The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:4751 advisory.

  - httpd: mod_http2: DoS via slow, unneeded request bodies (CVE-2018-17189)

  - httpd: mod_http2: read-after-free on a string compare (CVE-2019-0196)

  - httpd: mod_http2: possible crash on late upgrade (CVE-2019-0197)

  - httpd: memory corruption on early pushes (CVE-2019-10081)

  - httpd: read-after-free in h2 connection shutdown (CVE-2019-10082)

  - httpd: limited cross-site scripting in mod_proxy error page (CVE-2019-10092)

  - httpd: null-pointer dereference in mod_remoteip (CVE-2019-10097)

  - httpd: mod_rewrite potential open redirect (CVE-2019-10098)

  - httpd: mod_rewrite configurations vulnerable to open redirect (CVE-2020-1927)

  - httpd: mod_proxy_ftp use of uninitialized value (CVE-2020-1934)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2020:4605 advisory.

  - python-httplib2: CRLF injection via an attacker controlled unescaped part of uri for httplib2.Http.request     function (CVE-2020-11078)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2020:3032 advisory.

  - mod_auth_openidc: Open redirect in logout url when using URLs with leading slashes (CVE-2019-14857)

  - mod_auth_openidc: Open redirect issue exists in URLs with slash and backslash (CVE-2019-20479)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2020:1318 advisory.

  - telnet-server: no bounds checks in nextitem() function allows to remotely execute arbitrary code     (CVE-2020-10188)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2020:5483 advisory.

  - gnutls: Heap buffer overflow in handshake with no_renegotiation alert sent (CVE-2020-24659)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2020:4807 advisory.

  - snakeyaml: Billion laughs attack via alias feature (CVE-2017-18640)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:4442 advisory.

  - sqlite: Division by zero in whereLoopAddBtreeIndex in sqlite3.c (CVE-2019-16168)

  - sqlite: selectExpander in select.c proceeds with WITH stack unwinding even after a parsing error     (CVE-2019-20218)

  - sqlite: Use-after-free in window function leading to remote code execution (CVE-2019-5018)

  - sqlite: Use-after-free in fts3EvalNextRow in ext/fts3/fts3.c (CVE-2020-13630)

  - sqlite: Virtual table can be renamed into the name of one of its shadow tables (CVE-2020-13631)

  - sqlite: NULL pointer dereference in ext/fts3/fts3_snippet.c via a crafted matchinfo() query     (CVE-2020-13632)

  - sqlite: Out-of-bounds read in SELECT with ON/USING clause (CVE-2020-6405)

  - sqlite: NULL pointer dereference and segmentation fault because of generated column optimizations     (CVE-2020-9327)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:1624 advisory.

  - php: Buffer over-read in PHAR reading functions (CVE-2018-20783)

  - php: Heap buffer overflow in function exif_process_IFD_TAG() (CVE-2019-11034)

  - php: Heap buffer overflow in function exif_iif_add_value() (CVE-2019-11035)

  - php: Buffer over-read in exif_process_IFD_TAG() leading to information disclosure (CVE-2019-11036)

  - php: Out-of-bounds read due to integer overflow in iconv_mime_decode_headers() (CVE-2019-11039)

  - php: Buffer over-read in exif_read_data() (CVE-2019-11040)

  - php: Heap buffer over-read in exif_scan_thumbnail() (CVE-2019-11041)

  - php: Heap buffer over-read in exif_process_user_comment() (CVE-2019-11042)

  - php: Invalid memory access in function xmlrpc_decode() (CVE-2019-9020)

  - php: Heap-based buffer over-read in PHAR reading functions (CVE-2019-9021)

  - php: memcpy with negative length via crafted DNS response (CVE-2019-9022)

  - php: Heap-based buffer over-read in mbstring regular expression functions (CVE-2019-9023)

  - php: Out-of-bounds read in base64_decode_xmlrpc in ext/xmlrpc/libxmlrpc/base64.c (CVE-2019-9024)

  - php: File rename across filesystems may allow unwanted access during processing (CVE-2019-9637)

  - php: Uninitialized read in exif_process_IFD_in_MAKERNOTE (CVE-2019-9638, CVE-2019-9639)

  - php: Invalid read in exif_process_SOFn() (CVE-2019-9640)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:4272 advisory.

  - npm: sensitive information exposure through logs (CVE-2020-15095)

  - nodejs-dot-prop: prototype pollution (CVE-2020-8116)

  - nodejs: HTTP request smuggling due to CR-to-Hyphen conversion (CVE-2020-8201)

  - libuv: buffer overflow in realpath (CVE-2020-8252)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2020:1852 advisory.

  - patch: the following of symlinks in inp.c and util.c is mishandled in cases other than input files     (CVE-2019-13636)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2020:3714 advisory.

  - httpd: Push diary crash on specifically crafted HTTP/2 header (CVE-2020-9490)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2020:1725 advisory.

  - haproxy: HTTP request smuggling issue with transfer-encoding header containing an obfuscated chunked     value (CVE-2019-18277)

  - haproxy: HTTP/2 implementation vulnerable to intermediary encapsulation attacks (CVE-2019-19330)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2020:4483 advisory.

  - opensc: Out-of-bounds access of an ASN.1 Bitstring in decode_bit_string in libopensc/asn1.c     (CVE-2019-15945)

  - opensc: Out-of-bounds access of an ASN.1 Octet string in asn1_decode_entry in libopensc/asn1.c     (CVE-2019-15946)

  - opensc: Incorrect read operation during parsing of a SETCOS file attribute (CVE-2019-19479)

  - opensc: Improper handling of buffer limits for CAC certificates (CVE-2019-19481)

  - opensc: Double free in coolkey_free_private_data in libopensc/card-coolkey.c (CVE-2019-20792)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2020:1735 advisory.

  - dpdk: possible memory leak leads to denial of service (CVE-2019-14818)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2020:0570 advisory.

  - openjpeg: heap-based buffer overflow in pj_t1_clbl_decode_processor in openjp2/t1.c (CVE-2020-8112)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:4431 advisory.

  - kernel: null pointer dereference in dlpar_parse_cc_property in arch/powerrc/platforms/pseries/dlpar.c     causing denial of service (CVE-2019-12614)

  - kernel: use-after-free in drivers/bluetooth/hci_ldisc.c (CVE-2019-15917)

  - kernel: out-of-bounds access in function hclge_tm_schd_mode_vnet_base_cfg (CVE-2019-15925)

  - kernel: null-pointer dereference in drivers/net/fjes/fjes_main.c (CVE-2019-16231)

  - kernel: null pointer dereference in drivers/scsi/qla2xxx/qla_os.c (CVE-2019-16233)

  - kernel: memory leak in ccp_run_sha_cmd() function in drivers/crypto/ccp/ccp-ops.c (CVE-2019-18808)

  - kernel: memory leak in  af9005_identify_state() function in drivers/media/usb/dvb-usb/af9005.c     (CVE-2019-18809)

  - kernel: Denial Of Service in the __ipmi_bmc_register() function in drivers/char/ipmi/ipmi_msghandler.c     (CVE-2019-19046)

  - kernel: A memory leak in the mwifiex_pcie_alloc_cmdrsp_buf() function in     drivers/net/wireless/marvell/mwifiex/pcie.c allows to cause DoS (CVE-2019-19056)

  - kernel: memory leak in the crypto_report() function in crypto/crypto_user_base.c allows for DoS     (CVE-2019-19062)

  - kernel: Two memory leaks in the rtl_usb_probe() function in drivers/net/wireless/realtek/rtlwifi/usb.c     allow for a DoS (CVE-2019-19063)

  - kernel: A memory leak in the rtl8xxxu_submit_int_urb() function in     drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c allows for a DoS (CVE-2019-19068)

  - kernel: A memory leak in the predicate_parse() function in kernel/trace/trace_events_filter.c allows for a     DoS (CVE-2019-19072)

  - kernel: out-of-bounds write in ext4_xattr_set_entry in fs/ext4/xattr.c (CVE-2019-19319)

  - Kernel: kvm: OOB memory write via kvm_dev_ioctl_get_cpuid (CVE-2019-19332)

  - kernel: mounting a crafted ext4 filesystem image, performing some operations, and unmounting can lead to a     use-after-free in ext4_put_super in fs/ext4/super.c (CVE-2019-19447)

  - kernel: a malicious USB device in the drivers/input/ff-memless.c leads to use-after-free (CVE-2019-19524)

  - kernel: information leak bug caused  by a malicious USB device in the drivers/media/usb/ttusb-     dec/ttusb_dec.c (CVE-2019-19533)

  - kernel: race condition caused by a malicious USB device in the USB character device driver layer     (CVE-2019-19537)

  - kernel: use-after-free in serial_ir_init_module() in drivers/media/rc/serial_ir.c (CVE-2019-19543)

  - kernel: use-after-free in __ext4_expand_extra_isize and ext4_xattr_set_entry related to fs/ext4/inode.c     and fs/ext4/super.c (CVE-2019-19767)

  - kernel: use-after-free in debugfs_remove in fs/debugfs/inode.c (CVE-2019-19770)

  - kernel: Null pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c (CVE-2019-20054)

  - kernel: out-of-bounds write via crafted keycode table (CVE-2019-20636)

  - kernel: kernel pointer leak due to WARN_ON statement in video driver leads to local information disclosure     (CVE-2019-9455)

  - kernel: use after free due to race condition in the video driver leads to local privilege escalation     (CVE-2019-9458)

  - kernel: possible use-after-free due to a race condition in cdev_get of char_dev.c (CVE-2020-0305)

  - kernel: uninitialized kernel data leak in userspace coredumps (CVE-2020-10732)

  - kernel: SELinux netlink permission check bypass (CVE-2020-10751)

  - kernel: kernel stack information leak on s390/s390x (CVE-2020-10773)

  - kernel: possibility of memory disclosure when reading the file /proc/sys/kernel/rh_features     (CVE-2020-10774)

  - kernel: vhost-net: stack overflow in get_raw_socket while checking sk_family field (CVE-2020-10942)

  - kernel: out-of-bounds write in mpol_parse_str function in mm/mempolicy.c (CVE-2020-11565)

  - kernel: mishandles invalid descriptors in drivers/media/usb/gspca/xirlink_cit.c (CVE-2020-11668)

  - kernel: buffer overflow in mt76_add_fragment function in drivers/net/wireless/mediatek/mt76/dma.c     (CVE-2020-12465)

  - kernel: sync of excessive duration via an XFS v5 image with crafted metadata (CVE-2020-12655)

  - kernel: xdp_umem_reg in net/xdp/xdp_umem.c has an out-of-bounds write which could result in crash and data     coruption (CVE-2020-12659)

  - kernel: sg_write function lacks an sg_remove_request call in a certain failure case (CVE-2020-12770)

  - kernel: possible to send arbitrary signals to a privileged (suidroot) parent process (CVE-2020-12826)

  - kernel: referencing inode of removed superblock in get_futex_key() causes UAF (CVE-2020-14381)

  - kernel: soft-lockups in iov_iter_copy_from_user_atomic() could result in DoS (CVE-2020-25641)

  - kernel: out-of-bounds read in in vc_do_resize function in drivers/tty/vt/vt.c (CVE-2020-8647)

  - kernel: use-after-free in n_tty_receive_buf_common function in drivers/tty/n_tty.c (CVE-2020-8648)

  - kernel: invalid read location in vgacon_invert_region function in drivers/video/console/vgacon.c     (CVE-2020-8649)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2020:3050 advisory.

  - cloud-init: default configuration disabled deletion of SSH host keys (CVE-2018-10896)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:2848 advisory.

  - nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)

  - nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a     constructor or __proto__ payload (CVE-2020-7598)

  - nodejs: memory corruption in napi_get_value_string_* functions (CVE-2020-8174)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2020:0708 advisory.

  - nodejs: HTTP request smuggling using malformed Transfer-Encoding header (CVE-2019-15605)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2020:2550 advisory.

  - libexif: several buffer over-reads in EXIF MakerNote handling can lead to information disclosure and DoS     (CVE-2020-13112)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:0339 advisory.

  - kernel: heap overflow in mwifiex_set_uap_rates() function of Marvell Wifi Driver leading to DoS     (CVE-2019-14814)

  - kernel: heap-overflow in mwifiex_set_wmm_params() function of Marvell WiFi driver leading to DoS     (CVE-2019-14815)

  - kernel: heap overflow in mwifiex_update_vs_ie() function of Marvell WiFi driver (CVE-2019-14816)

  - kernel: heap-based buffer overflow in mwifiex_process_country_ie() function in     drivers/net/wireless/marvell/mwifiex/sta_ioctl.c (CVE-2019-14895)

  - kernel: incomplete fix  for race condition between mmget_not_zero()/get_task_mm() and core dumping in     CVE-2019-11599 (CVE-2019-14898)

  - kernel: heap overflow in marvell/mwifiex/tdls.c (CVE-2019-14901)

  - kernel: rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel lacks a certain     upper-bound check, leading to a buffer overflow (CVE-2019-17666)

  - Kernel: KVM: export MSR_IA32_TSX_CTRL to guest - incomplete fix for TAA (CVE-2019-11135) (CVE-2019-19338)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2020:5495 advisory.

  - nginx: HTTP request smuggling in configurations with URL redirect used as error_page (CVE-2019-20372)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2020:1672 advisory.

  - freeradius: eap-pwd: Information leak due to aborting when needing more than 10 iterations     (CVE-2019-13456)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:1650 advisory.

  - runc: volume mount race condition with shared mounts leads to information leak/integrity manipulation     (CVE-2019-19921)

  - containers/image: Container images read entire image manifest into memory (CVE-2020-1702)

  - podman: incorrectly allows existing files in volumes to be overwritten by a container when it is created     (CVE-2020-1726)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:2041 advisory.

  - squid: improper check for new member in ESIExpression::Evaluate allows for stack buffer overflow     (CVE-2019-12519)

  - squid: parsing of header Proxy-Authentication leads to memory corruption (CVE-2019-12525)

  - squid: improper access restriction upon Digest Authentication nonce replay could lead to remote code     execution (CVE-2020-11945)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:0598 advisory.

  - nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string (CVE-2019-15604)

  - nodejs: HTTP request smuggling using malformed Transfer-Encoding header (CVE-2019-15605)

  - nodejs: HTTP header values do not have trailing optional whitespace trimmed (CVE-2019-15606)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:1810 advisory.

  - sqlite: fts3: improve shadow table corruption detection (CVE-2019-13752)

  - sqlite: fts3: incorrectly removed corruption check (CVE-2019-13753)

  - sqlite: mishandling of certain uses of SELECT DISTINCT involving a LEFT JOIN in flattenSubquery in     select.c leads to a NULL pointer dereference (CVE-2019-19923)

  - sqlite: incorrect sqlite3WindowRewrite() error handling leads to mishandling certain parser-tree rewriting     (CVE-2019-19924)

  - sqlite: zipfileUpdate in ext/misc/zipfile.c mishandles a NULL pathname during an update of a ZIP archive     (CVE-2019-19925)

  - sqlite: mishandles certain uses of INSERT INTO in situations involving embedded '\0' characters in     filenames (CVE-2019-19959)

  - sqlite: heap out-of-bound read in function rtreenode() (CVE-2019-8457)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2020:1712 advisory.

  - edk2: numeric truncation in MdeModulePkg/PiDxeS3BootScriptLib (CVE-2019-14563)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2021:0288 advisory.

  - Mozilla: HTTPS pages could have been intercepted by a registered service worker when they should not have     been (CVE-2020-26976)

  - Mozilla: Cross-origin information leakage via redirected PDF requests (CVE-2021-23953)

  - Mozilla: Type confusion when using logical assignment operators in JavaScript switch statements     (CVE-2021-23954)

  - Mozilla: Use-after-poison for incorrectly redeclared JavaScript variables during GC (CVE-2021-23960)

  - Mozilla: Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7 (CVE-2021-23964)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2021:0298 advisory.

  - Mozilla: IMAP Response Injection when using STARTTLS (CVE-2020-15685)

  - Mozilla: HTTPS pages could have been intercepted by a registered service worker when they should not have     been (CVE-2020-26976)

  - Mozilla: Cross-origin information leakage via redirected PDF requests (CVE-2021-23953)

  - Mozilla: Type confusion when using logical assignment operators in JavaScript switch statements     (CVE-2021-23954)

  - Mozilla: Use-after-poison for incorrectly redeclared JavaScript variables during GC (CVE-2021-23960)

  - Mozilla: Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7 (CVE-2021-23964)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:0150 advisory.

