According to the web server's banner, the version of HP System Management Homepage (SMH) hosted on the remote host is earlier than 7.1.1 and is, therefore, reportedly affected by the following vulnerabilities :

  - The bundled version of the libxml2 library contains     multiple vulnerabilities. (CVE-2011-1944, CVE-2011-2821,     CVE-2011-2834)

  - The bundled version of PHP contains multiple     vulnerabilities. (CVE-2011-3379, CVE-2011-4153,     CVE-2011-4885, CVE-2012-1823, CVE-2012-0057,     CVE-2012-0830)

  - The bundled version of the Apache HTTP Server contains     multiple vulnerabilities. (CVE-2011-3607, CVE-2011-4317,     CVE-2011-4415, CVE-2012-0021, CVE-2012-0031,     CVE-2012-0053)

  - An issue exists in the 'include/iniset.php' script in     the embedded RoundCube Webmail version that could lead     to a denial of service. (CVE-2011-4078)

  - The bundled version of OpenSSL contains multiple     vulnerabilities. (CVE-2011-4108, CVE-2011-4576,     CVE-2011-4577, CVE-2011-4619, CVE-2012-0027,     CVE-2012-1165)

  - The bundled version of curl and libcurl does not     properly consider special characters during extraction     of a pathname from a URL. (CVE-2012-0036)     
  - An off autocomplete attribute does not exist for     unspecified form fields, which makes it easier for     remote attackers to obtain access by leveraging an     unattended workstation. (CVE-2012-2012)

  - An unspecified vulnerability exists that could allow a     remote attacker to cause a denial of service, or     possibly obtain sensitive information or modify data.
    (CVE-2012-2013)

  - An unspecified vulnerability exists related to improper     input validation. (CVE-2012-2014)

  - An unspecified vulnerability allows remote,     unauthenticated users to gain privileges and obtain     sensitive information. (CVE-2012-2015)

  - An unspecified vulnerability allows local users to     obtain sensitive information via unknown vectors.
    (CVE-2012-2016)

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - httpd: mod_mime buffer overread (CVE-2017-7679)

  - httpd: Weak Digest auth nonce generation in mod_auth_digest (CVE-2018-1312)

  - Apache HTTP Server 1.3.22 through 1.3.27 on OpenBSD allows remote attackers to obtain sensitive     information via (1) the ETag header, which reveals the inode number, or (2) multipart MIME boundary, which     reveals child process IDs (PID). (CVE-2003-1418)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - firefox: Possible integer overflow to fix inside XML_Parse in Expat (CVE-2016-9063)

  - httpd: Weak Digest auth nonce generation in mod_auth_digest (CVE-2018-1312)

  - Apache HTTP Server 1.3.22 through 1.3.27 on OpenBSD allows remote attackers to obtain sensitive     information via (1) the ETag header, which reveals the inode number, or (2) multipart MIME boundary, which     reveals child process IDs (PID). (CVE-2003-1418)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 4 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - httpd information disclosure in FileEtag (CVE-2003-1418)

  - httpd: HTTP request smuggling attack against chunked request parser (CVE-2015-3183)

  - The (1) mod_cache and (2) mod_dav modules in the Apache HTTP Server 2.2.x before 2.2.16 allow remote     attackers to cause a denial of service (process crash) via a request that lacks a path. (CVE-2010-1452)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

ID	Name	Product	Family	Published	Updated	Severity
59851	HP System Management Homepage < 7.1.1 Multiple Vulnerabilities	Nessus	Web Servers	7/5/2012	4/11/2022	critical
198611	RHEL 5 : httpd (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	6/3/2024	6/3/2024	critical
198583	RHEL 6 : httpd (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	6/3/2024	6/3/2024	critical
198628	RHEL 4 : httpd (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	6/3/2024	6/3/2024	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical