The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2020:3385 advisory.

  - libvncserver: websocket decoding buffer overflow (CVE-2017-18922)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2020:4712 advisory.

  - subversion: remotely triggerable DoS vulnerability in svnserve 'get-deleted-rev' (CVE-2018-11782)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2020:1921 advisory.

  - fontforge: out-of-bounds write in SFD_GetFontMetaData function in sfd.c (CVE-2020-5395)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2020:1293 advisory.

  - ICU: Integer overflow in UnicodeString::doAppend() (CVE-2020-10531)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:5567 advisory.

  - postgresql: Reconnection can downgrade connection security settings (CVE-2020-25694)

  - postgresql: Multiple features escape security restricted operation sandbox (CVE-2020-25695)

  - postgresql: psql's \gset allows overwriting specially treated variables (CVE-2020-25696)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:1577 advisory.

  - exiv2: infinite recursion in Exiv2::Image::printTiffStructure in file image.cpp resulting in denial of     service (CVE-2019-9143)

  - exiv2: null pointer dereference in the Exiv2::DataValue::toLong function in value.cpp (CVE-2017-18005)

  - exiv2: OOB read in pngimage.cpp:tEXtToDataBuf() allows for crash via crafted file (CVE-2018-10772)

  - exiv2: information leak via a crafted file (CVE-2018-11037)

  - exiv2: buffer overflow in samples/geotag.cpp (CVE-2018-14338)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2020:0903 advisory.

  - zsh: insecure dropping of privileges when unsetting PRIVILEGED option (CVE-2019-20044)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:4451 advisory.

  - webkitgtk: Incorrect state management leading to universal cross-site scripting (CVE-2019-8625,     CVE-2019-8813, CVE-2020-3867)

  - webkitgtk: Multiple memory corruption issues leading to arbitrary code execution (CVE-2019-8710,     CVE-2019-8720, CVE-2019-8766, CVE-2019-8782, CVE-2019-8783, CVE-2019-8808, CVE-2019-8811, CVE-2019-8812,     CVE-2019-8814, CVE-2019-8815, CVE-2019-8816, CVE-2019-8819, CVE-2019-8820, CVE-2019-8823, CVE-2020-3868)

  - webkitgtk: Multiple memory corruption  issues leading to arbitrary code execution (CVE-2019-8743)

  - webkitgtk: Incorrect state  management leading to universal cross-site scripting (CVE-2019-8764)

  - webkitgtk: Websites could reveal browsing history (CVE-2019-8769)

  - webkitgtk: Violation of iframe sandboxing policy (CVE-2019-8771)

  - webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution (CVE-2019-8835,     CVE-2019-8844)

  - webkitgtk: Use after free issue may lead to remote code execution (CVE-2019-8846)

  - webkitgtk: Use-after-free issue in accessibility/AXObjectCache.cpp (CVE-2020-10018)

  - webkitgtk: use-after-free via crafted web content (CVE-2020-11793)

  - gnome-settings-daemon: Red Hat Customer Portal password logged and passed as command line argument when     user registers through GNOME control center (CVE-2020-14391)

  - LibRaw: lack of thumbnail size range check can lead to buffer overflow (CVE-2020-15503)

  - webkitgtk: Denial of service via incorrect memory handling (CVE-2020-3862)

  - webkitgtk: Non-unique security origin for DOM object contexts (CVE-2020-3864)

  - webkitgtk: Incorrect security check for a top-level DOM object context (CVE-2020-3865)

  - webkitgtk: Incorrect processing of file URLs (CVE-2020-3885)

  - webkitgtk: Race condition allows reading of restricted memory (CVE-2020-3894)

  - webkitgtk: Memory corruption triggered by a malicious web content (CVE-2020-3895)

  - webkitgtk: Type confusion leading to arbitrary code execution (CVE-2020-3897, CVE-2020-3901)

  - webkitgtk: Memory consumption issue leading to arbitrary code execution (CVE-2020-3899)

  - webkitgtk: Memory corruption  triggered by a malicious web content (CVE-2020-3900)

  - webkitgtk: Input validation issue leading to cross-site script attack (CVE-2020-3902)

  - webkitgtk: Logic issue may lead to arbitrary code execution (CVE-2020-9802, CVE-2020-9850)

  - webkitgtk: Memory corruption may lead to arbitrary code execution (CVE-2020-9803, CVE-2020-9806,     CVE-2020-9807)