  - dnsmasq: heap-based buffer overflow in sort_rrset() when DNSSEC is enabled (CVE-2020-25681)

  - dnsmasq: buffer overflow in extract_name() due to missing length check when DNSSEC is enabled     (CVE-2020-25682)

  - dnsmasq: heap-based buffer overflow with large memcpy in get_rdata() when DNSSEC is enabled     (CVE-2020-25683)

  - dnsmasq: loose address/port check in reply_query() makes forging replies easier for an off-path attacker     (CVE-2020-25684)

  - dnsmasq: loose query name check in reply_query() makes forging replies easier for an off-path attacker     (CVE-2020-25685)

  - dnsmasq: multiple queries forwarded for the same name makes forging replies easier for an off-path     attacker (CVE-2020-25686)

  - dnsmasq: heap-based buffer overflow with large memcpy in sort_rrset() when DNSSEC is enabled     (CVE-2020-25687)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:1951 advisory.

  - nss: NULL pointer dereference in several CMS functions resulting in a denial of service (CVE-2018-18508)

  - nss: Out-of-bounds read when importing curve25519 private key (CVE-2019-11719)

  - nss: PKCS#1 v1.5 signatures can be used for TLS 1.3 (CVE-2019-11727)

  - nss: Empty or malformed p256-ECDH public keys may trigger a segmentation fault (CVE-2019-11729)

  - nss: Handling of Netscape Certificate Sequences in CERT_DecodeCertPackage() may crash with a NULL deref     leading to DoS (CVE-2019-17007)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3736 advisory.

  - php: underflow in env_path_info in fpm_main.c (CVE-2019-11043)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2019:1269 advisory.

  - mozilla: Cross-origin theft of images with ImageBitmapRenderingContext (CVE-2018-18511)

  - Mozilla: Use-after-free in XMLHttpRequest (CVE-2019-11691)

  - Mozilla: Use-after-free removing listeners in the event listener manager (CVE-2019-11692)

  - Mozilla: Buffer overflow in WebGL bufferdata on Linux (CVE-2019-11693)

  - Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks     (CVE-2019-11698)

  - chromium-browser: Out of bounds read in Skia (CVE-2019-5798)

  - libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)

  - Mozilla: Cross-origin theft of images with createImageBitmap (CVE-2019-9797)

  - Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 (CVE-2019-9800)

  - Mozilla: Type confusion with object groups and UnboxedObjects (CVE-2019-9816)

  - Mozilla: Stealing of cross-domain images using canvas (CVE-2019-9817)

  - Mozilla: Compartment mismatch with fetch API (CVE-2019-9819)

  - Mozilla: Use-after-free of ChromeEventHandler by DocShell (CVE-2019-9820)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3464 advisory.

  - virt-install: unattended option leaks password via command line argument (CVE-2019-10183)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3624 advisory.

  - libseccomp: incorrect generation of syscall filters in libseccomp (CVE-2019-9893)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2019:1696 advisory.

  - Mozilla: Type confusion in Array.pop (CVE-2019-11707)

  - Mozilla: Sandbox escape using Prompt:Open (CVE-2019-11708)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:2893 advisory.

  - HTTP/2: request for large response leads to denial of service (CVE-2019-9517)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:1529 advisory.

  - tomcat: Open redirect in default servlet (CVE-2018-11784)

  - tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins (CVE-2018-8014)

  - tomcat: Host name verification missing in WebSocket client (CVE-2018-8034)

  - tomcat: Due to a mishandling of close in NIO/NIO2 connectors user sessions can get mixed up     (CVE-2018-8037)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:0968 advisory.

  - edk2: Buffer Overflow in BlockIo service for RAM disk (CVE-2018-12180)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:1175 advisory.

  - hardware: Microarchitectural Store Buffer Data Sampling (MSBDS) (CVE-2018-12126)

  - hardware: Micro-architectural Load Port Data Sampling - Information Leak (MLPDS) (CVE-2018-12127)

  - hardware: Microarchitectural Fill Buffer Data Sampling (MFBDS) (CVE-2018-12130)

  - QEMU: device_tree: heap buffer overflow while loading device tree blob (CVE-2018-20815)

  - hardware: Microarchitectural Data Sampling Uncacheable Memory (MDSUM) (CVE-2019-11091)

  - libssh2: Integer overflow in transport read resulting in out of bounds write (CVE-2019-3855)

  - libssh2: Integer overflow in keyboard interactive handling resulting in out of bounds write     (CVE-2019-3856)

  - libssh2: Integer overflow in SSH packet processing channel resulting in out of bounds write     (CVE-2019-3857)

  - libssh2: Integer overflow in user authenticate keyboard interactive allows out-of-bounds writes     (CVE-2019-3863)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3476 advisory.

