According to its self-reported version, the instance of Drupal running on the remote web server is 7.x prior to 7.66, 8.5.x prior to 8.5.15, or 8.6.x prior to 8.6.15. It is, therefore, affected by multiple vulnerabilities.

  - The jQuery project released version 3.4.0, and as part     of that, disclosed a security vulnerability that affects     all prior versions. As described in their release notes:
    jQuery 3.4.0 includes a fix for some unintended behavior     when using jQuery.extend(true, {}, ...). If an     unsanitized source object contained an enumerable
    __proto__ property, it could extend the native     Object.prototype. This fix is included in jQuery 3.4.0,     but patch diffs exist to patch previous jQuery versions.
    It's possible that this vulnerability is exploitable     with some Drupal modules. As a precaution, this Drupal     security release backports the fix to jQuery.extend(),     without making any other changes to the jQuery version     that is included in Drupal core (3.2.1 for Drupal 8 and     1.4.4 for Drupal 7) or running on the site via some     other module such as jQuery Update. (SA-CORE-2019-006)

  - This security release fixes third-party dependencies     included in or required by Drupal core. CVE-2019-10909:
    Escape validation messages in the PHP templating engine.
    From that advisory:Validation messages were not escaped     when using the form theme of the PHP templating engine     which, when validation messages may contain user input,     could result in an XSS. CVE-2019-10910: Check service     IDs are valid. From that advisory: Service IDs derived     from unfiltered user input could result in the execution     of any arbitrary code, resulting in possible remote code     execution. CVE-2019-10911: Add a separator in the     remember me cookie hash. From that advisory: This fixes     situations where part of an expiry time in a cookie     could be considered part of the username, or part of the     username could be considered part of the expiry time. An     attacker could modify the remember me cookie and     authenticate as a different user. This attack is only     possible if remember me functionality is enabled and the     two users share a password hash or the password hashes     (e.g. UserInterface::getPassword()) are null for all     users (which is valid if passwords are checked by an     external system, e.g. an SSO). (CVE-2019-10909,     CVE-2019-10910, CVE-2019-10911)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Oracle Primavera Unifier installation running on the remote web server is 16.x prior to 16.2.15.7 or 17.7.x prior to 17.12.10 or 18.x prior to 18.8.6. It is, therefore, affected by multiple vulnerabilities:

  - A deserialization vulnerability in Apache Commons     FileUpload allows for remote code execution.
    (CVE-2016-1000031)

  - A denial of service (DoS) vulnerability exists in     Apache HTTP Server 2.4.17 to 2.4.34, due to a design     error. An unauthenticated, remote attacker can     exploit this issue by sending continuous, large     SETTINGS frames to cause a client to occupy a     connection, server thread and CPU time without any     connection timeout coming to effect. This affects     only HTTP/2 connections. A possible mitigation is to     not enable the h2 protocol. (CVE-2018-11763).

  - A deserialization vulnerability in jackson-databind, a     fast and powerful JSON library for Java, allows an     unauthenticated user to perform code execution. The     issue was resolved by extending the blacklist and     blocking more classes from polymorphic deserialization.
    (CVE-2018-19362)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Oracle Primavera P6 Enterprise Project Portfolio Management (EPPM) installation running on the remote web server is 8.4 prior to 8.4.15.10, 15.x prior to 15.2.18.4, 16.x prior to 16.2.17.2, 17.x prior to 17.12.12.0, or 18.x prior to 18.8.8.0. It is, therefore, affected by multiple vulnerabilities:

  - A deserialization vulnerability in Apache Commons     FileUpload allows for remote code execution.
    (CVE-2016-1000031)

  - A denial of service vulnerability in the bundled     third-party component OpenSSL library's DSA signature     algorithm that renders it vulnerable to a timing side     channel attack. An attacker could leverage this     vulnerability to recover the private key.
    (CVE-2018-0734)

  - A deserialization vulnerability in jackson-databind, a     fast and powerful JSON library for Java, allows an     unauthenticated user to perform code execution. The     issue was resolved by extending the blacklist and     blocking more classes from polymorphic deserialization.
    (CVE-2018-19362)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Jenkins running on the remote web server is prior to 2.172 or is a version of Jenkins LTS prior to 2.164.2. It is, therefore, affected by multiple vulnerabilities:

  - An authentication bypass condition exists due to an incomplete fix for SECURITY-901, in which existing     remote-based CLI authentication caches. An unauthenticated, remote attacker can exploit this to bypass     existing Access Control Limitations and appear as an authenticated user. (CVE-2019-1003049)

  - A cross-site scripting (XSS) vulnerability exists due to improper validation of user-supplied input before     returning it to users. An unauthenticated, remote attacker can exploit this, by convincing a user to click     a specially crafted URL, to execute arbitrary script code in a user's browser session. (CVE-2019-1003050)     Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A cross-site scripting (XSS) vulnerability exists in HP Integrated Lights-Out 5 (iLO 5) due to improper validation of user-supplied input before returning it to users. An unauthenticated, remote attacker can exploit this, by convincing a user to click a specially crafted URL, to execute arbitrary script code in a user's browser session.

The HP DesignJet printer is affected by an information disclosure vulnerability due to exposure of the accounting.xls file. An unauthenticated, remote attacker can exploit this to disclose printer user names, document titles, and other information on print jobs.

According to the tests performed by Nessus, the remote host is affected by the following vulnerability:

  - A server-side template injection exists in the Widget     Connector due to improper input validation. An attacker     can exploit this, via unspecified vectors, to traverse     directories or execute arbitrary code. (CVE-2019-3396)

The remote Citrix SD-WAN Center is affected by a remote command injection vulnerability due to improper sanitization of user-supplied input. An unauthenticated, remote attacker can exploit this, via a specially crafted HTTP request, to execute arbitrary commands on the remote host with root privileges.

According to its self-reported version number, the Joomla! installation running on the remote web server is 1.5.0 or later but prior to 3.9.5. It is, therefore, affected by multiple vulnerabilities:

  - A directory traversal vulnerability exists in versions 1.5.0 to 3.9.4 within the Media Manager component     due to improperly sanitizing the folder parameter. An authenticated, remote attacker can exploit this, by     sending a URI that contains directory traversal characters, to disclose the contents of files located     outside of the server's restricted path. (CVE-2019-10945)

  - An access control limit bypass exists in versions 3.2.0 to 3.9.4 within the gethelpsites() function of the     com_users component. An unauthenticated, remote attacker can exploit this and access the 'refresh list of     helpsites' endpoint. (CVE-2019-10946)

 - A cross-site scripting (XSS) vulnerability exists in versions 3.0.0 to 3.9.4 due to improper validation of    user-supplied input before returning it to users. An unauthenticated, remote attacker can exploit this, by    convincing a user to click a specially crafted URL, to execute arbitrary script code in a user's browser    session.


Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

The version of Kubernetes installed on the remote host is version 1.x prior to 1.11.8, 1.12.x prior to 1.12.6 or 1.13.x prior to 1.13.4. It is, therefore, affected by a denial of service vulnerability in the API server. An authenticated, remote attacker can exploit this via a specially crafted patch request of type json-patch to cause the API Server to stop responding.

According to its banner, the version of PHP running on the remote web server is 7.3.x prior to 7.3.3. It is, therefore, affected by multiple vulnerabilities:

  - Uninitialized reads in the EXIF component of PHP due     to the mishandling of data in exif_process_IFD_in_MAKERNOTE,     and exif_process_IFD_in_TIFF. (CVE-2019-3638, CVE-2019-3639,     CVE-2019-3641)

  - An invalid read in the EXIF component of PHP due to a     mishandling of data in exif_process_SOFn. (CVE-2019-3640)

  - An access control bypass vulnerability exists due to the     way rename() is implemented. This could allow unauthorized     users to access data they otherwise would not have access     to (CVE-2019-9637).

