The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:2848 advisory.

  - nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)

  - nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a     constructor or __proto__ payload (CVE-2020-7598)

  - nodejs: memory corruption in napi_get_value_string_* functions (CVE-2020-8174)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2020:0708 advisory.

  - nodejs: HTTP request smuggling using malformed Transfer-Encoding header (CVE-2019-15605)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2020:2550 advisory.

  - libexif: several buffer over-reads in EXIF MakerNote handling can lead to information disclosure and DoS     (CVE-2020-13112)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:0339 advisory.

  - kernel: heap overflow in mwifiex_set_uap_rates() function of Marvell Wifi Driver leading to DoS     (CVE-2019-14814)

  - kernel: heap-overflow in mwifiex_set_wmm_params() function of Marvell WiFi driver leading to DoS     (CVE-2019-14815)

  - kernel: heap overflow in mwifiex_update_vs_ie() function of Marvell WiFi driver (CVE-2019-14816)

  - kernel: heap-based buffer overflow in mwifiex_process_country_ie() function in     drivers/net/wireless/marvell/mwifiex/sta_ioctl.c (CVE-2019-14895)

  - kernel: incomplete fix  for race condition between mmget_not_zero()/get_task_mm() and core dumping in     CVE-2019-11599 (CVE-2019-14898)

  - kernel: heap overflow in marvell/mwifiex/tdls.c (CVE-2019-14901)

  - kernel: rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel lacks a certain     upper-bound check, leading to a buffer overflow (CVE-2019-17666)

  - Kernel: KVM: export MSR_IA32_TSX_CTRL to guest - incomplete fix for TAA (CVE-2019-11135) (CVE-2019-19338)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2020:5495 advisory.

  - nginx: HTTP request smuggling in configurations with URL redirect used as error_page (CVE-2019-20372)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2020:1672 advisory.

  - freeradius: eap-pwd: Information leak due to aborting when needing more than 10 iterations     (CVE-2019-13456)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:1650 advisory.

  - runc: volume mount race condition with shared mounts leads to information leak/integrity manipulation     (CVE-2019-19921)

  - containers/image: Container images read entire image manifest into memory (CVE-2020-1702)

  - podman: incorrectly allows existing files in volumes to be overwritten by a container when it is created     (CVE-2020-1726)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:2041 advisory.

  - squid: improper check for new member in ESIExpression::Evaluate allows for stack buffer overflow     (CVE-2019-12519)

  - squid: parsing of header Proxy-Authentication leads to memory corruption (CVE-2019-12525)

  - squid: improper access restriction upon Digest Authentication nonce replay could lead to remote code     execution (CVE-2020-11945)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:0598 advisory.

  - nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string (CVE-2019-15604)

  - nodejs: HTTP request smuggling using malformed Transfer-Encoding header (CVE-2019-15605)

  - nodejs: HTTP header values do not have trailing optional whitespace trimmed (CVE-2019-15606)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:1810 advisory.

  - sqlite: fts3: improve shadow table corruption detection (CVE-2019-13752)

  - sqlite: fts3: incorrectly removed corruption check (CVE-2019-13753)

  - sqlite: mishandling of certain uses of SELECT DISTINCT involving a LEFT JOIN in flattenSubquery in     select.c leads to a NULL pointer dereference (CVE-2019-19923)

  - sqlite: incorrect sqlite3WindowRewrite() error handling leads to mishandling certain parser-tree rewriting     (CVE-2019-19924)

  - sqlite: zipfileUpdate in ext/misc/zipfile.c mishandles a NULL pathname during an update of a ZIP archive     (CVE-2019-19925)

  - sqlite: mishandles certain uses of INSERT INTO in situations involving embedded '\0' characters in     filenames (CVE-2019-19959)

  - sqlite: heap out-of-bound read in function rtreenode() (CVE-2019-8457)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2020:1712 advisory.

  - edk2: numeric truncation in MdeModulePkg/PiDxeS3BootScriptLib (CVE-2019-14563)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2021:0288 advisory.

  - Mozilla: HTTPS pages could have been intercepted by a registered service worker when they should not have     been (CVE-2020-26976)

  - Mozilla: Cross-origin information leakage via redirected PDF requests (CVE-2021-23953)

  - Mozilla: Type confusion when using logical assignment operators in JavaScript switch statements     (CVE-2021-23954)

  - Mozilla: Use-after-poison for incorrectly redeclared JavaScript variables during GC (CVE-2021-23960)

  - Mozilla: Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7 (CVE-2021-23964)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2021:0298 advisory.