  - webkitgtk: Logic issue may lead to cross site scripting (CVE-2020-9805)

  - webkitgtk: Input validation issue may lead to cross site scripting (CVE-2020-9843)

  - webkitgtk: Command injection in web inspector (CVE-2020-9862)

  - webkitgtk: Use-after-free may lead to application termination or arbitrary code execution (CVE-2020-9893,     CVE-2020-9895)

  - webkitgtk: Out-of-bounds read may lead to unexpected application termination or arbitrary code execution     (CVE-2020-9894)

  - webkitgtk: Access issue in content security policy (CVE-2020-9915)

  - webkitgtk: A logic issue may lead to cross site scripting (CVE-2020-9925)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:1765 advisory.

  - cups: stack-buffer-overflow in libcups's asn1_get_type function (CVE-2019-8675)

  - cups: stack-buffer-overflow in libcups's asn1_get_packed function (CVE-2019-8696)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2020:4625 advisory.

  - spamassassin: crafted configuration files can run system commands without any output or errors     (CVE-2018-11805)

  - spamassassin: crafted email message can lead to DoS (CVE-2019-12420)

  - spamassassin: command injection via crafted configuration file (CVE-2020-1930, CVE-2020-1931)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:1708 advisory.

  - liblouis: Segmentation fault in logging.c:lou_logPrint() (CVE-2018-11577)

  - liblouis: Stack-based buffer overflow in function includeFile in compileTranslationTable.c     (CVE-2018-11684)

  - liblouis: Stack-based buffer overflow in function compileHyphenation in compileTranslationTable.c     (CVE-2018-11685)

  - liblouis: Stack-based buffer overflow in compileTranslationTable.c (CVE-2018-12085)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:2416 advisory.

  - unbound: amplification of an incoming query into a large number of queries directed to a target     (CVE-2020-12662)

  - unbound: infinite loop via malformed DNS answers received from upstream servers (CVE-2020-12663)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:4751 advisory.

  - httpd: mod_http2: DoS via slow, unneeded request bodies (CVE-2018-17189)

  - httpd: mod_http2: read-after-free on a string compare (CVE-2019-0196)

  - httpd: mod_http2: possible crash on late upgrade (CVE-2019-0197)

  - httpd: memory corruption on early pushes (CVE-2019-10081)

  - httpd: read-after-free in h2 connection shutdown (CVE-2019-10082)

  - httpd: limited cross-site scripting in mod_proxy error page (CVE-2019-10092)

  - httpd: null-pointer dereference in mod_remoteip (CVE-2019-10097)

  - httpd: mod_rewrite potential open redirect (CVE-2019-10098)

  - httpd: mod_rewrite configurations vulnerable to open redirect (CVE-2020-1927)

  - httpd: mod_proxy_ftp use of uninitialized value (CVE-2020-1934)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2020:4605 advisory.

  - python-httplib2: CRLF injection via an attacker controlled unescaped part of uri for httplib2.Http.request     function (CVE-2020-11078)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2020:3032 advisory.

  - mod_auth_openidc: Open redirect in logout url when using URLs with leading slashes (CVE-2019-14857)

  - mod_auth_openidc: Open redirect issue exists in URLs with slash and backslash (CVE-2019-20479)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2020:1318 advisory.

  - telnet-server: no bounds checks in nextitem() function allows to remotely execute arbitrary code     (CVE-2020-10188)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2020:5483 advisory.

  - gnutls: Heap buffer overflow in handshake with no_renegotiation alert sent (CVE-2020-24659)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2020:4807 advisory.

  - snakeyaml: Billion laughs attack via alias feature (CVE-2017-18640)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:4442 advisory.

  - sqlite: Division by zero in whereLoopAddBtreeIndex in sqlite3.c (CVE-2019-16168)

  - sqlite: selectExpander in select.c proceeds with WITH stack unwinding even after a parsing error     (CVE-2019-20218)

  - sqlite: Use-after-free in window function leading to remote code execution (CVE-2019-5018)

  - sqlite: Use-after-free in fts3EvalNextRow in ext/fts3/fts3.c (CVE-2020-13630)

  - sqlite: Virtual table can be renamed into the name of one of its shadow tables (CVE-2020-13631)

  - sqlite: NULL pointer dereference in ext/fts3/fts3_snippet.c via a crafted matchinfo() query     (CVE-2020-13632)

  - sqlite: Out-of-bounds read in SELECT with ON/USING clause (CVE-2020-6405)

  - sqlite: NULL pointer dereference and segmentation fault because of generated column optimizations     (CVE-2020-9327)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:1624 advisory.

