The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:3703 advisory.

  - libvorbis: heap buffer overflow in mapping0_forward function (CVE-2018-10392)

  - libvorbis: stack buffer overflow in bark_noise_hybridmp function (CVE-2018-10393)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:1519 advisory.

  - golang: CRLF injection in net/http (CVE-2019-9741)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3610 advisory.

  - libqb: Insecure treatment of IPC (temporary) files (CVE-2019-12779)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:3335 advisory.

  - python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading to possible attack on     internal service (CVE-2019-11236)

  - python-urllib3: Certification mishandle when error should be thrown (CVE-2019-11324)

  - numpy: crafted serialized object passed in numpy.load() in pickle python module allows arbitrary code     execution (CVE-2019-6446)

  - python: CRLF injection via the query part of the url passed to urlopen() (CVE-2019-9740)

  - python: CRLF injection via the path part of the url passed to urlopen() (CVE-2019-9947)

  - python: Undocumented local_file protocol allows remote attackers to bypass protection mechanisms     (CVE-2019-9948)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:2822 advisory.

  - dovecot: improper NULL byte handling in IMAP and ManageSieve protocol parsers leads to out of bounds     writes (CVE-2019-11500)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2019:1764 advisory.

  - Mozilla: Memory safety bugs fixed in Firefox 68 and Firefox ESR 60.8 (CVE-2019-11709)

  - Mozilla: Script injection within domain through inner window reuse (CVE-2019-11711)

  - Mozilla: Cross-origin POST requests can be made with NPAPI plugins by following 308 redirects     (CVE-2019-11712)

  - Mozilla: Use-after-free with HTTP/2 cached stream (CVE-2019-11713)

  - Mozilla: HTML parsing error can contribute to content XSS (CVE-2019-11715)

  - Mozilla: Caret character improperly escaped in origins (CVE-2019-11717)

  - Mozilla: Same-origin policy treats all files in a directory as having the same-origin (CVE-2019-11730)

  - Mozilla: Sandbox escape via installation of malicious language pack (CVE-2019-9811)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2019:3694 advisory.

  - sudo: Privilege escalation via 'Runas' specification with 'ALL' keyword (CVE-2019-14287)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3467 advisory.

  - dovecot: Improper certificate validation (CVE-2019-3814)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:2591 advisory.

  - ghostscript: Safer mode bypass by .forceput exposure in .pdf_hook_DSC_Creator (701445) (CVE-2019-14811)

  - ghostscript: Safer mode bypass by .forceput exposure in setuserparams (701444) (CVE-2019-14812)

  - ghostscript: Safer mode bypass by .forceput exposure in setsystemparams (701443) (CVE-2019-14813)

  - ghostscript: Safer mode bypass by .forceput exposure in .pdfexectoken and other procedures (701450)     (CVE-2019-14817)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:2511 advisory.

  - mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2019) (CVE-2019-2420, CVE-2019-2481,     CVE-2019-2507, CVE-2019-2529, CVE-2019-2530)

  - mysql: Server: Parser unspecified vulnerability (CPU Jan 2019) (CVE-2019-2434, CVE-2019-2455)

  - mysql: Server: Replication unspecified vulnerability (CPU Jan 2019) (CVE-2019-2436, CVE-2019-2531,     CVE-2019-2534)

  - mysql: Server: PS unspecified vulnerability (CPU Jan 2019) (CVE-2019-2482)

  - mysql: Server: Security: Privileges unspecified vulnerability (CPU Jan 2019) (CVE-2019-2486,     CVE-2019-2532, CVE-2019-2533)

  - mysql: Server: DDL unspecified vulnerability (CPU Jan 2019) (CVE-2019-2494, CVE-2019-2495, CVE-2019-2537)

  - mysql: InnoDB unspecified vulnerability (CPU Jan 2019) (CVE-2019-2502, CVE-2019-2510)

  - mysql: Server: Connection Handling unspecified vulnerability (CPU Jan 2019) (CVE-2019-2503)

  - mysql: Server: Partition unspecified vulnerability (CPU Jan 2019) (CVE-2019-2528)

  - mysql: Server: Options unspecified vulnerability (CPU Jan 2019) (CVE-2019-2535)

  - mysql: Server: Packaging unspecified vulnerability (CPU Jan 2019) (CVE-2019-2536)

  - mysql: Server: Connection unspecified vulnerability (CPU Jan 2019) (CVE-2019-2539)

  - mysql: InnoDB unspecified vulnerability (CPU Apr 2019) (CVE-2019-2580, CVE-2019-2585, CVE-2019-2593,     CVE-2019-2624, CVE-2019-2628)

  - mysql: Server: Optimizer unspecified vulnerability (CPU Apr 2019) (CVE-2019-2581, CVE-2019-2596,     CVE-2019-2607, CVE-2019-2625, CVE-2019-2681, CVE-2019-2685, CVE-2019-2686, CVE-2019-2687, CVE-2019-2688,     CVE-2019-2689, CVE-2019-2693, CVE-2019-2694, CVE-2019-2695)

  - mysql: Server: Security: Privileges unspecified vulnerability (CPU Apr 2019) (CVE-2019-2584,     CVE-2019-2589, CVE-2019-2606, CVE-2019-2620, CVE-2019-2627)

  - mysql: Server: Partition unspecified vulnerability (CPU Apr 2019) (CVE-2019-2587)

  - mysql: Server: PS unspecified vulnerability (CPU Apr 2019) (CVE-2019-2592)

  - mysql: Server: Replication unspecified vulnerability (CPU Apr 2019) (CVE-2019-2614, CVE-2019-2617,     CVE-2019-2630, CVE-2019-2634, CVE-2019-2635)