  - squid: XSS via user_name or auth parameter in cachemgr.cgi (CVE-2019-13345)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:3134 advisory.

  - OpenJDK: Missing restrictions on use of custom SocketImpl (Networking, 8218573) (CVE-2019-2945)

  - OpenJDK: Improper handling of Kerberos proxy credentials (Kerberos, 8220302) (CVE-2019-2949)

  - OpenJDK: NULL pointer dereference in DrawGlyphList (2D, 8222690) (CVE-2019-2962)

  - OpenJDK: Unexpected exception thrown by Pattern processing crafted regular expression (Concurrency,     8222684) (CVE-2019-2964)

  - OpenJDK: Unexpected exception thrown by XPathParser processing crafted XPath expression (JAXP, 8223505)     (CVE-2019-2973)

  - OpenJDK: Unexpected exception thrown during regular expression processing in Nashorn (Scripting, 8223518)     (CVE-2019-2975)

  - OpenJDK: Incorrect handling of nested jar: URLs in Jar URL handler (Networking, 8223892) (CVE-2019-2978)

  - OpenJDK: Unexpected exception thrown by XPath processing crafted XPath expression (JAXP, 8224532)     (CVE-2019-2981)

  - OpenJDK: Unexpected exception thrown during Font object deserialization (Serialization, 8224915)     (CVE-2019-2983)

  - OpenJDK: Missing glyph bitmap image dimension check in FreetypeFontScaler (2D, 8225286) (CVE-2019-2987)

  - OpenJDK: Integer overflow in bounds check in SunGraphics2D (2D, 8225292) (CVE-2019-2988)

  - OpenJDK: Incorrect handling of HTTP proxy responses in HttpURLConnection (Networking, 8225298)     (CVE-2019-2989)

  - OpenJDK: Excessive memory allocation in CMap when reading TrueType font (2D, 8225597) (CVE-2019-2992)

  - OpenJDK: Insufficient filtering of HTML event attributes in Javadoc (Javadoc, 8226765) (CVE-2019-2999)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:2411 advisory.

  - kernel: hw: Spectre SWAPGS gadget vulnerability (CVE-2019-1125)

  - kernel: broken permission and object lifetime handling for PTRACE_TRACEME (CVE-2019-13272)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3890 advisory.

  - ghostscript: -dSAFER escape in .charkeys (701841) (CVE-2019-14869)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:2722 advisory.

  - gd: Double free in the gdImage*Ptr in gd_gif_out.c, gd_jpeg.c, and gd_wbmp.c (CVE-2019-6978)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:1959 advisory.

  - kernel: infinite loop in update_blocked_averages() in kernel/sched/fair.c leading to denial of service     (CVE-2018-20784)

  - kernel: insufficient input validation in kernel mode driver in Intel i915 graphics leads to privilege     escalation (CVE-2019-11085)

  - kernel: a NULL pointer dereference in drivers/scsi/megaraid/megaraid_sas_base.c leading to DoS     (CVE-2019-11810)

  - kernel: use-after-free in drivers/char/ipmi/ipmi_si_intf.c, ipmi_si_mem_io.c, ipmi_si_port_io.c     (CVE-2019-11811)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:1279 advisory.

  - pacemaker: Insufficient local IPC client-server authentication on the client's side can lead to local     privesc (CVE-2018-16877)

  - pacemaker: Insufficient verification inflicted preference of uncontrolled processes can lead to DoS     (CVE-2018-16878)

  - pacemaker: Information disclosure through use-after-free (CVE-2019-3885)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:0990 advisory.

  - systemd: Insufficient input validation in bus_process_object() resulting in PID 1 crash (CVE-2019-6454)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3530 advisory.