  - Mozilla: IMAP Response Injection when using STARTTLS (CVE-2020-15685)

  - Mozilla: HTTPS pages could have been intercepted by a registered service worker when they should not have     been (CVE-2020-26976)

  - Mozilla: Cross-origin information leakage via redirected PDF requests (CVE-2021-23953)

  - Mozilla: Type confusion when using logical assignment operators in JavaScript switch statements     (CVE-2021-23954)

  - Mozilla: Use-after-poison for incorrectly redeclared JavaScript variables during GC (CVE-2021-23960)

  - Mozilla: Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7 (CVE-2021-23964)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:0150 advisory.

  - dnsmasq: heap-based buffer overflow in sort_rrset() when DNSSEC is enabled (CVE-2020-25681)

  - dnsmasq: buffer overflow in extract_name() due to missing length check when DNSSEC is enabled     (CVE-2020-25682)

  - dnsmasq: heap-based buffer overflow with large memcpy in get_rdata() when DNSSEC is enabled     (CVE-2020-25683)

  - dnsmasq: loose address/port check in reply_query() makes forging replies easier for an off-path attacker     (CVE-2020-25684)

  - dnsmasq: loose query name check in reply_query() makes forging replies easier for an off-path attacker     (CVE-2020-25685)

  - dnsmasq: multiple queries forwarded for the same name makes forging replies easier for an off-path     attacker (CVE-2020-25686)

  - dnsmasq: heap-based buffer overflow with large memcpy in sort_rrset() when DNSSEC is enabled     (CVE-2020-25687)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:1951 advisory.

  - nss: NULL pointer dereference in several CMS functions resulting in a denial of service (CVE-2018-18508)

  - nss: Out-of-bounds read when importing curve25519 private key (CVE-2019-11719)

  - nss: PKCS#1 v1.5 signatures can be used for TLS 1.3 (CVE-2019-11727)

  - nss: Empty or malformed p256-ECDH public keys may trigger a segmentation fault (CVE-2019-11729)

  - nss: Handling of Netscape Certificate Sequences in CERT_DecodeCertPackage() may crash with a NULL deref     leading to DoS (CVE-2019-17007)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3736 advisory.

  - php: underflow in env_path_info in fpm_main.c (CVE-2019-11043)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2019:1269 advisory.

  - mozilla: Cross-origin theft of images with ImageBitmapRenderingContext (CVE-2018-18511)

  - Mozilla: Use-after-free in XMLHttpRequest (CVE-2019-11691)

  - Mozilla: Use-after-free removing listeners in the event listener manager (CVE-2019-11692)

  - Mozilla: Buffer overflow in WebGL bufferdata on Linux (CVE-2019-11693)

  - Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks     (CVE-2019-11698)

  - chromium-browser: Out of bounds read in Skia (CVE-2019-5798)

  - libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)

  - Mozilla: Cross-origin theft of images with createImageBitmap (CVE-2019-9797)

  - Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 (CVE-2019-9800)

  - Mozilla: Type confusion with object groups and UnboxedObjects (CVE-2019-9816)

  - Mozilla: Stealing of cross-domain images using canvas (CVE-2019-9817)

  - Mozilla: Compartment mismatch with fetch API (CVE-2019-9819)

  - Mozilla: Use-after-free of ChromeEventHandler by DocShell (CVE-2019-9820)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3464 advisory.

  - virt-install: unattended option leaks password via command line argument (CVE-2019-10183)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3624 advisory.

  - libseccomp: incorrect generation of syscall filters in libseccomp (CVE-2019-9893)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2019:1696 advisory.

  - Mozilla: Type confusion in Array.pop (CVE-2019-11707)

  - Mozilla: Sandbox escape using Prompt:Open (CVE-2019-11708)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:2893 advisory.

  - HTTP/2: request for large response leads to denial of service (CVE-2019-9517)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:1529 advisory.

  - tomcat: Open redirect in default servlet (CVE-2018-11784)

  - tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins (CVE-2018-8014)

  - tomcat: Host name verification missing in WebSocket client (CVE-2018-8034)

  - tomcat: Due to a mishandling of close in NIO/NIO2 connectors user sessions can get mixed up     (CVE-2018-8037)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:0968 advisory.

  - edk2: Buffer Overflow in BlockIo service for RAM disk (CVE-2018-12180)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:1175 advisory.

