The Microsoft SQL Server installation on the remote host is missing a security update. It is, therefore, affected by the following vulnerabilities:

  - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2024-26186, CVE-2024-26191, CVE-2024-37335, CVE-2024-37338,     CVE-2024-37339, CVE-2024-37340)

  - An information disclosure vulnerability. An authenticated, remote attacker can exploit this to disclose     sensitive database and file information. (CVE-2024-37337, CVE-2024-37342, CVE-2024-37966)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

Security Updates for Microsoft SQL Server (September 2024)

high Nessus Plugin ID 207067

Version 1.2