The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:3436 advisory.

  - httpd: mod_auth_digest: access control bypass due to race condition (CVE-2019-0217)

  - httpd: URL normalization inconsistency (CVE-2019-0220)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:3553 advisory.

  - webkitgtk: HTTP proxy setting deanonymization information disclosure (CVE-2019-11070)

  - evince: uninitialized memory use in function tiff_document_render() and tiff_document_get_thumbnail()     (CVE-2019-11459)

  - gvfs: improper authorization in daemon/gvfsdaemon.c in gvfsd (CVE-2019-12795)

  - webkitgtk: Multiple memory corruption issues leading to arbitrary code execution (CVE-2019-6237,     CVE-2019-8571, CVE-2019-8583, CVE-2019-8584, CVE-2019-8586, CVE-2019-8587, CVE-2019-8594, CVE-2019-8595,     CVE-2019-8596, CVE-2019-8597, CVE-2019-8601, CVE-2019-8608, CVE-2019-8609, CVE-2019-8610, CVE-2019-8611,     CVE-2019-8615, CVE-2019-8619, CVE-2019-8622, CVE-2019-8623, CVE-2019-8666, CVE-2019-8671, CVE-2019-8672,     CVE-2019-8673, CVE-2019-8676, CVE-2019-8677, CVE-2019-8679, CVE-2019-8681, CVE-2019-8686, CVE-2019-8687,     CVE-2019-8689, CVE-2019-8726, CVE-2019-8735)

  - webkitgtk: processing maliciously crafted web content lead to URI spoofing (CVE-2019-6251)

  - webkitgtk: malicous web content leads to arbitrary code execution (CVE-2019-8506)

  - webkitgtk: malicious web content leads to arbitrary code execution (CVE-2019-8518, CVE-2019-8523,     CVE-2019-8524, CVE-2019-8559, CVE-2019-8563)

  - webkitgtk: malicious crafted web content leads to arbitrary code execution (CVE-2019-8535, CVE-2019-8536,     CVE-2019-8558)

  - webkitgtk: malicious crafted web content leads to arbitrary we content (CVE-2019-8544)

  - webkitgtk: Out-of-bounds read leading to memory disclosure (CVE-2019-8607)

  - webkitgtk: Incorrect state management leading to universal cross-site scripting (CVE-2019-8690)

  - webkitgtk: Browsing history could not be deleted (CVE-2019-8768)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:2692 advisory.

  - HTTP/2: large amount of data requests leads to denial of service (CVE-2019-9511)

  - HTTP/2: flood using PRIORITY frames results in excessive resource consumption (CVE-2019-9513)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:1479 advisory.

  - Kernel: tcp: integer overflow while processing SACK blocks allows remote denial of service     (CVE-2019-11477)

  - Kernel: tcp: excessive resource consumption while processing SACK blocks allows remote denial of service     (CVE-2019-11478)

  - kernel: tcp: excessive resource consumption for TCP connections with low MSS allows remote denial of     service (CVE-2019-11479)

  - kernel: lack of check for mmap minimum address in expand_downwards in mm/mmap.c leads to NULL pointer     dereferences exploit on non-SMAP platforms (CVE-2019-9213)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:1816 advisory.

  - OpenJDK: Side-channel attack risks in Elliptic Curve (EC) cryptography (Security, 8208698) (CVE-2019-2745)

  - OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328)     (CVE-2019-2762)

  - OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432)     (CVE-2019-2769)

  - OpenJDK: Insufficient restriction of privileges in AccessController (Security, 8216381) (CVE-2019-2786)

  - OpenJDK: Missing URL format validation (Networking, 8221518) (CVE-2019-2816)

  - OpenJDK: Missing array bounds check in crypto providers (JCE, 8223511) (CVE-2019-2842)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:0984 advisory.

  - python-sqlalchemy: SQL Injection when the order_by parameter can be controlled (CVE-2019-7164)

  - python-sqlalchemy: SQL Injection when the group_by parameter can be controlled (CVE-2019-7548)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:3135 advisory.

  - OpenJDK: Missing restrictions on use of custom SocketImpl (Networking, 8218573) (CVE-2019-2945)

  - OpenJDK: Improper handling of Kerberos proxy credentials (Kerberos, 8220302) (CVE-2019-2949)

  - OpenJDK: NULL pointer dereference in DrawGlyphList (2D, 8222690) (CVE-2019-2962)

  - OpenJDK: Unexpected exception thrown by Pattern processing crafted regular expression (Concurrency,     8222684) (CVE-2019-2964)

  - OpenJDK: Unexpected exception thrown by XPathParser processing crafted XPath expression (JAXP, 8223505)     (CVE-2019-2973)

  - OpenJDK: Unexpected exception thrown during regular expression processing in Nashorn (Scripting, 8223518)     (CVE-2019-2975)

  - OpenJDK: Out of bounds access in optimized String indexof implementation (Hotspot, 8224062)     (CVE-2019-2977)

  - OpenJDK: Incorrect handling of nested jar: URLs in Jar URL handler (Networking, 8223892) (CVE-2019-2978)

  - OpenJDK: Unexpected exception thrown by XPath processing crafted XPath expression (JAXP, 8224532)     (CVE-2019-2981)

  - OpenJDK: Unexpected exception thrown during Font object deserialization (Serialization, 8224915)     (CVE-2019-2983)

  - OpenJDK: Missing glyph bitmap image dimension check in FreetypeFontScaler (2D, 8225286) (CVE-2019-2987)

  - OpenJDK: Integer overflow in bounds check in SunGraphics2D (2D, 8225292) (CVE-2019-2988)

  - OpenJDK: Incorrect handling of HTTP proxy responses in HttpURLConnection (Networking, 8225298)     (CVE-2019-2989)

  - OpenJDK: Excessive memory allocation in CMap when reading TrueType font (2D, 8225597) (CVE-2019-2992)

  - OpenJDK: Insufficient filtering of HTML event attributes in Javadoc (Javadoc, 8226765) (CVE-2019-2999)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2019:2798 advisory.

  - patch: do_ed_script in pch.c does not block strings beginning with a ! character (CVE-2018-20969)

  - patch: OS shell command injection when processing crafted patch files (CVE-2019-13638)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3433 advisory.

  - golang: malformed hosts in URLs leads to authorization bypass (CVE-2019-14809)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:3575 advisory.

  - elfutils: buffer over-read in the ebl_object_note function in eblobjnote.c in libebl (CVE-2019-7146)

  - elfutils: heap-based buffer over-read in read_srclines in dwarf_getsrclines.c in libdw (CVE-2019-7149)

  - elfutils: segmentation fault in elf64_xlatetom in libelf/elf32_xlatetom.c (CVE-2019-7150)

  - elfutils: out of bound write in elf_cvt_note in libelf/note_xlate.h (CVE-2019-7664)

  - elfutils: heap-based buffer over-read in function elf32_xlatetom in elf32_xlatetom.c (CVE-2019-7665)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:0972 advisory.

  - openwsman: Disclosure of arbitrary files outside of the registered URIs (CVE-2019-3816)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2019:3673 advisory.

  - lldptool: improper sanitization of shell-escape codes (CVE-2018-10932)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:0975 advisory.

  - runc: Execution of malicious containers allows for container escape and access to host filesystem     (CVE-2019-5736)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2019:3237 advisory.

  - Mozilla: Use-after-free when creating index updates in IndexedDB (CVE-2019-11757)

  - Mozilla: Potentially exploitable crash due to 360 Total Security (CVE-2019-11758)

  - Mozilla: Stack buffer overflow in HKDF output (CVE-2019-11759)

  - Mozilla: Stack buffer overflow in WebRTC networking (CVE-2019-11760)

  - Mozilla: Unintended access to a privileged JSONView object (CVE-2019-11761)

  - Mozilla: document.domain-based origin isolation has same-origin-property violation (CVE-2019-11762)

  - Mozilla: Incorrect HTML parsing results in XSS bypass technique (CVE-2019-11763)

  - Mozilla: Memory safety bugs fixed in Firefox 70 and Firefox ESR 68.2 (CVE-2019-11764)

  - expat: heap-based buffer over-read via crafted XML input (CVE-2019-15903)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:1517 advisory.

  - gvfs: Incorrect authorization in admin backend allows privileged users to read and modify arbitrary files     without prompting for password (CVE-2019-3827)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3704 advisory.

  - numpy: crafted serialized object passed in numpy.load() in pickle python module allows arbitrary code     execution (CVE-2019-6446)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:2827 advisory.

  - kernel: vhost-net: guest to host kernel escape during migration (CVE-2019-14835)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:2720 advisory.

  - jackson-databind: failure to block the logback-core class from polymorphic deserialization leading to     remote code execution (CVE-2019-12384)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2019:4195 advisory.

  - Mozilla: Buffer overflow in plain text serializer (CVE-2019-17005)

  - Mozilla: Use-after-free in worker destruction (CVE-2019-17008)

  - Mozilla: Use-after-free when performing device orientation checks (CVE-2019-17010)

  - Mozilla: Use-after-free when retrieving a document in antitracking (CVE-2019-17011)

  - Mozilla: Memory safety bugs fixed in Firefox 71 and Firefox ESR 68.3 (CVE-2019-17012)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2019:3391 advisory.

  - libreswan: vulnerability in the processing of IKEv1 informational packets due to missing integrity check     (CVE-2019-10155)

  - libreswan: null-pointer dereference by sending two IKEv2 packets (CVE-2019-12312)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3592 advisory.

  - systemd: systemd-resolved allows unprivileged users to configure DNS (CVE-2019-15718)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3352 advisory.

  - libiberty: Memory leak in demangle_template function resulting in a denial of service (CVE-2018-20657)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3871 advisory.

  - hw: Intel GPU blitter manipulation can allow for arbitrary kernel memory write (CVE-2019-0155)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:2713 advisory.

  - poppler: memory leak in GfxColorSpace::setDisplayProfile in GfxState.cc (CVE-2018-18897)

  - poppler: NULL pointer dereference in the XRef::getEntry in XRef.cc (CVE-2018-20481)

  - poppler: reachable Object::getString assertion in AnnotRichMedia class in Annot.c (CVE-2018-20551)

  - poppler: reachable Object::dictLookup assertion in FileSpec class in FileSpec.cc (CVE-2018-20650)

  - poppler: SIGABRT PDFDoc::setup class in PDFDoc.cc (CVE-2018-20662)

  - poppler: heap-based buffer over-read in function PSOutputDev::checkPageSlice in PSOutputDev.cc     (CVE-2019-10871)

  - poppler: heap-based buffer over-read in JPXStream::init in JPEG2000Stream.cc (CVE-2019-12293)

  - poppler: heap-based buffer over-read in XRef::getEntry in XRef.cc (CVE-2019-7310)

  - poppler: heap-based buffer overflow in function ImageStream::getLine() in Stream.cc (CVE-2019-9200)

  - poppler: heap-based buffer over-read in function downsample_row_box_filter in CairoRescaleBox.cc     (CVE-2019-9631)

  - poppler: stack consumption in function Dict::find() in Dict.cc (CVE-2019-9903)

  - poppler: integer overflow in JPXStream::init function leading to memory consumption (CVE-2019-9959)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2019:1308 advisory.