According to its banner, the version of PHP running on the remote web server is 7.2.x prior to 7.2.16. It is, therefore, affected by multiple vulnerabilities:

  - Uninitialized reads in the EXIF component of PHP due     to the mishandling of data in exif_process_IFD_in_MAKERNOTE,     and exif_process_IFD_in_TIFF. (CVE-2019-3638, CVE-2019-3639,     CVE-2019-3641)

  - An invalid read in the EXIF component of PHP due to a     mishandling of data in exif_process_SOFn. (CVE-2019-3640)

  - An access control bypass vulnerability exists due to the     way rename() is implemented. This could allow unauthorized     users to access data they otherwise would not have access     to (CVE-2019-9637).

According to its banner, the version of PHP running on the remote web server is 7.1.x prior to 7.1.27. It is, therefore, affected by multiple vulnerabilities:

  - Uninitialized reads in the EXIF component of PHP due     to the mishandling of data in exif_process_IFD_in_MAKERNOTE,     and exif_process_IFD_in_TIFF. (CVE-2019-3638, CVE-2019-3639,     CVE-2019-3641)

  - An invalid read in the EXIF component of PHP due to a     mishandling of data in exif_process_SOFn. (CVE-2019-3640)

  - An access control bypass vulnerability exists due to the     way rename() is implemented. This could allow unauthorized     users to access data they otherwise would not have access     to (CVE-2019-9637).

The version of Apache ActiveMQ running on the remote host is 5.x prior to 5.15.9. It is, therefore, affected by a denial of service (DoS) vulnerability due to improper validation of MQTT frames. An unauthenticated, remote attacker can exploit this issue to cause the broker to stop responding.

According to its banner, the version of PHP running on the remote web server is 7.3.x prior to 7.3.4. It is, therefore, affected by multiple vulnerabilities:

  - A heap-based buffer over-read condition exists in     php_ifd_get32s in exif.c.

  - A heap-based buffer overflow condition exists in     exif_iif_add_value in exif.c as a result of improperly     checking input length.

According to its banner, the version of PHP running on the remote web server is 7.2.x prior to 7.2.17. It is, therefore, affected by multiple vulnerabilities:

  - A heap-based buffer over-read condition exists in     php_ifd_get32s in exif.c.

  - A heap-based buffer overflow condition exists in     exif_iif_add_value in exif.c as a result of improperly     checking input length.

According to its banner, the version of PHP running on the remote web server is 7.1.x prior to 7.1.28. It is, therefore, affected by multiple vulnerabilities:

  - A heap-based buffer over-read condition exists in     php_ifd_get32s in exif.c.

  - A heap-based buffer overflow condition exists in     exif_iif_add_value in exif.c as a result of improperly     checking input length.

According to its self-reported version, the installation of Atlassian Fisheye running on the remote Windows host is prior to 4.4.6 or 4.5.x prior to 4.5.3. It is, therefore, affected by a remote command execution vulnerability due to improper sanitization of characters in a Mercurial repository URI which may be interpreted as argument parameters on the Windows operating system. An authenticated, remote attacker can exploit this to execute arbitrary commands with the privileges of the user running the server. 

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version, the installation of Atlassian Crucible running on the remote  Windows host is prior to 4.4.6 or 4.5.x prior to 4.5.3. It is, therefore, affected by a remote command execution vulnerability due to improper sanitization of characters in a Mercurial repository URI which may be interpreted as argument parameters on the Windows operating system. An authenticated, remote attacker can exploit this to execute arbitrary commands with the privileges of the user running the server. 

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The WP Google Maps plugin for WordPress running on the remote web server is affected by an SQL injection (SQLi) vulnerability due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to inject or manipulate SQL queries in the back-end database, resulting in the disclosure or manipulation of arbitrary data.

The Magento application running on the remote web server is affected by a SQL injection vulnerability due to failing to properly sanitize the user-supplied 'from' and 'to' inputs to the 'prepareSqlCondition' function of the 'Magento\Framework\DB\Adapter\Pdo\Mysql' class. An unauthenticated, remote attacker can exploit this to execute arbitrary SQL statements against the back-end database, leading to the execution of arbitrary code, manipulation of data, or disclosure of sensitive information.

The version of Apache Solr running on the remote web server is affected by a remote code execution vulnerability in the Config API due to unsafe deserialization of Java objects. An unauthenticated, remote attacker can exploit this, via an HTTP POST request that points the JMX server to a  malicious RMI server. An attacker could then send a crafted serialized Java object to the server, to execute arbitrary code.