  - php: Buffer over-read in PHAR reading functions (CVE-2018-20783)

  - php: Heap buffer overflow in function exif_process_IFD_TAG() (CVE-2019-11034)

  - php: Heap buffer overflow in function exif_iif_add_value() (CVE-2019-11035)

  - php: Buffer over-read in exif_process_IFD_TAG() leading to information disclosure (CVE-2019-11036)

  - php: Out-of-bounds read due to integer overflow in iconv_mime_decode_headers() (CVE-2019-11039)

  - php: Buffer over-read in exif_read_data() (CVE-2019-11040)

  - php: Heap buffer over-read in exif_scan_thumbnail() (CVE-2019-11041)

  - php: Heap buffer over-read in exif_process_user_comment() (CVE-2019-11042)

  - php: Invalid memory access in function xmlrpc_decode() (CVE-2019-9020)

  - php: Heap-based buffer over-read in PHAR reading functions (CVE-2019-9021)

  - php: memcpy with negative length via crafted DNS response (CVE-2019-9022)

  - php: Heap-based buffer over-read in mbstring regular expression functions (CVE-2019-9023)

  - php: Out-of-bounds read in base64_decode_xmlrpc in ext/xmlrpc/libxmlrpc/base64.c (CVE-2019-9024)

  - php: File rename across filesystems may allow unwanted access during processing (CVE-2019-9637)

  - php: Uninitialized read in exif_process_IFD_in_MAKERNOTE (CVE-2019-9638, CVE-2019-9639)

  - php: Invalid read in exif_process_SOFn() (CVE-2019-9640)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:4272 advisory.

  - npm: sensitive information exposure through logs (CVE-2020-15095)

  - nodejs-dot-prop: prototype pollution (CVE-2020-8116)

  - nodejs: HTTP request smuggling due to CR-to-Hyphen conversion (CVE-2020-8201)

  - libuv: buffer overflow in realpath (CVE-2020-8252)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2020:1852 advisory.

  - patch: the following of symlinks in inp.c and util.c is mishandled in cases other than input files     (CVE-2019-13636)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2020:3714 advisory.

  - httpd: Push diary crash on specifically crafted HTTP/2 header (CVE-2020-9490)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2020:1725 advisory.

  - haproxy: HTTP request smuggling issue with transfer-encoding header containing an obfuscated chunked     value (CVE-2019-18277)

  - haproxy: HTTP/2 implementation vulnerable to intermediary encapsulation attacks (CVE-2019-19330)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2020:4483 advisory.

  - opensc: Out-of-bounds access of an ASN.1 Bitstring in decode_bit_string in libopensc/asn1.c     (CVE-2019-15945)

  - opensc: Out-of-bounds access of an ASN.1 Octet string in asn1_decode_entry in libopensc/asn1.c     (CVE-2019-15946)

  - opensc: Incorrect read operation during parsing of a SETCOS file attribute (CVE-2019-19479)

  - opensc: Improper handling of buffer limits for CAC certificates (CVE-2019-19481)

  - opensc: Double free in coolkey_free_private_data in libopensc/card-coolkey.c (CVE-2019-20792)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2020:1735 advisory.

  - dpdk: possible memory leak leads to denial of service (CVE-2019-14818)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2020:0570 advisory.

  - openjpeg: heap-based buffer overflow in pj_t1_clbl_decode_processor in openjp2/t1.c (CVE-2020-8112)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:4431 advisory.

  - kernel: null pointer dereference in dlpar_parse_cc_property in arch/powerrc/platforms/pseries/dlpar.c     causing denial of service (CVE-2019-12614)

  - kernel: use-after-free in drivers/bluetooth/hci_ldisc.c (CVE-2019-15917)

  - kernel: out-of-bounds access in function hclge_tm_schd_mode_vnet_base_cfg (CVE-2019-15925)

  - kernel: null-pointer dereference in drivers/net/fjes/fjes_main.c (CVE-2019-16231)

  - kernel: null pointer dereference in drivers/scsi/qla2xxx/qla_os.c (CVE-2019-16233)

  - kernel: memory leak in ccp_run_sha_cmd() function in drivers/crypto/ccp/ccp-ops.c (CVE-2019-18808)