  - mozilla: Cross-origin theft of images with ImageBitmapRenderingContext (CVE-2018-18511)

  - Mozilla: Use-after-free in XMLHttpRequest (CVE-2019-11691)

  - Mozilla: Use-after-free removing listeners in the event listener manager (CVE-2019-11692)

  - Mozilla: Buffer overflow in WebGL bufferdata on Linux (CVE-2019-11693)

  - Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks     (CVE-2019-11698)

  - chromium-browser: Out of bounds read in Skia (CVE-2019-5798)

  - libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)

  - Mozilla: Cross-origin theft of images with createImageBitmap (CVE-2019-9797)

  - Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 (CVE-2019-9800)

  - Mozilla: Stealing of cross-domain images using canvas (CVE-2019-9817)

  - Mozilla: Compartment mismatch with fetch API (CVE-2019-9819)

  - Mozilla: Use-after-free of ChromeEventHandler by DocShell (CVE-2019-9820)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3705 advisory.

  - libjpeg-turbo: heap-based buffer over-read via crafted 8-bit BMP in get_8bit_row in rdbmp.c leads to     denial of service (CVE-2018-14498)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3387 advisory.

  - Libosinfo: osinfo-install-script option leaks password via command line argument (CVE-2019-13313)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2019:0985 advisory.

  - mod_auth_mellon: authentication bypass in ECP flow (CVE-2019-3878)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2019:4360 advisory.

  - libyang: stack-based buffer overflow in make_canonical when bits leaf type is used (CVE-2019-19333)

  - libyang: stack-based buffer overflow in make_canonical when identityref leaf type is used (CVE-2019-19334)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2019:2663 advisory.

  - firefox: stored passwords in 'Saved Logins' can be copied without master password entry (CVE-2019-11733)

  - Mozilla: Memory safety bugs fixed in Firefox 69 and Firefox ESR 68.1 (CVE-2019-11735)

  - Mozilla: Content security policy bypass through hash-based sources in directives (CVE-2019-11738)

  - Mozilla: Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, Firefox ESR 60.9, Thunderbird 68.1, and     Thunderbird 60.9 (CVE-2019-11740)

  - Mozilla: Same-origin policy violation with SVG filters and canvas to steal cross-origin images     (CVE-2019-11742)

  - Mozilla: Cross-origin access to unload event attributes (CVE-2019-11743)

  - Mozilla: XSS by breaking out of title and textarea elements using innerHTML (CVE-2019-11744)

  - Mozilla: Use-after-free while manipulating video (CVE-2019-11746)

  - Mozilla: 'Forget about this site' removes sites from pre-loaded HSTS list (CVE-2019-11747)

  - Mozilla: Persistence of WebRTC permissions in a third party context (CVE-2019-11748)

  - Mozilla: Camera information available without prompting using getUserMedia (CVE-2019-11749)

  - Mozilla: Type confusion in Spidermonkey (CVE-2019-11750)

  - Mozilla: Use-after-free while extracting a key value in IndexedDB (CVE-2019-11752)

  - Mozilla: Sandbox escape through Firefox Sync (CVE-2019-9812)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:3390 advisory.

  - qt5-qtbase: Double free in QXmlStreamReader (CVE-2018-15518)

  - qt5-qtbase: QImage allocation failure in qgifhandler (CVE-2018-19870)

  - qt5-qtbase: QBmpHandler segmentation fault on malformed BMP file (CVE-2018-19873)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:3698 advisory.

  - libarchive: Out-of-bounds read in lha_read_data_none (CVE-2017-14503)

  - libarchive: Double free in RAR decoder resulting in a denial of service (CVE-2018-1000877)

  - libarchive: Use after free in RAR decoder resulting in a denial of service (CVE-2018-1000878)

  - libarchive: Out of bounds read in archive_read_support_format_7zip.c resulting in a denial of service     (CVE-2019-1000019)

  - libarchive: Infinite recursion in archive_read_support_format_iso9660.c resulting in denial of service     (CVE-2019-1000020)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:2799 advisory.