According to its self-reported version number, the phpMyAdmin application hosted on the remote web server is 4.x prior to 4.8.5. It is, therefore, affected by at least one of the following vulnerabilities:

  - A SQL injection (SQLi) vulnerability exists in phpMyAdmin due to improper validation of user-supplied input.
  An unauthenticated, remote attacker can exploit this to inject or manipulate SQL queries in the back-end database,   resulting in the disclosure or manipulation of arbitrary data (CVE-2019-6798).

  - An arbitrary file read vulnerability exists in phpMyAdmin when the AllowArbitraryServer configuration setting is   set to true. An unauthenticated, remote attacker can exploit this, via a rogue MySQL server, to read arbitrary files   and disclose sensitive information (CVE-2019-6799).

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 6.6.12, 6.7.x prior to 6.12.3, 6.13.x prior to 6.13.3, or 6.14.x prior to 6.14.2. It is, therefore, affected by the following vulnerabilities :

  - A server-side request forgery (SSRF) exists in the     WebDAV plugin due to improper input validation. An     attacker can exploit this, via unspecified vectors, to     send arbitrary HTTP and WebDAV requests from the     application. (CVE-2019-3395)

  - A server-side template injection exists in the Widget     Connector due to improper input validation. An attacker     can exploit this, via unspecified vectors, to traverse     directories or execute arbitrary code. (CVE-2019-3396)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Easy WP SMTP Plugin for WordPress running on the remote web server is version 1.3.9. It is, therefore, affected by an unauthenticated remote code execution vulnerability.

Nessus was able to gain access to the Atlassian JIRA web application using a common set of credentials. A remote attacker can exploit this issue to disclose sensitive information or otherwise affect the operation of the application and underlying system.

A sensitive data disclosure flaw was found in the way Logstash logs malformed URLs. If a malformed URL is specified as part of the Logstash configuration, the credentials for the URL could be inadvertently logged as part of the error message.

A permission issue was found in Elasticsearch when Field Level Security and Document Level Security are disabled and the _aliases,
_shrink, or _split endpoints are used . If the elasticsearch.yml file has xpack.security.dls_fls.enabled set to false, certain permission checks are skipped when users perform one of the actions mentioned above, to make existing data available under a new index/alias name.
This could result in an attacker gaining additional permissions against a restricted index.

According to its self-reported version number, the WordPress application running on the remote web server is affected by multiple vulnerabilities:

  - A cross-site request forgery (XSRF) vulnerability     exists in the comment form due to improper validation. A     remote attacker can exploit this by tricking a user into     visiting a specially crafted web page, allowing the     attacker to create comments on the administrator's     behalf.

  - A cross-site scripting (XSS) vulnerability exists due     to improper validation of user-supplied input before     returning it to users. An unauthenticated, remote     attacker can exploit this, by convincing a user to     click a specially crafted URL, to execute arbitrary     script code in a user's browser session.

According to its banner, the version of PHP running on the remote web server is 7.0.x prior to 7.0.33. It is, therefore, affected by multiple vulnerabilities:

  - An arbitrary command injection vulnerability exists in   the imap_open function due to improper filters for mailbox names   prior to passing them to rsh or ssh commands. An authenticated,   remote attacker can exploit this by sending a specially crafted IMAP   server name to cause the execution of arbitrary commands on the   target system. (CVE-2018-19518)

  - A heap buffer over-read exists in the phar_parse_pharfile function.
  An unauthenticated, remote attacker can exploit this to read   allocated or unallocated memory past the actual data when trying to   parse a .phar file. (CVE-2018-20783)

According to its self-reported version number, the Joomla! installation running on the remote web server is prior to 3.9.4.
It is, therefore, affected by multiple vulnerabilities:

  - A logic error exists in sample data plugins that allows     remote attackers to gain unauthorized access to     unspecified elements. (CVE-2019-9713)

  - Multiple flaws exist in input-validation processes that     allow an unauthenticated, remote attacker to carry out     cross-site scripting (XSS) attacks. (CVE-2019-9711,     CVE-2019-9712, CVE-2019-9714)

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

The Aruba Virtual Application Networks (VAN) Software Defined Networking (SDN) controller running on the remote host is configured with default credentials. A default service token is configured or the 'sdn' account is using a default password. An unauthenticated, remote attacker can exploit this to gain privileged or administrator access to the system.