  - hardware: Microarchitectural Store Buffer Data Sampling (MSBDS) (CVE-2018-12126)

  - hardware: Micro-architectural Load Port Data Sampling - Information Leak (MLPDS) (CVE-2018-12127)

  - hardware: Microarchitectural Fill Buffer Data Sampling (MFBDS) (CVE-2018-12130)

  - QEMU: device_tree: heap buffer overflow while loading device tree blob (CVE-2018-20815)

  - hardware: Microarchitectural Data Sampling Uncacheable Memory (MDSUM) (CVE-2019-11091)

  - libssh2: Integer overflow in transport read resulting in out of bounds write (CVE-2019-3855)

  - libssh2: Integer overflow in keyboard interactive handling resulting in out of bounds write     (CVE-2019-3856)

  - libssh2: Integer overflow in SSH packet processing channel resulting in out of bounds write     (CVE-2019-3857)

  - libssh2: Integer overflow in user authenticate keyboard interactive allows out-of-bounds writes     (CVE-2019-3863)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3476 advisory.

  - squid: XSS via user_name or auth parameter in cachemgr.cgi (CVE-2019-13345)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:3134 advisory.

  - OpenJDK: Missing restrictions on use of custom SocketImpl (Networking, 8218573) (CVE-2019-2945)

  - OpenJDK: Improper handling of Kerberos proxy credentials (Kerberos, 8220302) (CVE-2019-2949)

  - OpenJDK: NULL pointer dereference in DrawGlyphList (2D, 8222690) (CVE-2019-2962)

  - OpenJDK: Unexpected exception thrown by Pattern processing crafted regular expression (Concurrency,     8222684) (CVE-2019-2964)

  - OpenJDK: Unexpected exception thrown by XPathParser processing crafted XPath expression (JAXP, 8223505)     (CVE-2019-2973)

  - OpenJDK: Unexpected exception thrown during regular expression processing in Nashorn (Scripting, 8223518)     (CVE-2019-2975)

  - OpenJDK: Incorrect handling of nested jar: URLs in Jar URL handler (Networking, 8223892) (CVE-2019-2978)

  - OpenJDK: Unexpected exception thrown by XPath processing crafted XPath expression (JAXP, 8224532)     (CVE-2019-2981)

  - OpenJDK: Unexpected exception thrown during Font object deserialization (Serialization, 8224915)     (CVE-2019-2983)

  - OpenJDK: Missing glyph bitmap image dimension check in FreetypeFontScaler (2D, 8225286) (CVE-2019-2987)

  - OpenJDK: Integer overflow in bounds check in SunGraphics2D (2D, 8225292) (CVE-2019-2988)

  - OpenJDK: Incorrect handling of HTTP proxy responses in HttpURLConnection (Networking, 8225298)     (CVE-2019-2989)

  - OpenJDK: Excessive memory allocation in CMap when reading TrueType font (2D, 8225597) (CVE-2019-2992)

  - OpenJDK: Insufficient filtering of HTML event attributes in Javadoc (Javadoc, 8226765) (CVE-2019-2999)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:2411 advisory.

  - kernel: hw: Spectre SWAPGS gadget vulnerability (CVE-2019-1125)

  - kernel: broken permission and object lifetime handling for PTRACE_TRACEME (CVE-2019-13272)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3890 advisory.

  - ghostscript: -dSAFER escape in .charkeys (701841) (CVE-2019-14869)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:2722 advisory.

  - gd: Double free in the gdImage*Ptr in gd_gif_out.c, gd_jpeg.c, and gd_wbmp.c (CVE-2019-6978)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:1959 advisory.

  - kernel: infinite loop in update_blocked_averages() in kernel/sched/fair.c leading to denial of service     (CVE-2018-20784)

  - kernel: insufficient input validation in kernel mode driver in Intel i915 graphics leads to privilege     escalation (CVE-2019-11085)

  - kernel: a NULL pointer dereference in drivers/scsi/megaraid/megaraid_sas_base.c leading to DoS     (CVE-2019-11810)

  - kernel: use-after-free in drivers/char/ipmi/ipmi_si_intf.c, ipmi_si_mem_io.c, ipmi_si_port_io.c     (CVE-2019-11811)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:1279 advisory.

  - pacemaker: Insufficient local IPC client-server authentication on the client's side can lead to local     privesc (CVE-2018-16877)

  - pacemaker: Insufficient verification inflicted preference of uncontrolled processes can lead to DoS     (CVE-2018-16878)

  - pacemaker: Information disclosure through use-after-free (CVE-2019-3885)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:0990 advisory.