  - kernel: memory leak in  af9005_identify_state() function in drivers/media/usb/dvb-usb/af9005.c     (CVE-2019-18809)

  - kernel: Denial Of Service in the __ipmi_bmc_register() function in drivers/char/ipmi/ipmi_msghandler.c     (CVE-2019-19046)

  - kernel: A memory leak in the mwifiex_pcie_alloc_cmdrsp_buf() function in     drivers/net/wireless/marvell/mwifiex/pcie.c allows to cause DoS (CVE-2019-19056)

  - kernel: memory leak in the crypto_report() function in crypto/crypto_user_base.c allows for DoS     (CVE-2019-19062)

  - kernel: Two memory leaks in the rtl_usb_probe() function in drivers/net/wireless/realtek/rtlwifi/usb.c     allow for a DoS (CVE-2019-19063)

  - kernel: A memory leak in the rtl8xxxu_submit_int_urb() function in     drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c allows for a DoS (CVE-2019-19068)

  - kernel: A memory leak in the predicate_parse() function in kernel/trace/trace_events_filter.c allows for a     DoS (CVE-2019-19072)

  - kernel: out-of-bounds write in ext4_xattr_set_entry in fs/ext4/xattr.c (CVE-2019-19319)

  - Kernel: kvm: OOB memory write via kvm_dev_ioctl_get_cpuid (CVE-2019-19332)

  - kernel: mounting a crafted ext4 filesystem image, performing some operations, and unmounting can lead to a     use-after-free in ext4_put_super in fs/ext4/super.c (CVE-2019-19447)

  - kernel: a malicious USB device in the drivers/input/ff-memless.c leads to use-after-free (CVE-2019-19524)

  - kernel: information leak bug caused  by a malicious USB device in the drivers/media/usb/ttusb-     dec/ttusb_dec.c (CVE-2019-19533)

  - kernel: race condition caused by a malicious USB device in the USB character device driver layer     (CVE-2019-19537)

  - kernel: use-after-free in serial_ir_init_module() in drivers/media/rc/serial_ir.c (CVE-2019-19543)

  - kernel: use-after-free in __ext4_expand_extra_isize and ext4_xattr_set_entry related to fs/ext4/inode.c     and fs/ext4/super.c (CVE-2019-19767)

  - kernel: use-after-free in debugfs_remove in fs/debugfs/inode.c (CVE-2019-19770)

  - kernel: Null pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c (CVE-2019-20054)

  - kernel: out-of-bounds write via crafted keycode table (CVE-2019-20636)

  - kernel: kernel pointer leak due to WARN_ON statement in video driver leads to local information disclosure     (CVE-2019-9455)

  - kernel: use after free due to race condition in the video driver leads to local privilege escalation     (CVE-2019-9458)

  - kernel: possible use-after-free due to a race condition in cdev_get of char_dev.c (CVE-2020-0305)

  - kernel: uninitialized kernel data leak in userspace coredumps (CVE-2020-10732)

  - kernel: SELinux netlink permission check bypass (CVE-2020-10751)

  - kernel: kernel stack information leak on s390/s390x (CVE-2020-10773)

  - kernel: possibility of memory disclosure when reading the file /proc/sys/kernel/rh_features     (CVE-2020-10774)

  - kernel: vhost-net: stack overflow in get_raw_socket while checking sk_family field (CVE-2020-10942)

  - kernel: out-of-bounds write in mpol_parse_str function in mm/mempolicy.c (CVE-2020-11565)

  - kernel: mishandles invalid descriptors in drivers/media/usb/gspca/xirlink_cit.c (CVE-2020-11668)

  - kernel: buffer overflow in mt76_add_fragment function in drivers/net/wireless/mediatek/mt76/dma.c     (CVE-2020-12465)

  - kernel: sync of excessive duration via an XFS v5 image with crafted metadata (CVE-2020-12655)

  - kernel: xdp_umem_reg in net/xdp/xdp_umem.c has an out-of-bounds write which could result in crash and data     coruption (CVE-2020-12659)

  - kernel: sg_write function lacks an sg_remove_request call in a certain failure case (CVE-2020-12770)

  - kernel: possible to send arbitrary signals to a privileged (suidroot) parent process (CVE-2020-12826)

  - kernel: referencing inode of removed superblock in get_futex_key() causes UAF (CVE-2020-14381)

  - kernel: soft-lockups in iov_iter_copy_from_user_atomic() could result in DoS (CVE-2020-25641)

  - kernel: out-of-bounds read in in vc_do_resize function in drivers/tty/vt/vt.c (CVE-2020-8647)

  - kernel: use-after-free in n_tty_receive_buf_common function in drivers/tty/n_tty.c (CVE-2020-8648)

  - kernel: invalid read location in vgacon_invert_region function in drivers/video/console/vgacon.c     (CVE-2020-8649)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2020:3050 advisory.

