The version of Microsoft Edge installed on the remote Windows host is prior to 127.0.2651.74. It is, therefore, affected by multiple vulnerabilities as referenced in the July 25, 2024 advisory.

  - Microsoft Edge (Chromium-based) Information Disclosure Vulnerability (CVE-2024-38103)

  - Use after free in Downloads. (CVE-2024-6988)

  - Use after free in Loader. (CVE-2024-6989)

  - Use after free in Dawn. (CVE-2024-6991)

  - The vulnerability exists due to a boundary error when processing untrusted input in ANGLE. A remote     attacker can create a specially crafted web page, trick the victim into visiting it, trigger out-of-bounds     write and execute arbitrary code on the target system. (CVE-2024-6992)

  - The vulnerability exists due to inappropriate implementation in Canvas. A remote attacker can create a     specially crafted web page, trick the victim into visiting it and gain unauthorized access to the system.
    (CVE-2024-6993)

  - Heap buffer overflow in Layout. (CVE-2024-6994)

  - Inappropriate implementation in Fullscreen. (CVE-2024-6995)

  - Race in Frames. (CVE-2024-6996)

  - Use after free in Tabs. (CVE-2024-6997)

  - Use after free in User Education. (CVE-2024-6998)

  - Inappropriate implementation in FedCM. (CVE-2024-6999, CVE-2024-7003)

  - Use after free in CSS. (CVE-2024-7000)

  - Inappropriate implementation in HTML. (CVE-2024-7001)

  - Insufficient validation of untrusted input in Safe Browsing. (CVE-2024-7004, CVE-2024-7005)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Microsoft Edge (Chromium) < 127.0.2651.74 Multiple Vulnerabilities

high Nessus Plugin ID 204747

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.4 Aug 16, 2024, 1:19 PM IAVM reference Plugin Feed: 202408161319
Version 1.3 Aug 8, 2024, 9:29 AM CVSS metrics ("CVSSv2 score" set to 10.0) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C") CVSS metrics ("CVSSv3 score" set to 8.8) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H") CVSSv2 score source (changed from "CVE-2024-38103" to "CVE-2024-7000") CVSSv2 severity (based on CVE-2024-7000, severity increased from "Medium" to "High") CVSSv3 severity (based on None, severity increased from "Medium" to "High") Plugin Feed: 202408080929
Version 1.2 Aug 2, 2024, 12:20 PM IAVM reference STIG Severity (set to "I") Plugin Feed: 202408021220
Version 1.1 Jul 26, 2024, 3:28 AM New Plugin Feed: 202407260328