According to its banner, the version of PHP running on the remote web server is 7.3.x prior to 7.3.2. It is, therefore, affected by: 

  - An out-of-bounds read error exists in the dns_get_record function     due to improper parsing of DNS responses. An unauthenticated,     remote attacker can exploit this, via a specially crafted DNS     reply, to disclose memory contents.

The version of EMC RSA Authentication Manager running on the remote host is prior to 8.4 Patch 1. It is, therefore, affected by an insecure credential management vulnerability in the operations console components. An authenticated, remote attacker with administrator privileges can exploit this, to obtain the value of a domain password that another operations console administrator had set previously.

The version of EMC RSA Archer running on the remote web server is prior to 6.4.1.5 or 6.5.x < 6.5.0.2. It is, therefore, affected by multiple vulnerabilities :

  - An information disclosure vulnerability exists in RSA Archer     versions, prior to 6.5 SP2 (6.5.0.2). An authenticated malicious     local user with access to the log files may obtain the database     connection password to use it in further attacks. (CVE-2019-3716)

  - An information disclosure vulnerability exists in RSA Archer     versions, prior to 6.5 SP1 (6.5.0.1). An authenticated malicious     local user with access to the log files may obtain user session     information to use it in further attacks. (CVE-2019-3705)

  - An information disclosure vulnerability exists in RSA Archer     versions, prior to 6.5 SP2 (6.5.0.2). An authenticated malicious     local user with access to the log files may obtain the database     connection password to use it in further attacks. (CVE-2019-3706)

Note that version 6.4 SP1 P5 (6.4.1.5) also fixed these vulnerabilities.

The remote web application displays plaintext credit card information without the appropriate masking.

According to its self-reported version number, the instance of Atlassian JIRA hosted on the remote web server is potentially affected by an authentication bypass on certain administrative resources, which could allow an attacker to run import operations or reveal sensitive information.

According to its self-reported version number, the instance of Atlassian JIRA hosted on the remote web server is potentially affected by a cross-site request forgery in the IncomingMailServers resource. A remote attacker can exploit this by tricking a user into visiting a specially crafted web page, allowing the attacker to disclose sensitive information, impersonate the user's identity, or inject malicious content into the victim's web browser.

According to its self-reported version number, the instance of Atlassian JIRA hosted on the remote web server is potentially affected by multiple vulnerabilities:

  - A cross-site scripting (XSS) vulnerability exists due to     improper validation of user-supplied input before     returning it to users. An unauthenticated, remote     attacker can exploit this, by convincing a user to click     a specially crafted URL, to execute arbitrary script     code in a user's browser session. (CVE-2017-18097,     CVE-2017-18098)

  - A server-side request forgery (SSRF) vulnerability     exists, allowing an attacker to potentially reveal     sensitive internal data. (CVE-2017-16865)

According to its self-reported version number, the instance of Atlassian JIRA hosted on the remote web server is potentially affected by a cross-site scripting vulnerability in the PieChart Gadget. An unauthenticated, remote attacker can exploit this, by convincing a user to click a specially crafted URL, to execute arbitrary code in a user's browser session.

According to its self-reported version number, the instance of Atlassian JIRA hosted on the remote web server is potentially affected by a cross-site scripting vulnerability in the jqlQuery query parameter of the printable searchrequest issue resource. An unauthenticated, remote attacker can exploit this, by convincing a user to click a specially crafted URL, to execute arbitrary code in a user's browser session.

According to its self-reported version number, the instance of Atlassian JIRA hosted on the remote web server is potentially affected by an information disclosure vulnerability due to webhook events being sent improperly due to issues in the related JQL filter.

According to its self-reported version number, the instance of Atlassian JIRA hosted on the remote web server is potentially affected by a cross-site scripting vulnerability in EditIssue.jspa. An unauthenticated, remote attacker can exploit this, by convincing a user to click a specially crafted URL, to execute arbitrary code in a user's browser session.