  - HTTP/2: large amount of data requests leads to denial of service (CVE-2019-9511)

  - HTTP/2: flood using PRIORITY frames results in excessive resource consumption (CVE-2019-9513)

  - HTTP/2: 0-length headers lead to denial of service (CVE-2019-9516)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:3703 advisory.

  - libvorbis: heap buffer overflow in mapping0_forward function (CVE-2018-10392)

  - libvorbis: stack buffer overflow in bark_noise_hybridmp function (CVE-2018-10393)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:1519 advisory.

  - golang: CRLF injection in net/http (CVE-2019-9741)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3610 advisory.

  - libqb: Insecure treatment of IPC (temporary) files (CVE-2019-12779)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:3335 advisory.

  - python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading to possible attack on     internal service (CVE-2019-11236)

  - python-urllib3: Certification mishandle when error should be thrown (CVE-2019-11324)

  - numpy: crafted serialized object passed in numpy.load() in pickle python module allows arbitrary code     execution (CVE-2019-6446)

  - python: CRLF injection via the query part of the url passed to urlopen() (CVE-2019-9740)

  - python: CRLF injection via the path part of the url passed to urlopen() (CVE-2019-9947)

  - python: Undocumented local_file protocol allows remote attackers to bypass protection mechanisms     (CVE-2019-9948)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:2822 advisory.

  - dovecot: improper NULL byte handling in IMAP and ManageSieve protocol parsers leads to out of bounds     writes (CVE-2019-11500)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2019:1764 advisory.

  - Mozilla: Memory safety bugs fixed in Firefox 68 and Firefox ESR 60.8 (CVE-2019-11709)

  - Mozilla: Script injection within domain through inner window reuse (CVE-2019-11711)

  - Mozilla: Cross-origin POST requests can be made with NPAPI plugins by following 308 redirects     (CVE-2019-11712)

  - Mozilla: Use-after-free with HTTP/2 cached stream (CVE-2019-11713)

  - Mozilla: HTML parsing error can contribute to content XSS (CVE-2019-11715)

  - Mozilla: Caret character improperly escaped in origins (CVE-2019-11717)

  - Mozilla: Same-origin policy treats all files in a directory as having the same-origin (CVE-2019-11730)

  - Mozilla: Sandbox escape via installation of malicious language pack (CVE-2019-9811)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2019:3694 advisory.

  - sudo: Privilege escalation via 'Runas' specification with 'ALL' keyword (CVE-2019-14287)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3467 advisory.

  - dovecot: Improper certificate validation (CVE-2019-3814)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:2591 advisory.

  - ghostscript: Safer mode bypass by .forceput exposure in .pdf_hook_DSC_Creator (701445) (CVE-2019-14811)

  - ghostscript: Safer mode bypass by .forceput exposure in setuserparams (701444) (CVE-2019-14812)

  - ghostscript: Safer mode bypass by .forceput exposure in setsystemparams (701443) (CVE-2019-14813)

  - ghostscript: Safer mode bypass by .forceput exposure in .pdfexectoken and other procedures (701450)     (CVE-2019-14817)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:2511 advisory.

  - mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2019) (CVE-2019-2420, CVE-2019-2481,     CVE-2019-2507, CVE-2019-2529, CVE-2019-2530)

  - mysql: Server: Parser unspecified vulnerability (CPU Jan 2019) (CVE-2019-2434, CVE-2019-2455)

  - mysql: Server: Replication unspecified vulnerability (CPU Jan 2019) (CVE-2019-2436, CVE-2019-2531,     CVE-2019-2534)

  - mysql: Server: PS unspecified vulnerability (CPU Jan 2019) (CVE-2019-2482)

  - mysql: Server: Security: Privileges unspecified vulnerability (CPU Jan 2019) (CVE-2019-2486,     CVE-2019-2532, CVE-2019-2533)

  - mysql: Server: DDL unspecified vulnerability (CPU Jan 2019) (CVE-2019-2494, CVE-2019-2495, CVE-2019-2537)