  - cloud-init: default configuration disabled deletion of SSH host keys (CVE-2018-10896)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:2848 advisory.

  - nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)

  - nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a     constructor or __proto__ payload (CVE-2020-7598)

  - nodejs: memory corruption in napi_get_value_string_* functions (CVE-2020-8174)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2020:0708 advisory.

  - nodejs: HTTP request smuggling using malformed Transfer-Encoding header (CVE-2019-15605)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2020:2550 advisory.

  - libexif: several buffer over-reads in EXIF MakerNote handling can lead to information disclosure and DoS     (CVE-2020-13112)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:0339 advisory.

  - kernel: heap overflow in mwifiex_set_uap_rates() function of Marvell Wifi Driver leading to DoS     (CVE-2019-14814)

  - kernel: heap-overflow in mwifiex_set_wmm_params() function of Marvell WiFi driver leading to DoS     (CVE-2019-14815)

  - kernel: heap overflow in mwifiex_update_vs_ie() function of Marvell WiFi driver (CVE-2019-14816)

  - kernel: heap-based buffer overflow in mwifiex_process_country_ie() function in     drivers/net/wireless/marvell/mwifiex/sta_ioctl.c (CVE-2019-14895)

  - kernel: incomplete fix  for race condition between mmget_not_zero()/get_task_mm() and core dumping in     CVE-2019-11599 (CVE-2019-14898)

  - kernel: heap overflow in marvell/mwifiex/tdls.c (CVE-2019-14901)

  - kernel: rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel lacks a certain     upper-bound check, leading to a buffer overflow (CVE-2019-17666)

  - Kernel: KVM: export MSR_IA32_TSX_CTRL to guest - incomplete fix for TAA (CVE-2019-11135) (CVE-2019-19338)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2020:5495 advisory.

  - nginx: HTTP request smuggling in configurations with URL redirect used as error_page (CVE-2019-20372)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2020:1672 advisory.

  - freeradius: eap-pwd: Information leak due to aborting when needing more than 10 iterations     (CVE-2019-13456)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:1650 advisory.

  - runc: volume mount race condition with shared mounts leads to information leak/integrity manipulation     (CVE-2019-19921)

  - containers/image: Container images read entire image manifest into memory (CVE-2020-1702)

  - podman: incorrectly allows existing files in volumes to be overwritten by a container when it is created     (CVE-2020-1726)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:2041 advisory.

  - squid: improper check for new member in ESIExpression::Evaluate allows for stack buffer overflow     (CVE-2019-12519)

  - squid: parsing of header Proxy-Authentication leads to memory corruption (CVE-2019-12525)

  - squid: improper access restriction upon Digest Authentication nonce replay could lead to remote code     execution (CVE-2020-11945)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:0598 advisory.

  - nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string (CVE-2019-15604)

  - nodejs: HTTP request smuggling using malformed Transfer-Encoding header (CVE-2019-15605)

  - nodejs: HTTP header values do not have trailing optional whitespace trimmed (CVE-2019-15606)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:1810 advisory.

  - sqlite: fts3: improve shadow table corruption detection (CVE-2019-13752)

  - sqlite: fts3: incorrectly removed corruption check (CVE-2019-13753)

  - sqlite: mishandling of certain uses of SELECT DISTINCT involving a LEFT JOIN in flattenSubquery in     select.c leads to a NULL pointer dereference (CVE-2019-19923)

  - sqlite: incorrect sqlite3WindowRewrite() error handling leads to mishandling certain parser-tree rewriting     (CVE-2019-19924)

  - sqlite: zipfileUpdate in ext/misc/zipfile.c mishandles a NULL pathname during an update of a ZIP archive     (CVE-2019-19925)

  - sqlite: mishandles certain uses of INSERT INTO in situations involving embedded '\0' characters in     filenames (CVE-2019-19959)

  - sqlite: heap out-of-bound read in function rtreenode() (CVE-2019-8457)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2020:1712 advisory.

