According to its self-reported version number, the HP System Management Homepage install on the remote host is earlier than 3.0.1.73.  Such versions are reportedly affected by multiple flaws :

  - A weakness in PHP could be exploited to perform cross-     site scripting attacks, provided PHP directive 'display     errors' is enabled. (CVE-2008-5814)

  - A vulnerability in OpenSSL versions prior to 0.9.8i     could be exploited to bypass the validation of the     certificate chain. (CVE-2008-5077)

  - Windows and Linux versions of SMH are affected by a     cross-site scripting vulnerability. (CVE-2009-1418)

This update improves the verification of return values. Prior to this update it was possible to bypass the certification chain checks of openssl. (CVE-2008-5077)

This update adds openssl patches since 2007 for :

  - CVE-2009-0590

  - CVE-2008-5077

  - CVE-2009-0789

  - CVE-2009-3555

  - CVE-2010-4180

The remote VMware ESX host is missing a security-related patch. It is, therefore, is affected by multiple vulnerabilities :

  - A format string flaw exists in the Vim help tag     processor in the helptags_one() function that allows a     remote attacker to execute arbitrary code by tricking a     user into executing the 'helptags' command on malicious     help files. (CVE-2007-2953)

  - Multiple flaws exist in the Vim system functions due to     a failure to sanitize user-supplied input. An attacker     can exploit these to execute arbitrary code by tricking     a user into opening a crafted file. (CVE-2008-2712)

  - A heap-based buffer overflow condition exists in the Vim     mch_expand_wildcards() function. An attacker can exploit     this, via shell metacharacters in a crafted file name,     to execute arbitrary code. (CVE-2008-3432)

  - Multiple flaws exist in Vim keyword and tag handling due     to improper handling of escape characters. An attacker     can exploit this, via a crafted document, to execute     arbitrary shell commands or Ex commands. (CVE-2008-4101)

  - A security bypass vulnerability exists in OpenSSL due to     a failure to properly check the return value from the     EVP_VerifyFinal() function. A remote attacker can     exploit this, via a malformed SSL/TLS signature for DSA     and ECDSA keys, to bypass the validation of the     certificate chain. (CVE-2008-5077)

  - A security bypass vulnerability exists in BIND due to a     failure to properly check the return value from the     OpenSSL DSA_verify() function. A remote attacker can     exploit this, via a malformed SSL/TLS signature, to     bypass the validation of the certificate chain on those     systems using DNSSEC. (CVE-2009-0025)

The remote host is running a version of Mac OS X 10.5.x that is prior to 10.5.7. 

Mac OS X 10.5.7 contains security fixes for the following products :

  - Apache
  - ATS
  - BIND
  - CFNetwork
  - CoreGraphics
  - Cscope
  - CUPS
  - Disk Images
  - enscript
  - Flash Player plug-in
  - Help Viewer
  - iChat
  - International Components for Unicode
  - IPSec
  - Kerberos
  - Kernel
  - Launch Services
  - libxml
  - Net-SNMP
  - Network Time
  - Networking
  - OpenSSL
  - PHP
  - QuickDraw Manager
  - ruby
  - Safari
  - Spotlight
  - system_cmds
  - telnet
  - Terminal
  - WebKit
  - X11

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
38832	HP System Management Homepage < 3.0.1.73 Multiple Flaws	Nessus	CGI abuses	2009/5/20	2022/4/11	medium
41490	SuSE 10 Security Update : compat-openssl097g (ZYPP Patch Number 5957)	Nessus	SuSE Local Security Checks	2009/9/24	2021/1/14	medium
55715	SuSE 10 Security Update : compat-openssl097g (ZYPP Patch Number 7644)	Nessus	SuSE Local Security Checks	2011/7/28	2021/1/19	medium
89112	VMware ESX Multiple Vulnerabilities (VMSA-2009-0004) (remote check)	Nessus	Misc.	2016/3/3	2021/1/6	high
38744	Mac OS X 10.5.x < 10.5.7 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	2009/5/13	2024/5/28	critical

检测

插件搜索

medium

medium

medium

high

critical