  - mysql: InnoDB unspecified vulnerability (CPU Jan 2019) (CVE-2019-2502, CVE-2019-2510)

  - mysql: Server: Connection Handling unspecified vulnerability (CPU Jan 2019) (CVE-2019-2503)

  - mysql: Server: Partition unspecified vulnerability (CPU Jan 2019) (CVE-2019-2528)

  - mysql: Server: Options unspecified vulnerability (CPU Jan 2019) (CVE-2019-2535)

  - mysql: Server: Packaging unspecified vulnerability (CPU Jan 2019) (CVE-2019-2536)

  - mysql: Server: Connection unspecified vulnerability (CPU Jan 2019) (CVE-2019-2539)

  - mysql: InnoDB unspecified vulnerability (CPU Apr 2019) (CVE-2019-2580, CVE-2019-2585, CVE-2019-2593,     CVE-2019-2624, CVE-2019-2628)

  - mysql: Server: Optimizer unspecified vulnerability (CPU Apr 2019) (CVE-2019-2581, CVE-2019-2596,     CVE-2019-2607, CVE-2019-2625, CVE-2019-2681, CVE-2019-2685, CVE-2019-2686, CVE-2019-2687, CVE-2019-2688,     CVE-2019-2689, CVE-2019-2693, CVE-2019-2694, CVE-2019-2695)

  - mysql: Server: Security: Privileges unspecified vulnerability (CPU Apr 2019) (CVE-2019-2584,     CVE-2019-2589, CVE-2019-2606, CVE-2019-2620, CVE-2019-2627)

  - mysql: Server: Partition unspecified vulnerability (CPU Apr 2019) (CVE-2019-2587)

  - mysql: Server: PS unspecified vulnerability (CPU Apr 2019) (CVE-2019-2592)

  - mysql: Server: Replication unspecified vulnerability (CPU Apr 2019) (CVE-2019-2614, CVE-2019-2617,     CVE-2019-2630, CVE-2019-2634, CVE-2019-2635)

  - mysql: Server: Options unspecified vulnerability (CPU Apr 2019) (CVE-2019-2623, CVE-2019-2683)

  - mysql: Server: DDL unspecified vulnerability (CPU Apr 2019) (CVE-2019-2626, CVE-2019-2644)

  - mysql: Server: Information Schema unspecified vulnerability (CPU Apr 2019) (CVE-2019-2631)

  - mysql: Server: Group Replication Plugin unspecified vulnerability (CPU Apr 2019) (CVE-2019-2636)

  - mysql: Server: Security: Roles unspecified vulnerability (CPU Apr 2019) (CVE-2019-2691)

  - mysql: Server: Pluggable Auth unspecified vulnerability (CPU Jul 2019) (CVE-2019-2737)

  - mysql: Server: Compiling unspecified vulnerability (CPU Jul 2019) (CVE-2019-2738)

  - mysql: Server: Security: Privileges unspecified vulnerability (CPU Jul 2019) (CVE-2019-2739,     CVE-2019-2778, CVE-2019-2789, CVE-2019-2811)

  - mysql: Server: XML unspecified vulnerability (CPU Jul 2019) (CVE-2019-2740)

  - mysql: Server: Options unspecified vulnerability (CPU Jul 2019) (CVE-2019-2752)

  - mysql: Server: Replication unspecified vulnerability (CPU Jul 2019) (CVE-2019-2755, CVE-2019-2800)

  - mysql: Server: Optimizer unspecified vulnerability (CPU Jul 2019) (CVE-2019-2757, CVE-2019-2774,     CVE-2019-2796, CVE-2019-2802, CVE-2019-2803, CVE-2019-2808, CVE-2019-2810, CVE-2019-2812, CVE-2019-2815,     CVE-2019-2830, CVE-2019-2834)

  - mysql: InnoDB unspecified vulnerability (CPU Jul 2019) (CVE-2019-2758, CVE-2019-2785, CVE-2019-2798,     CVE-2019-2814, CVE-2019-2879)