  - edk2: numeric truncation in MdeModulePkg/PiDxeS3BootScriptLib (CVE-2019-14563)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2021:0288 advisory.

  - Mozilla: HTTPS pages could have been intercepted by a registered service worker when they should not have     been (CVE-2020-26976)

  - Mozilla: Cross-origin information leakage via redirected PDF requests (CVE-2021-23953)

  - Mozilla: Type confusion when using logical assignment operators in JavaScript switch statements     (CVE-2021-23954)

  - Mozilla: Use-after-poison for incorrectly redeclared JavaScript variables during GC (CVE-2021-23960)

  - Mozilla: Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7 (CVE-2021-23964)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2021:0298 advisory.

  - Mozilla: IMAP Response Injection when using STARTTLS (CVE-2020-15685)

  - Mozilla: HTTPS pages could have been intercepted by a registered service worker when they should not have     been (CVE-2020-26976)

  - Mozilla: Cross-origin information leakage via redirected PDF requests (CVE-2021-23953)

  - Mozilla: Type confusion when using logical assignment operators in JavaScript switch statements     (CVE-2021-23954)

  - Mozilla: Use-after-poison for incorrectly redeclared JavaScript variables during GC (CVE-2021-23960)

  - Mozilla: Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7 (CVE-2021-23964)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:0150 advisory.

  - dnsmasq: heap-based buffer overflow in sort_rrset() when DNSSEC is enabled (CVE-2020-25681)

  - dnsmasq: buffer overflow in extract_name() due to missing length check when DNSSEC is enabled     (CVE-2020-25682)

  - dnsmasq: heap-based buffer overflow with large memcpy in get_rdata() when DNSSEC is enabled     (CVE-2020-25683)

  - dnsmasq: loose address/port check in reply_query() makes forging replies easier for an off-path attacker     (CVE-2020-25684)

  - dnsmasq: loose query name check in reply_query() makes forging replies easier for an off-path attacker     (CVE-2020-25685)

  - dnsmasq: multiple queries forwarded for the same name makes forging replies easier for an off-path     attacker (CVE-2020-25686)

  - dnsmasq: heap-based buffer overflow with large memcpy in sort_rrset() when DNSSEC is enabled     (CVE-2020-25687)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:1951 advisory.

  - nss: NULL pointer dereference in several CMS functions resulting in a denial of service (CVE-2018-18508)

  - nss: Out-of-bounds read when importing curve25519 private key (CVE-2019-11719)

  - nss: PKCS#1 v1.5 signatures can be used for TLS 1.3 (CVE-2019-11727)

  - nss: Empty or malformed p256-ECDH public keys may trigger a segmentation fault (CVE-2019-11729)

  - nss: Handling of Netscape Certificate Sequences in CERT_DecodeCertPackage() may crash with a NULL deref     leading to DoS (CVE-2019-17007)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3736 advisory.

  - php: underflow in env_path_info in fpm_main.c (CVE-2019-11043)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2019:1269 advisory.

  - mozilla: Cross-origin theft of images with ImageBitmapRenderingContext (CVE-2018-18511)

  - Mozilla: Use-after-free in XMLHttpRequest (CVE-2019-11691)

  - Mozilla: Use-after-free removing listeners in the event listener manager (CVE-2019-11692)

  - Mozilla: Buffer overflow in WebGL bufferdata on Linux (CVE-2019-11693)

  - Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks     (CVE-2019-11698)

  - chromium-browser: Out of bounds read in Skia (CVE-2019-5798)

  - libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)

  - Mozilla: Cross-origin theft of images with createImageBitmap (CVE-2019-9797)

  - Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 (CVE-2019-9800)

  - Mozilla: Type confusion with object groups and UnboxedObjects (CVE-2019-9816)

  - Mozilla: Stealing of cross-domain images using canvas (CVE-2019-9817)

  - Mozilla: Compartment mismatch with fetch API (CVE-2019-9819)

  - Mozilla: Use-after-free of ChromeEventHandler by DocShell (CVE-2019-9820)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3464 advisory.

  - virt-install: unattended option leaks password via command line argument (CVE-2019-10183)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3624 advisory.

  - libseccomp: incorrect generation of syscall filters in libseccomp (CVE-2019-9893)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2019:1696 advisory.

  - Mozilla: Type confusion in Array.pop (CVE-2019-11707)

  - Mozilla: Sandbox escape using Prompt:Open (CVE-2019-11708)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:2893 advisory.