  - systemd: Insufficient input validation in bus_process_object() resulting in PID 1 crash (CVE-2019-6454)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3530 advisory.

  - glib2: file_copy_fallback in gio/gfile.c in GNOME GLib does not properly restrict file permissions while a     copy operation is in progress (CVE-2019-12450)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:4269 advisory.

  - runc: AppArmor/SELinux bypass with malicious image that specifies a volume at /proc (CVE-2019-16884)

  - podman: resolving symlink in host filesystem leads to unexpected results of copy operation     (CVE-2019-18466)

  - HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512)

  - HTTP/2: flood using HEADERS frames results in unbounded memory growth (CVE-2019-9514)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:1972 advisory.

  - rubygems: Installing a malicious gem may lead to arbitrary code execution (CVE-2019-8324)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2019:1799 advisory.

  - Mozilla: Memory safety bugs fixed in Firefox 68 and Firefox ESR 60.8 (CVE-2019-11709)

  - Mozilla: Script injection within domain through inner window reuse (CVE-2019-11711)

  - Mozilla: Cross-origin POST requests can be made with NPAPI plugins by following 308 redirects     (CVE-2019-11712)

  - Mozilla: Use-after-free with HTTP/2 cached stream (CVE-2019-11713)

  - Mozilla: HTML parsing error can contribute to content XSS (CVE-2019-11715)

  - Mozilla: Caret character improperly escaped in origins (CVE-2019-11717)

  - Mozilla: Same-origin policy treats all files in a directory as having the same-origin (CVE-2019-11730)

  - Mozilla: Sandbox escape via installation of malicious language pack (CVE-2019-9811)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:2703 advisory.

  - kernel: Use-after-free in sound/usb/card.c:usb_audio_probe() (CVE-2018-19824)

  - kernel: Count overflow in FUSE request leading to use-after-free issues. (CVE-2019-11487)

  - kernel: ppc: unrelated processes being able to read/write to each other's virtual memory (CVE-2019-12817)

  - kernel: Heap overflow in mwifiex_update_bss_desc_with_ie function in marvell/mwifiex/scan.c     (CVE-2019-3846)

  - Kernel: KVM: nVMX: guest accesses L0 MSR causes potential DoS (CVE-2019-3887)

  - kernel: brcmfmac heap buffer overflow in brcmf_wowl_nd_results (CVE-2019-9500)

  - kernel: brcmfmac frame validation bypass (CVE-2019-9503)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3513 advisory.

  - glibc: getaddrinfo should reject IP addresses with trailing characters (CVE-2016-10739)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:3600 advisory.

  - gnutls: use-after-free/double-free in certificate verification (CVE-2019-3829)

  - gnutls: invalid pointer access upon receiving async handshake messages (CVE-2019-3836)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:3517 advisory.

  - kernel: Linux stack ASLR implementation Integer overflow (CVE-2015-1593)

  - kernel: nfs: use-after-free in svc_process_common() (CVE-2018-16884)

  - kernel: Information Disclosure in crypto_report_one in crypto/crypto_user.c (CVE-2018-19854)

  - kernel: oob memory read in hso_probe in drivers/net/usb/hso.c (CVE-2018-19985)

  - kernel: usb: missing size check in the __usb_get_extra_descriptor() leading to DoS (CVE-2018-20169)

  - kernel: Heap overflow in mwifiex_uap_parse_tail_ies function in drivers/net/wireless/marvell/mwifiex/ie.c     (CVE-2019-10126)

  - kernel: null-pointer dereference in hci_uart_set_flow_control (CVE-2019-10207)

  - Kernel: net: weak IP ID generation leads to remote device tracking (CVE-2019-10638)

  - kernel: fix race condition between mmget_not_zero()/get_task_mm() and core dumping (CVE-2019-11599)

  - kernel: fs/ext4/extents.c leads to information disclosure (CVE-2019-11833)

  - kernel: sensitive information disclosure from kernel stack memory via HIDPCONNADD command (CVE-2019-11884)

  - kernel: unchecked kstrdup of fwstr in drm_load_edid_firmware leads to denial of service (CVE-2019-12382)

  - kernel: use-after-free in arch/x86/lib/insn-eval.c (CVE-2019-13233)