  - mysql: Server: Components / Services unspecified vulnerability (CPU Jul 2019) (CVE-2019-2780)

  - mysql: Server: DML unspecified vulnerability (CPU Jul 2019) (CVE-2019-2784)

  - mysql: Server: Charsets unspecified vulnerability (CPU Jul 2019) (CVE-2019-2795)

  - mysql: Client programs unspecified vulnerability (CPU Jul 2019) (CVE-2019-2797)

  - mysql: Server: FTS unspecified vulnerability (CPU Jul 2019) (CVE-2019-2801)

  - mysql: Server: Parser unspecified vulnerability (CPU Jul 2019) (CVE-2019-2805)

  - mysql: Server: Security: Audit unspecified vulnerability (CPU Jul 2019) (CVE-2019-2819)

  - mysql: Server: Security: Roles unspecified vulnerability (CPU Jul 2019) (CVE-2019-2826)

  - mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2019) (CVE-2019-2948, CVE-2019-2950)

  - mysql: Client programs unspecified vulnerability (CPU Oct 2019) (CVE-2019-2969)

  - mysql: InnoDB unspecified vulnerability (CPU Oct 2019) (CVE-2019-3003)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:2731 advisory.

  - dotnet: System.Net.Sockets.dll Socket.ConnectAsync Denial of Service (CVE-2019-1301)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:1268 advisory.

  - libvirt: wrong permissions in systemd admin-sock due to missing SocketMode parameter (CVE-2019-10132)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:3708 advisory.

  - mysql: InnoDB unspecified vulnerability (CPU Jan 2019) (CVE-2019-2510)

  - mysql: Server: DDL unspecified vulnerability (CPU Jan 2019) (CVE-2019-2537)

  - mysql: Server: Replication unspecified vulnerability (CPU Apr 2019) (CVE-2019-2614)

  - mysql: Server: Security: Privileges unspecified vulnerability (CPU Apr 2019) (CVE-2019-2627)

  - mysql: InnoDB unspecified vulnerability (CPU Apr 2019) (CVE-2019-2628)

  - mysql: Server: Pluggable Auth unspecified vulnerability (CPU Jul 2019) (CVE-2019-2737)

  - mysql: Server: Security: Privileges unspecified vulnerability (CPU Jul 2019) (CVE-2019-2739)

  - mysql: Server: XML unspecified vulnerability (CPU Jul 2019) (CVE-2019-2740)

  - mysql: InnoDB unspecified vulnerability (CPU Jul 2019) (CVE-2019-2758)

  - mysql: Server: Parser unspecified vulnerability (CPU Jul 2019) (CVE-2019-2805)

  - mysql: C API unspecified vulnerability (CPU Apr 2020) (CVE-2020-2922)

  - mysql: C API unspecified vulnerability (CPU Jan 2021) (CVE-2021-2007)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3643 advisory.

  - gettext: double free in default_add_message in read-catalog.c (CVE-2018-18751)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3419 advisory.

  - libtiff: Heap-based buffer overflow in the cpSeparateBufToContigBuf function resulting in a denial of     service or possibly code execution (CVE-2018-12900)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3651 advisory.

  - sssd: improper implementation of GPOs due to too restrictive permissions (CVE-2018-16838)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3706 advisory.

