Oracle WebLogic, a Java EE application server, was detected on the remote host.

The remote host is running an OpenVPN server. Based on its responses, the remote host appears to be in unauthenticated mode. This means that the tunnel is unencrypted and authentication is disabled.

This plugin checks the docker diff for any running containers that are analyzed by Container Security.
Note that this plugin does not run except through a licensed Container Security account.

The Cisco Smart Install (SMI) feature is enabled on the remote host.
If the SMI Client role enabled, it is subject to protocol misuse, which could allow an unauthenticated, remote attacker to:

  - Substitute the switch's startup-config file with a file that the     attacker prepared and force a reload of the switch after a defined     time interval.

  - Load the attacker-supplied IOS image onto the switch.

  - Execute high-privilege configuration mode CLI commands on the     switch, including do-exec CLI commands.

  - Copy arbitrary files from the switch to the attacker-controlled     TFTP server.

The remote service accepts connections encrypted using TLS 1.0. TLS 1.0 has a number of cryptographic design flaws. Modern implementations of TLS 1.0 mitigate these problems, but newer versions of TLS like 1.2 and 1.3 are designed against these flaws and should be used whenever possible.

As of March 31, 2020, Endpoints that aren’t enabled for TLS 1.2 and higher will no longer function properly with major web browsers and major vendors.

PCI DSS v3.2 requires that TLS 1.0 be disabled entirely by June 30, 2018, except for POS POI terminals (and the SSL/TLS termination points to which they connect) that can be verified as not being susceptible to any known exploits.

The remote device answered a NetworkVideoTransmitter WS-Discovery request. Therefore, it supports ONVIF.

Redis, a document-oriented database system, is running on the remote host.

Oracle GoldenGate Manager, a data integration and replication solution, is running on the remote host.

The RESTful web service for AlienVault Open Source Security Information Management (OSSIM) is running on the remote host.
AlienVault OSSIM is a suite of security tools used to monitor and maintain a network.

Sophos XG Firewall, a next generation multi-protection firewall appliance, is running on the remote host.

IBM Spectrum Protect Mount, a virtual mount application that ships with Spectrum Protect, is running on the remote host.

Note that IBM Spectrum Protect was formerly known as IBM Tivoli Storage Manager (TSM) FastBack.

The remote host is an Apple TV device. Nessus was able to obtain its version and model information via an HTTP request for the '/server-info' resource.

Note that if 'Show potential false alarms' is enabled, this plugin may result in false positives.

The Docker service is running on the remote host. Docker is an open-source project that automates the deployment of applications inside software containers.

TeamSpeak 3, a proprietary Voice over IP (VoIP) conferencing software application, is running on the remote host.

This plugin detects the SAP RMI-P4 Protocol being used on the remote device.

The remote host is running Pgbouncer, a connection pooler service for PostgreSQL. Nessus was able to extract version information by logging into the Pgbouncer administrative console.

PowerFolder, a file sharing and backup utility, is running on the remote server.

A ProRat server was detected on the remote host. ProRat is a remote access trojan, which allows an attacker to control the remote system over the network.

The remote host is running Flexera FlexNet Publisher (formerly FLEXlm), a license management service. FlexNet Publisher is often bundled with third-party software and hardware license management software, and it may be part of a license management solution for a vendor other than Flexera.

Crestron QM-RMC was detected. Crestron QM-RMC is a device for networking together physical hardware for the purpose of remote control.

The remote service accepts connections encrypted using TLS 1.0. This version of TLS is affected by multiple cryptographic flaws. An attacker can exploit these flaws to conduct man-in-the-middle attacks or to decrypt communications between the affected service and clients.

Gearman, an open source job queuing and processing service, was detected on the remote host.

The remote host is running IBM Spectrum Protect for Workstations, a backup and data protection server. This product was formerly known as IBM Tivoli Storage Manager FastBack.

The remote service provides collaborative-coding and chat platform.

An NTP server is listening on port 123. If not securely configured, it may provide information about its version, current date, current time, and possibly system information.

The rsync server on the host can be remotely written to.

The remote host is running a postfix policyd service.

A Tinc VPN server was detected on the remote host. Tinc is an open source virtual private networking service that can create a secure tunnel between two or more hosts.

The remote host is an HP OfficeJet printer.

The remote host is running a management protocol for HP LeftHand OS (formerly known as SAN/iQ). This management protocol is used for remote administration of storage systems.

The remote device has the NAT-PMP protocol enabled.  This protocol allows any application on the local subnet to request port mappings from the outside to the inside. 

Make sure the use of this service is done in accordance to your security policy.  Letting any application create dynamic mappings is usually not recommended.

The remote device has the NAT-PMP protocol enabled. This protocol may allow any application on an internal subnet to request port mappings from the outside to the inside.

If this service is reachable from the outside your network, it may allow a remote attacker to gain more information about your network and possibly to break into it by creating dynamic port mappings.

The remote host is running a SAProuter server, which is used to proxy requests between SAP systems and performs access control.

The remote service supports MikroTik MAC Telnet Protocol, a proprietary protocol used to remotely administer MikroTik's RouterOS network devices.

The remote service supports MikroTik Neighbor Discovery Protocol (MNDP), used by MikroTik to locate devices in the Layer 2 broadcast domain.

