The version of Microsoft Edge installed on the remote Windows host is prior to 128.0.2739.42. It is, therefore, affected by multiple vulnerabilities as referenced in the August 22, 2024 advisory.

  - Microsoft Edge (HTML-based) Memory Corruption Vulnerability (CVE-2024-38207)

  - Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVE-2024-38209, CVE-2024-38210)

  - Use after free in Passwords in Google Chrome on Android prior to 128.0.6613.84 allowed a remote attacker     to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)     (CVE-2024-7964)

  - Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)     (CVE-2024-7965)

  - Out of bounds memory access in Skia in Google Chrome prior to 128.0.6613.84 allowed a remote attacker who     had compromised the renderer process to perform out of bounds memory access via a crafted HTML page.
    (Chromium security severity: High) (CVE-2024-7966)

  - Heap buffer overflow in Fonts in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)     (CVE-2024-7967)

  - Use after free in Autofill in Google Chrome prior to 128.0.6613.84 allowed a remote attacker who had     convinced the user to engage in specific UI interactions to potentially exploit heap corruption via a     crafted HTML page. (Chromium security severity: High) (CVE-2024-7968)

  - Type Confusion in V8 in Google Chrome prior to 128.0.6613.113 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (Chromium security severity: High) (CVE-2024-7969)

  - Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap     corruption via a crafted HTML page. (Chromium security severity: High) (CVE-2024-7971)

  - Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to     potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity:
    Medium) (CVE-2024-7972)

  - Heap buffer overflow in PDFium in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to     perform an out of bounds memory read via a crafted PDF file. (Chromium security severity: Medium)     (CVE-2024-7973)

  - Insufficient data validation in V8 API in Google Chrome prior to 128.0.6613.84 allowed a remote attacker     to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity:
    Medium) (CVE-2024-7974)

  - Inappropriate implementation in Permissions in Google Chrome prior to 128.0.6613.84 allowed a remote     attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)     (CVE-2024-7975)

  - Inappropriate implementation in FedCM in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to     perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) (CVE-2024-7976)

  - Insufficient data validation in Installer in Google Chrome on Windows prior to 128.0.6613.84 allowed a     local attacker to perform privilege escalation via a malicious file. (Chromium security severity: Medium)     (CVE-2024-7977)

  - Insufficient policy enforcement in Data Transfer in Google Chrome prior to 128.0.6613.84 allowed a remote     attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted     HTML page. (Chromium security severity: Medium) (CVE-2024-7978)

  - Insufficient data validation in Installer in Google Chrome on Windows prior to 128.0.6613.84 allowed a     local attacker to perform privilege escalation via a crafted symbolic link. (Chromium security severity:
    Medium) (CVE-2024-7979, CVE-2024-7980)

  - Inappropriate implementation in Views in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to     perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) (CVE-2024-7981)

  - Inappropriate implementation in WebApp Installs in Google Chrome on Windows prior to 128.0.6613.84 allowed     an attacker who convinced a user to install a malicious application to perform UI spoofing via a crafted     HTML page. (Chromium security severity: Low) (CVE-2024-8033)

  - Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 128.0.6613.84 allowed a     remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)     (CVE-2024-8034)

  - Inappropriate implementation in Extensions in Google Chrome on Windows prior to 128.0.6613.84 allowed a     remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)     (CVE-2024-8035)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Microsoft Edge (Chromium) < 128.0.2739.42 Multiple Vulnerabilities

critical Nessus Plugin ID 206172

Version 1.8