows SMB Information Disclosure Vulnerability (CVE-2021-28325)

  - Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVE-2021-28327, CVE-2021-28329,     CVE-2021-28330, CVE-2021-28331, CVE-2021-28332, CVE-2021-28333, CVE-2021-28334, CVE-2021-28335,     CVE-2021-28336, CVE-2021-28337, CVE-2021-28338, CVE-2021-28339, CVE-2021-28340, CVE-2021-28341,     CVE-2021-28342, CVE-2021-28343, CVE-2021-28344, CVE-2021-28345, CVE-2021-28346, CVE-2021-28352,     CVE-2021-28353, CVE-2021-28354, CVE-2021-28355, CVE-2021-28356, CVE-2021-28357, CVE-2021-28358,     CVE-2021-28434)

  - Windows GDI+ Remote Code Execution Vulnerability (CVE-2021-28348, CVE-2021-28349, CVE-2021-28350)

  - Windows Event Tracing Information Disclosure Vulnerability (CVE-2021-28435)

  - Windows Installer Information Disclosure Vulnerability (CVE-2021-28437)

  - Windows TCP/IP Driver Denial of Service Vulnerability (CVE-2021-28439)

  - Windows Console Driver Denial of Service Vulnerability (CVE-2021-28443)

  - Windows Hyper-V Security Feature Bypass Vulnerability (CVE-2021-28444)

  - Windows Network File System Remote Code Execution Vulnerability (CVE-2021-28445)   
  - Windows Portmapping Information Disclosure Vulnerability (CVE-2021-28446)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

KB5001382: Windows 8.1 and Windows Server 2012 R2 Security Update (Apr 2021)

high Nessus Plugin ID 148477

Version 1.16

Version 1.15

Version 1.14

Version 1.14

Version 1.13

Version 1.16 Jun 17, 2024, 3:35 PM Plugin metadata (add more granular CPEs to Windows OS plugins) Plugin Feed: 202406171535
Version 1.15 Jan 4, 2024, 3:23 PM CVSSv3 score source (changed from "CVE-2021-28445" to "CVE-2021-28434") Plugin Feed: 202401041523
Version 1.14 Sep 22, 2023, 6:10 PM Detection Plugin Feed: 202309221810
Version 1.14 Jan 4, 2024, 1:31 PM CVSSv3 score source (changed from "CVE-2021-28445" to "CVE-2021-28434") Plugin Feed: 202401041331
Version 1.13 Dec 6, 2022, 1:01 AM Reference Plugin Feed: 202212060101