  - HTTP/2: request for large response leads to denial of service (CVE-2019-9517)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Severity
145833	CentOS 8 : libvncserver (CESA-2020:3385)	critical
145832	CentOS 8 : subversion:1.10 (CESA-2020:4712)	medium
145831	CentOS 8 : fontforge (CESA-2020:1921)	high
145830	CentOS 8 : nodejs:12 (CESA-2020:1293)	high
145829	CentOS 8 : postgresql:10 (CESA-2020:5567)	high
145828	CentOS 8 : exiv2 (CESA-2020:1577)	high
145827	CentOS 8 : zsh (CESA-2020:0903)	high
145826	CentOS 8 : GNOME (CESA-2020:4451)	critical
145825	CentOS 8 : cups (CESA-2020:1765)	high
145824	CentOS 8 : spamassassin (CESA-2020:4625)	high
145823	CentOS 8 : liblouis (CESA-2020:1708)	high
145822	CentOS 8 : unbound (CESA-2020:2416)	high
145821	CentOS 8 : httpd:2.4 (CESA-2020:4751)	critical
145820	CentOS 8 : resource-agents (CESA-2020:4605)	medium
145819	CentOS 8 : mod_auth_openidc:2.3 (CESA-2020:3032)	medium
145818	CentOS 8 : telnet (CESA-2020:1318)	critical
145817	CentOS 8 : gnutls (CESA-2020:5483)	high
145816	CentOS 8 : prometheus-jmx-exporter (CESA-2020:4807)	high
145815	CentOS 8 : sqlite (CESA-2020:4442)	high
145814	CentOS 8 : php:7.2 (CESA-2020:1624)	critical
145813	CentOS 8 : nodejs:12 (CESA-2020:4272)	high
145812	CentOS 8 : patch (CESA-2020:1852)	medium
145811	CentOS 8 : httpd:2.4 (CESA-2020:3714)	high
145810	CentOS 8 : haproxy (CESA-2020:1725)	critical
145809	CentOS 8 : opensc (CESA-2020:4483)	medium
145808	CentOS 8 : dpdk (CESA-2020:1735)	high
145807	CentOS 8 : openjpeg2 (CESA-2020:0570)	high
145806	CentOS 8 : kernel (CESA-2020:4431)	high
145805	CentOS 8 : cloud-init (CESA-2020:3050)	high
145804	CentOS 8 : nodejs:10 (CESA-2020:2848)	high
145803	CentOS 8 : http-parser (CESA-2020:0708)	critical
145802	CentOS 8 : libexif (CESA-2020:2550)	critical
145801	CentOS 8 : kernel (CESA-2020:0339)	critical
145800	CentOS 8 : nginx:1.16 (CESA-2020:5495)	medium
145799	CentOS 8 : freeradius:3.0 (CESA-2020:1672)	medium
145798	CentOS 8 : container-tools:rhel8 (CESA-2020:1650)	high
145797	CentOS 8 : squid:4 (CESA-2020:2041)	critical
145796	CentOS 8 : nodejs:12 (CESA-2020:0598)	critical
145795	CentOS 8 : sqlite (CESA-2020:1810)	critical
145794	CentOS 8 : edk2 (CESA-2020:1712)	high
145792	CentOS 8 : firefox (CESA-2021:0288)	high
145791	CentOS 8 : thunderbird (CESA-2021:0298)	high
145698	CentOS 8 : dnsmasq (CESA-2021:0150)	high
145690	CentOS 8 : nss and nspr (CESA-2019:1951)	high
145689	CentOS 8 : php:7.3 (CESA-2019:3736)	critical
145688	CentOS 8 : firefox (CESA-2019:1269)	critical
145687	CentOS 8 : virt-manager (CESA-2019:3464)	low
145686	CentOS 8 : libseccomp (CESA-2019:3624)	critical
145685	CentOS 8 : firefox (CESA-2019:1696)	critical
145684	CentOS 8 : httpd:2.4 (CESA-2019:2893)	high

Detections

Analytics

CentOS Local Security Checks Family for Nessus

critical

medium

high

high

high

high

high

critical

high

high

high

high

critical

medium

medium

critical

high

high

high

critical

high

medium

high

critical

medium

high

high

high

high

high

critical

critical

critical

medium

medium

high

critical

critical

critical

high

high

high

high

high

critical

critical

low

critical

critical

high