  - kernel: denial of service in arch/powerpc/kernel/signal_32.c and arch/powerpc/kernel/signal_64.c via     sigreturn() system call (CVE-2019-13648)

  - Kernel: KVM: OOB memory access via mmio ring buffer (CVE-2019-14821)

  - kernel: out-of-bounds array access in __xfrm_policy_unlink (CVE-2019-15666)

  - kernel: memory leak in register_queue_kobjects() in net/core/net-sysfs.c leads to denial of service     (CVE-2019-15916)

  - kernel: memory leak in genl_register_family() in net/netlink/genetlink.c (CVE-2019-15921)

  - kernel: null pointer dereference in drivers/net/ethernet/intel/fm10k/fm10k_main.c (CVE-2019-15924)

  - kernel: Memory leak in sit_init_net() in net/ipv6/sit.c (CVE-2019-16994)

  - kernel: Heap address information leak while using L2CAP_GET_CONF_OPT (CVE-2019-3459)

  - kernel: Heap address information leak while using L2CAP_PARSE_CONF_RSP (CVE-2019-3460)

  - kernel: SCTP socket buffer memory leak leading to denial of service (CVE-2019-3874)

  - kernel: denial of service vector through vfio DMA mappings (CVE-2019-3882)

  - Kernel: vhost_net: infinite loop while receiving packets leads to DoS (CVE-2019-3900)

  - Kernel: page cache side channel attacks (CVE-2019-5489)

  - Kernel: KVM: leak of uninitialized stack contents to guest (CVE-2019-7222)

  - hardware: bluetooth: BR/EDR encryption key negotiation attacks (KNOB) (CVE-2019-9506)

  - kernel: use-after-free read in napi_gro_frags() in the Linux kernel (CVE-2020-10720)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:3401 advisory.

  - 389-ds-base: replication and the Retro Changelog plugin store plaintext password by default     (CVE-2018-10871)

  - 389-ds-base: using dscreate in verbose mode results in information disclosure (CVE-2019-10224)

  - 389-ds-base: Read permission check bypass via the deref plugin (CVE-2019-14824)

  - 389-ds-base: DoS via hanging secured connections (CVE-2019-3883)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:1817 advisory.

  - OpenJDK: Side-channel attack risks in Elliptic Curve (EC) cryptography (Security, 8208698) (CVE-2019-2745)

  - OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328)     (CVE-2019-2762)

  - OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432)     (CVE-2019-2769)

  - OpenJDK: Insufficient restriction of privileges in AccessController (Security, 8216381) (CVE-2019-2786)

  - OpenJDK: Missing URL format validation (Networking, 8221518) (CVE-2019-2816)

  - OpenJDK: Non-constant time comparison in ChaCha20Cipher (Security, 8221344) (CVE-2019-2818)

  - OpenJDK: Incorrect handling of certificate status messages during TLS handshake (JSSE, 8222678)     (CVE-2019-2821)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:0971 advisory.

  - ghostscript: superexec operator is available (700585) (CVE-2019-3835)

  - ghostscript: forceput in DefineResource is still accessible (700576) (CVE-2019-3838)

  - ghostscript: missing attack vector protections for CVE-2019-6116 (CVE-2019-3839)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:3700 advisory.

  - openssl: timing side channel attack in the DSA signature algorithm (CVE-2018-0734)

  - openssl: timing side channel attack in the ECDSA signature generation (CVE-2018-0735)

  - openssl: ChaCha20-Poly1305 with long nonces (CVE-2019-1543)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2019:0983 advisory.

  - wget: do_conversion() heap-based buffer overflow vulnerability (CVE-2019-5953)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3735 advisory.

  - php: underflow in env_path_info in fpm_main.c (CVE-2019-11043)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:3520 advisory.

  - python: NULL pointer dereference using a specially crafted X509 certificate (CVE-2019-5010)

  - python: CRLF injection via the query part of the url passed to urlopen() (CVE-2019-9740)

  - python: CRLF injection via the path part of the url passed to urlopen() (CVE-2019-9947)

  - python: Undocumented local_file protocol allows remote attackers to bypass protection mechanisms     (CVE-2019-9948)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3353 advisory.

  - freeradius: privilege escalation due to insecure logrotate configuration (CVE-2019-10143)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:1518 advisory.

  - OpenJDK: Slow conversion of BigDecimal to long (Libraries, 8211936) (CVE-2019-2602)

  - OpenJDK: Incorrect skeleton selection in RMI registry server-side dispatch handling (RMI, 8218453)     (CVE-2019-2684)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:4114 advisory.