According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.35. It is, therefore, affected by a security bypass vulnerability. Dumpable FPM child processes allow bypassing opcache access controls because fpm_unix.c makes a PR_SET_DUMPABLE prctl call, allowing one user (in a multiuser environment) to obtain sensitive information from the process memory of a second user's PHP applications by running gcore on the PID of the PHP-FPM worker process.

According to its banner, the version of PHP installed on the remote host is 5.4.x earlier than 5.4.0, and, therefore, potentially affected by multiple vulnerabilities :

  - crypt_blowfish as used in PHP does not properly handle     8-bit characters, which makes it easier for     context-dependent attackers to determine a cleartext     password by leveraging knowledge of a password hash.
    (CVE-2011-2483)

  - Multiple NULL Pointer Dereference with the     zend_strndup() fucntion could allow a remote attacker     to cause a denial of service. (CVE-2011-4153)

  - A flaw in SSL sockets with SSL 3.0 / TLS 1.0 was     addressed. (CVE-2011-3389)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Kibana versions before 5.6.15 and 6.6.1 have the following vulnerabilities:

  - A cross-site scripting (XSS) vulnerability that could     allow an attacker to obtain sensitive information from     or perform destructive actions on behalf of other     Kibana users. (CVE-2019-7608)

  - An arbitrary code execution flaw in the Timelion     visualizer. An attacker with access to the Timelion     application could send a request that will attempt to     execute javascript code. This could possibly lead to an     attacker executing arbitrary commands with permissions     of the Kibana process on the host system. (CVE-2019-7609)

  - An arbitrary code execution flaw in the security audit     logger. If a Kibana instance has the setting     xpack.security.audit.enabled set to true, an attacker     could send a request that will attempt to execute     javascript code. This could possibly lead to an attacker     executing arbitrary commands with permissions of the     Kibana process on the host system. (CVE-2019-7610)

The scanner was able to send specially crafted input to one or more endpoints and parameters on the remote host that resulted in an injection into a SQL query, allowing arbitrary SQL statements to be executed on the remote host.