The remote service is a RES Workspace Manager Relay Server.  It communicates with a central database of RES Workspace Manager, a workspace virtualization platform, or another RES Workspace Manager Relay Server and provides caching services to RES Workspace Manager Agents and other RES Workspace Manager Relay Servers.  It is used to reduce load on the RES Workspace Manager central database and improve scalability in all kinds of distributed network topologies.

The remote service is a RES Workspace Manager Agent.  It communicates with a central database of RES Workspace Manager, a workspace virtualization platform, and provides transaction services to the RES Workspace Composer.  It usually indicates that this machine has the RES Workspace Composer installed.  The RES Workspace Composer is the uniform workspace that the end users of the RES Workspace Manager Workspace virtualization platform interact with.

The remote host is running the Juniper NSM GUI Server.  The NSM GUI accepts connections from users using the NSM GUI Client, which allows for administration of the NSM servers.

The remote host is an HP switch. It is possible to read the model, serial number, and/or software version by connecting to the switch via SSH or by using SNMP.

The remote host is running a Poison Ivy client.  Poison Ivy is a Remote Administration Tool (RAT) used to control computers infected by malware. The 'client' is the component used to control those computers.  It is associated with malicious activity.

The memcached interface for Hazelcast, an open source data clustering solution, was detected on the remote host.

The wire protocol for Hazelcast, an open source data clustering solution, was found listening on the remote host.

The remote service understands the Bonjour (also known as ZeroConf or mDNS) protocol, which allows anyone to uncover information from the remote host such as its operating system type and exact version, its hostname, and the list of services it is running. 

This plugin attempts to discover mDNS used by hosts residing on the same network segment as Nessus.

The remote host exposes the ADB (Android Debug Bridge) control port of an Android emulator allowing full, unauthenticated, root access to the emulated Android device.

The Nagios Remote Plugin Executor (NRPE) was detected on the remote host.  This application allows a user to execute Nagios plugins and monitor remote machines.

A document-oriented database system is listening on the remote port.

A Git daemon using the Git protocol is running on the remote host.

This script checks the remote VNC server protocol version and the available 'security types' to determine if any unencrypted 'security-types' are in use or available.

The CXML service for EMC Data Protection Advisor, an automated analysis and alerting system for backup and replication infrastructure, was detected on the remote host.

One of the network services provided by the hydra daemon was detected on the remote host. This daemon runs on the HP LeftHand OS (formerly SAN/iQ) and is used in products such as the HP Virtual SAN appliance.
This service is used for management and control.

ID	Name	Severity
109430	Oracle WebLogic SNMP Detection (TCP)	info
107073	Unauthenticated OpenVPN Server Detection	high
106050	Docker Container File Change Detection	info
105161	Cisco Smart Install Detection	info
104743	TLS Version 1.0 Protocol Detection	medium
103869	Open Network Video Interface Forum (ONVIF) Protocol Detection	info
100635	Redis Server Detection	info
100621	Oracle GoldenGate Manager Version Detection	info
100382	AlienVault OSSIM REST API Service Detection	info
96281	Sophos XG Firewall Detection	info
96144	IBM Spectrum Protect Mount Detection	info
93741	Apple TV Version Detection	info
93561	Docker Service Detection	info
93440	TeamSpeak 3 Server Detection	info
93374	SAP RMI-P4 Protocol Detection	info
93007	Pgbouncer Service Detection	info
91817	PowerFolder Server Detection	info
90894	ProRat Detection	critical
90151	Flexera FlexNet Publisher Detection	info
87597	Crestron QM-RMC Service Detection	info
84470	TLS Version 1.0 Protocol Detection (PCI DSS)	high
83465	Gearman Server Detection	info
83300	IBM Tivoli Storage Manager FastBack Server Detection	info
83139	sobby Server Detection	info
10884	Network Time Protocol (NTP) Server Detection	info
78428	rsync Writeable Module Detection	info
78083	Postfix Policyd Protocol Detection	info
76255	Tinc VPN Service Detection	info
74268	HP OfficeJet Printer Detection	info
73460	HP LeftHand OS Management Protocol Detection	info
73125	NAT-PMP Detection (local network)	info
73124	NAT-PMP Detection (remote network)	high
72262	SAProuter Detection	info
71175	MikroTik MAC Telnet Protocol Detection	info
71077	MikroTik Neighbor Discovery Protocol Detection	info
70291	RES Workspace Manager Relay Server Detection	info
70290	RES Workspace Manager Agent Detection	info
69870	Juniper NSM GUI Server Detection	info
69322	HP Switch Identification	info
69320	Poison Ivy Detection	info
67023	Hazelcast Memcached Interface Detection	info
67022	Hazelcast Wire Protocol Detection	info
66717	mDNS Detection (Local Network)	info
66382	Android Emulator ADB Port on Remote Host	high
66360	Nagios NRPE Plugin Detect	info
65914	MongoDB Detection	info
65822	Git Protocol Detection	info
65792	VNC Server Unencrypted Communication Detection	info
64701	EMC Data Protection Advisor CXML Service Detection	info
64632	HP LeftHand OS hydra Detection	info

Detections

Analytics

Service detection Family for Nessus

info

high

info

info

medium

info

info

info

info

info

info

info

info

info

info

info

info

critical

info

info

high

info

info

info

info

info

info

info

info

info

info

high

info

info

info

info

info

info

info

info

info

info

info

high

info

info

info

info

info

info