  - lua: use-after-free in lua_upvaluejoin in lapi.c resulting in denial of service (CVE-2019-6706)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Severity
145654	CentOS 8 : httpd:2.4 (CESA-2019:3436)	high
145653	CentOS 8 : GNOME (CESA-2019:3553)	high
145652	CentOS 8 : nghttp2 (CESA-2019:2692)	high
145651	CentOS 8 : kernel (CESA-2019:1479)	high
145650	CentOS 8 : java-1.8.0-openjdk (CESA-2019:1816)	medium
145649	CentOS 8 : python36:3.6 (CESA-2019:0984)	critical
145648	CentOS 8 : java-11-openjdk (CESA-2019:3135)	medium
145647	CentOS 8 : patch (CESA-2019:2798)	high
145646	CentOS 8 : go-toolset:rhel8 (CESA-2019:3433)	critical
145645	CentOS 8 : elfutils (CESA-2019:3575)	medium
145644	CentOS 8 : openwsman (CESA-2019:0972)	high
145643	CentOS 8 : lldpad (CESA-2019:3673)	medium
145642	CentOS 8 : container-tools:rhel8 (CESA-2019:0975)	high
145641	CentOS 8 : thunderbird (CESA-2019:3237)	high
145640	CentOS 8 : gvfs (CESA-2019:1517)	high
145639	CentOS 8 : numpy (CESA-2019:3704)	critical
145638	CentOS 8 : kernel (CESA-2019:2827)	high
145637	CentOS 8 : pki-deps:10.6 (CESA-2019:2720)	medium
145636	CentOS 8 : thunderbird (CESA-2019:4195)	high
145635	CentOS 8 : libreswan (CESA-2019:3391)	high
145634	CentOS 8 : systemd (CESA-2019:3592)	medium
145633	CentOS 8 : gdb (CESA-2019:3352)	high
145632	CentOS 8 : kernel (CESA-2019:3871)	high
145631	CentOS 8 : poppler (CESA-2019:2713)	critical
145630	CentOS 8 : thunderbird (CESA-2019:1308)	critical
145629	CentOS 8 : libjpeg-turbo (CESA-2019:3705)	medium
145628	CentOS 8 : osinfo-db and libosinfo (CESA-2019:3387)	high
145627	CentOS 8 : mod_auth_mellon (CESA-2019:0985)	high
145626	CentOS 8 : libyang (CESA-2019:4360)	critical
145625	CentOS 8 : firefox (CESA-2019:2663)	critical
145624	CentOS 8 : qt5-qtbase (CESA-2019:3390)	critical
145623	CentOS 8 : libarchive (CESA-2019:3698)	high
145622	CentOS 8 : nginx:1.14 (CESA-2019:2799)	high
145621	CentOS 8 : libvorbis (CESA-2019:3703)	high
145620	CentOS 8 : go-toolset:rhel8 (CESA-2019:1519)	medium
145619	CentOS 8 : libqb (CESA-2019:3610)	high
145618	CentOS 8 : python27:2.7 (CESA-2019:3335)	critical
145617	CentOS 8 : dovecot (CESA-2019:2822)	critical
145616	CentOS 8 : firefox (CESA-2019:1764)	critical
145615	CentOS 8 : sudo (CESA-2019:3694)	high
145614	CentOS 8 : dovecot (CESA-2019:3467)	medium
145613	CentOS 8 : ghostscript (CESA-2019:2591)	critical
145612	CentOS 8 : mysql:8.0 (CESA-2019:2511)	high
145611	CentOS 8 : .NET Core on Red Hat Enterprise Linux (CESA-2019:2731)	high
145610	CentOS 8 : virt:rhel (CESA-2019:1268)	high
145609	CentOS 8 : mariadb:10.3 (CESA-2019:3708)	medium
145608	CentOS 8 : gettext (CESA-2019:3643)	critical
145607	CentOS 8 : libtiff (CESA-2019:3419)	high
145606	CentOS 8 : sssd (CESA-2019:3651)	medium
145605	CentOS 8 : lua (CESA-2019:3706)	high

Detections

Analytics

CentOS Local Security Checks Family for Nessus

high

high

high

high

medium

critical

medium

high

critical

medium

high

medium

high

high

high

critical

high

medium

high

high

medium

high

high

critical

critical

medium

high

high

critical

critical

critical

high

high

high

medium

high

critical

critical

critical

high

medium

critical

high

high

high

medium

critical

high

medium

high