According to its banner, the version of PHP running on the remote web server is 7.0.x prior to 7.0.23. It is, therefore, affected by a heap-based buffer overflow condition exists in the ext/standard/var_unserializer.re script due to improper use of the hash API for key deletion. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP running on the remote web server is 7.1.x prior to 7.1.9. It is, therefore, affected by a heap-based buffer overflow condition exists in the ext/standard/var_unserializer.re script due to improper use of the hash API for key deletion. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP running on the remote web server is 7.1.x prior to 7.1.8. It is, therefore, affected by a denial of service (DoS) vulnerability exists in the ext/wddx/wddx.c script due to the use of an invalid free for an empty boolean element. An unauthenticated, remote attacker can exploit this issue to cause the application to stop responding.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Severity
124176	Drupal 7.x < 7.66 / 8.5.x < 8.5.15 / 8.6.x < 8.6.15 Multiple Vulnerabilities (drupal-2019-04-17)	High
124170	Oracle Primavera Unifier Multiple Vulnerabilities (Apr 2019 CPU)	High
124169	Oracle Primavera P6 Enterprise Project Portfolio Management (EPPM) Multiple Vulnerabilities (Apr 2019 CPU)	High
124168	Jenkins < 2.164.2 LTS / 2.172 Multiple Vulnerabilities	Medium
124119	iLO 5 < 1.40 Cross Site Scripting (XSS) Vulnerability	High
124086	HP DesignJet Accounting.xls Information Disclosure Vulnerability	Medium
124004	Atlassian Confluence < 6.6.12 / 6.7.x < 6.12.3 / 6.13.x < 6.13.3 / 6.14.x < 6.14.2 Template Injection	High
124000	Citrix SD-WAN Center Command Injection	Critical
123954	Joomla! 1.5.0 < 3.9.5 Multiple Vulnerabilities	Medium
123831	Kubernetes 1.x < 1.11.8 / 1.12.x < 1.12.6 / 1.13.x < 1.13.4 API server DOS	Medium
123829	PHP 7.3.x < 7.3.3 Multiple vulnerabilities.	High
123828	PHP 7.2.x < 7.2.16 Multiple vulnerabilities.	High
123827	PHP 7.1.x < 7.1.27 Multiple vulnerabilities.	High
123756	Apache ActiveMQ 5.x < 5.15.9 Corrupt MQTT Frame Denial of Service (DoS) (CVE-2019-0222)	Medium
123755	PHP 7.3.x < 7.3.4 Multiple vulnerabilities.	Medium
123754	PHP 7.2.x < 7.2.17 Multiple vulnerabilities.	Medium
123753	PHP 7.1.x < 7.1.28 Multiple vulnerabilities.	Medium
123688	Atlassian Fisheye for Windows < 4.4.6, 4.5.x < 4.5.3 Remote Code Execution Vulnerability	Medium
123687	Atlassian Crucible for Windows < 4.4.6, 4.5.x < 4.5.3 Remote Code Execution Vulnerability	Medium
123643	WP Google Maps for WordPress < 7.11.17 Unauthenticated SQL Injection (CVE-2019-10692)	High
123519	Magento 2.2.x < 2.2.8 / 2.3.x < 2.3.1 Unauthenticated SQLi	High
123417	Apache Solr 5.x <= 5.5.5 or 6.x <= 6.6.5 Deserialization Vulnerability	High
123416	phpMyAdmin 4.x < 4.8.5 Multiple Vulnerabilities (PMASA-2019-1) (PMASA-2019-2)	High
123008	Atlassian Confluence < 6.6.12 / 6.7.x < 6.12.3 / 6.13.x < 6.13.3 / 6.14.x < 6.14.2 Multiple Vulnerabilities	Critical
123004	Easy WP SMTP Plugin for WordPress 1.3.9 Unauthenticated Remote Code Execution	Critical
123003	Atlassian JIRA Common Credentials	Critical
122977	Logstash ESA-2019-05	Medium
122973	Elasticsearch ESA-2019-04	Medium
122823	WordPress < 5.1.1 Multiple Vulnerabilities	Medium
122821	PHP 7.0.x < 7.0.33 Multiple vulnerabilities	High
122814	Joomla! 3.x < 3.9.4 Multiple Vulnerabilities	High
122755	Aruba VAN SDN default credentials	Critical
122750	PHP 7.3.x < 7.3.2 Information Disclosure.	Medium
122717	EMC RSA Authentication Manager < 8.4 P1 Insecure Credential Management (DSA-2019-038)	Medium
122649	EMC RSA Archer < 6.4.1.5 / 6.5.x < 6.5.0.2 Multiple Vulnerabilities	High
122648	Credit Card Disclosure in HTML	Medium
122598	Atlassian JIRA < 7.6.5 / 7.7.x < 7.7.3 / 7.8.x < 7.8.3 Limited Authentication Bypass	Medium
122597	Atlassian JIRA < 7.6.2 Cross-Site Request Forgery	Medium
122596	Atlassian JIRA < 7.6.1 Multiple Vulnerabilities	Medium
122595	Atlassian JIRA < 7.5.3 Cross-Site Scripting	Medium
122594	Atlassian JIRA < 7.2.12 / 7.3.x < 7.6.1 Cross-Site Scripting	Medium
122593	Atlassian JIRA < 7.6.7 / 7.7.x < 7.11.0 Information Disclosure	Medium
122592	Atlassian JIRA < 7.6.7 / 7.7.x < 7.10.1 Cross-Site Scripting	Medium
122591	PHP 5.6.x < 5.6.35 Security Bypass Vulnerability	Low
122590	PHP 5.4.x < 5.4.0 Multiple Vulnerabilities	Medium
122589	Kibana ESA-2019-01, ESA-2019-02, ESA-2019-03	High
122584	SQLi scanner	High
122544	PHP 7.2.x < 7.2.0 Heap-based Buffer Overflow Vulnerability	High
122543	PHP 7.1.x < 7.1.9 Heap-based Buffer Overflow Vulnerability	High
122542	PHP 7.1.x < 7.1.8 Denial of Service Vulnerability	Medium

CGI abuses Family for Nessus