  - glib2: file_copy_fallback in gio/gfile.c in GNOME GLib does not properly restrict file permissions while a     copy operation is in progress (CVE-2019-12450)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Severity
145821	CentOS 8 : httpd:2.4 (CESA-2020:4751)	critical
145820	CentOS 8 : resource-agents (CESA-2020:4605)	medium
145819	CentOS 8 : mod_auth_openidc:2.3 (CESA-2020:3032)	medium
145818	CentOS 8 : telnet (CESA-2020:1318)	critical
145817	CentOS 8 : gnutls (CESA-2020:5483)	high
145816	CentOS 8 : prometheus-jmx-exporter (CESA-2020:4807)	high
145815	CentOS 8 : sqlite (CESA-2020:4442)	high
145814	CentOS 8 : php:7.2 (CESA-2020:1624)	critical
145813	CentOS 8 : nodejs:12 (CESA-2020:4272)	high
145812	CentOS 8 : patch (CESA-2020:1852)	medium
145811	CentOS 8 : httpd:2.4 (CESA-2020:3714)	high
145810	CentOS 8 : haproxy (CESA-2020:1725)	critical
145809	CentOS 8 : opensc (CESA-2020:4483)	medium
145808	CentOS 8 : dpdk (CESA-2020:1735)	high
145807	CentOS 8 : openjpeg2 (CESA-2020:0570)	high
145806	CentOS 8 : kernel (CESA-2020:4431)	high
145805	CentOS 8 : cloud-init (CESA-2020:3050)	high
145804	CentOS 8 : nodejs:10 (CESA-2020:2848)	high
145803	CentOS 8 : http-parser (CESA-2020:0708)	critical
145802	CentOS 8 : libexif (CESA-2020:2550)	critical
145801	CentOS 8 : kernel (CESA-2020:0339)	critical
145800	CentOS 8 : nginx:1.16 (CESA-2020:5495)	medium
145799	CentOS 8 : freeradius:3.0 (CESA-2020:1672)	medium
145798	CentOS 8 : container-tools:rhel8 (CESA-2020:1650)	high
145797	CentOS 8 : squid:4 (CESA-2020:2041)	critical
145796	CentOS 8 : nodejs:12 (CESA-2020:0598)	critical
145795	CentOS 8 : sqlite (CESA-2020:1810)	critical
145794	CentOS 8 : edk2 (CESA-2020:1712)	high
145792	CentOS 8 : firefox (CESA-2021:0288)	high
145791	CentOS 8 : thunderbird (CESA-2021:0298)	high
145698	CentOS 8 : dnsmasq (CESA-2021:0150)	high
145690	CentOS 8 : nss and nspr (CESA-2019:1951)	high
145689	CentOS 8 : php:7.3 (CESA-2019:3736)	critical
145688	CentOS 8 : firefox (CESA-2019:1269)	critical
145687	CentOS 8 : virt-manager (CESA-2019:3464)	low
145686	CentOS 8 : libseccomp (CESA-2019:3624)	critical
145685	CentOS 8 : firefox (CESA-2019:1696)	critical
145684	CentOS 8 : httpd:2.4 (CESA-2019:2893)	high
145683	CentOS 8 : pki-deps:10.6 (CESA-2019:1529)	critical
145682	CentOS 8 : edk2 (CESA-2019:0968)	high
145681	CentOS 8 : virt:rhel (CESA-2019:1175)	critical
145680	CentOS 8 : squid:4 (CESA-2019:3476)	medium
145679	CentOS 8 : java-1.8.0-openjdk (CESA-2019:3134)	medium
145678	CentOS 8 : kernel (CESA-2019:2411)	high
145677	CentOS 8 : ghostscript (CESA-2019:3890)	high
145676	CentOS 8 : libwmf (CESA-2019:2722)	critical
145675	CentOS 8 : kernel (CESA-2019:1959)	critical
145674	CentOS 8 : pacemaker (CESA-2019:1279)	high
145673	CentOS 8 : systemd (CESA-2019:0990)	medium
145672	CentOS 8 : glib2 (CESA-2019:3530)	critical

Detections

Analytics

CentOS Local Security Checks Family for Nessus

critical

medium

medium

critical

high

high

high

critical

high

medium

high

critical

medium

high

high

high

high

high

critical

critical

critical

medium

medium

high

critical

critical

critical

high

high

high

high

high

critical

critical

low

critical

critical

high

critical

high

critical

medium

medium

high

high

critical

critical

high

medium

critical