  - nss: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate     (CVE-2019-11745)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Severity
145804	CentOS 8 : nodejs:10 (CESA-2020:2848)	high
145803	CentOS 8 : http-parser (CESA-2020:0708)	critical
145802	CentOS 8 : libexif (CESA-2020:2550)	critical
145801	CentOS 8 : kernel (CESA-2020:0339)	critical
145800	CentOS 8 : nginx:1.16 (CESA-2020:5495)	medium
145799	CentOS 8 : freeradius:3.0 (CESA-2020:1672)	medium
145798	CentOS 8 : container-tools:rhel8 (CESA-2020:1650)	high
145797	CentOS 8 : squid:4 (CESA-2020:2041)	critical
145796	CentOS 8 : nodejs:12 (CESA-2020:0598)	critical
145795	CentOS 8 : sqlite (CESA-2020:1810)	critical
145794	CentOS 8 : edk2 (CESA-2020:1712)	high
145792	CentOS 8 : firefox (CESA-2021:0288)	high
145791	CentOS 8 : thunderbird (CESA-2021:0298)	high
145698	CentOS 8 : dnsmasq (CESA-2021:0150)	high
145690	CentOS 8 : nss and nspr (CESA-2019:1951)	high
145689	CentOS 8 : php:7.3 (CESA-2019:3736)	critical
145688	CentOS 8 : firefox (CESA-2019:1269)	critical
145687	CentOS 8 : virt-manager (CESA-2019:3464)	low
145686	CentOS 8 : libseccomp (CESA-2019:3624)	critical
145685	CentOS 8 : firefox (CESA-2019:1696)	critical
145684	CentOS 8 : httpd:2.4 (CESA-2019:2893)	high
145683	CentOS 8 : pki-deps:10.6 (CESA-2019:1529)	critical
145682	CentOS 8 : edk2 (CESA-2019:0968)	high
145681	CentOS 8 : virt:rhel (CESA-2019:1175)	critical
145680	CentOS 8 : squid:4 (CESA-2019:3476)	medium
145679	CentOS 8 : java-1.8.0-openjdk (CESA-2019:3134)	medium
145678	CentOS 8 : kernel (CESA-2019:2411)	high
145677	CentOS 8 : ghostscript (CESA-2019:3890)	high
145676	CentOS 8 : libwmf (CESA-2019:2722)	critical
145675	CentOS 8 : kernel (CESA-2019:1959)	critical
145674	CentOS 8 : pacemaker (CESA-2019:1279)	high
145673	CentOS 8 : systemd (CESA-2019:0990)	medium
145672	CentOS 8 : glib2 (CESA-2019:3530)	critical
145671	CentOS 8 : container-tools:rhel8 (CESA-2019:4269)	high
145670	CentOS 8 : ruby:2.5 (CESA-2019:1972)	high
145669	CentOS 8 : thunderbird (CESA-2019:1799)	critical
145668	CentOS 8 : kernel (CESA-2019:2703)	high
145667	CentOS 8 : glibc (CESA-2019:3513)	medium
145666	CentOS 8 : gnutls (CESA-2019:3600)	high
145665	CentOS 8 : kernel (CESA-2019:3517)	critical
145664	CentOS 8 : 389-ds:1.4 (CESA-2019:3401)	high
145663	CentOS 8 : java-11-openjdk (CESA-2019:1817)	medium
145662	CentOS 8 : ghostscript (CESA-2019:0971)	high
145661	CentOS 8 : openssl (CESA-2019:3700)	high
145660	CentOS 8 : wget (CESA-2019:0983)	critical
145659	CentOS 8 : php:7.2 (CESA-2019:3735)	critical
145658	CentOS 8 : python3 (CESA-2019:3520)	critical
145657	CentOS 8 : freeradius:3.0 (CESA-2019:3353)	high
145656	CentOS 8 : java-11-openjdk (CESA-2019:1518)	medium
145655	CentOS 8 : nss (CESA-2019:4114)	high

Detections

Analytics

CentOS Local Security Checks Family for Nessus

high

critical

critical

critical

medium

medium

high

critical

critical

critical

high

high

high

high

high

critical

critical

low

critical

critical

high

critical

high

critical

medium

medium

high

high

critical

critical

high

medium

critical

high

high

critical

high

medium

high

critical

high

medium

high

high

critical

critical

critical

high

medium

high