  - mysql: Server: Options unspecified vulnerability (CPU Apr 2019) (CVE-2019-2623, CVE-2019-2683)

  - mysql: Server: DDL unspecified vulnerability (CPU Apr 2019) (CVE-2019-2626, CVE-2019-2644)

  - mysql: Server: Information Schema unspecified vulnerability (CPU Apr 2019) (CVE-2019-2631)

  - mysql: Server: Group Replication Plugin unspecified vulnerability (CPU Apr 2019) (CVE-2019-2636)

  - mysql: Server: Security: Roles unspecified vulnerability (CPU Apr 2019) (CVE-2019-2691)

  - mysql: Server: Pluggable Auth unspecified vulnerability (CPU Jul 2019) (CVE-2019-2737)

  - mysql: Server: Compiling unspecified vulnerability (CPU Jul 2019) (CVE-2019-2738)

  - mysql: Server: Security: Privileges unspecified vulnerability (CPU Jul 2019) (CVE-2019-2739,     CVE-2019-2778, CVE-2019-2789, CVE-2019-2811)

  - mysql: Server: XML unspecified vulnerability (CPU Jul 2019) (CVE-2019-2740)

  - mysql: Server: Options unspecified vulnerability (CPU Jul 2019) (CVE-2019-2752)

  - mysql: Server: Replication unspecified vulnerability (CPU Jul 2019) (CVE-2019-2755, CVE-2019-2800)

  - mysql: Server: Optimizer unspecified vulnerability (CPU Jul 2019) (CVE-2019-2757, CVE-2019-2774,     CVE-2019-2796, CVE-2019-2802, CVE-2019-2803, CVE-2019-2808, CVE-2019-2810, CVE-2019-2812, CVE-2019-2815,     CVE-2019-2830, CVE-2019-2834)

  - mysql: InnoDB unspecified vulnerability (CPU Jul 2019) (CVE-2019-2758, CVE-2019-2785, CVE-2019-2798,     CVE-2019-2814, CVE-2019-2879)

  - mysql: Server: Components / Services unspecified vulnerability (CPU Jul 2019) (CVE-2019-2780)

  - mysql: Server: DML unspecified vulnerability (CPU Jul 2019) (CVE-2019-2784)

  - mysql: Server: Charsets unspecified vulnerability (CPU Jul 2019) (CVE-2019-2795)

  - mysql: Client programs unspecified vulnerability (CPU Jul 2019) (CVE-2019-2797)

  - mysql: Server: FTS unspecified vulnerability (CPU Jul 2019) (CVE-2019-2801)

  - mysql: Server: Parser unspecified vulnerability (CPU Jul 2019) (CVE-2019-2805)

  - mysql: Server: Security: Audit unspecified vulnerability (CPU Jul 2019) (CVE-2019-2819)

  - mysql: Server: Security: Roles unspecified vulnerability (CPU Jul 2019) (CVE-2019-2826)

  - mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2019) (CVE-2019-2948, CVE-2019-2950)

  - mysql: Client programs unspecified vulnerability (CPU Oct 2019) (CVE-2019-2969)

  - mysql: InnoDB unspecified vulnerability (CPU Oct 2019) (CVE-2019-3003)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:2731 advisory.

  - dotnet: System.Net.Sockets.dll Socket.ConnectAsync Denial of Service (CVE-2019-1301)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:1268 advisory.

  - libvirt: wrong permissions in systemd admin-sock due to missing SocketMode parameter (CVE-2019-10132)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:3708 advisory.

  - mysql: InnoDB unspecified vulnerability (CPU Jan 2019) (CVE-2019-2510)

  - mysql: Server: DDL unspecified vulnerability (CPU Jan 2019) (CVE-2019-2537)

  - mysql: Server: Replication unspecified vulnerability (CPU Apr 2019) (CVE-2019-2614)

  - mysql: Server: Security: Privileges unspecified vulnerability (CPU Apr 2019) (CVE-2019-2627)

  - mysql: InnoDB unspecified vulnerability (CPU Apr 2019) (CVE-2019-2628)

  - mysql: Server: Pluggable Auth unspecified vulnerability (CPU Jul 2019) (CVE-2019-2737)

  - mysql: Server: Security: Privileges unspecified vulnerability (CPU Jul 2019) (CVE-2019-2739)

  - mysql: Server: XML unspecified vulnerability (CPU Jul 2019) (CVE-2019-2740)

  - mysql: InnoDB unspecified vulnerability (CPU Jul 2019) (CVE-2019-2758)

  - mysql: Server: Parser unspecified vulnerability (CPU Jul 2019) (CVE-2019-2805)

  - mysql: C API unspecified vulnerability (CPU Apr 2020) (CVE-2020-2922)

  - mysql: C API unspecified vulnerability (CPU Jan 2021) (CVE-2021-2007)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3643 advisory.

  - gettext: double free in default_add_message in read-catalog.c (CVE-2018-18751)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3419 advisory.

  - libtiff: Heap-based buffer overflow in the cpSeparateBufToContigBuf function resulting in a denial of     service or possibly code execution (CVE-2018-12900)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3651 advisory.

  - sssd: improper implementation of GPOs due to too restrictive permissions (CVE-2018-16838)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3706 advisory.

  - lua: use-after-free in lua_upvaluejoin in lapi.c resulting in denial of service (CVE-2019-6706)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3951 advisory.

  - SDL: heap-based buffer overflow in SDL blit functions in video/SDL_blit*.c (CVE-2019-13616)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:3701 advisory.

  - curl: NTLM type-2 heap out-of-bounds buffer read (CVE-2018-16890)

  - wget: Information exposure in set_file_metadata function in xattr.c (CVE-2018-20483)

  - curl: NTLMv2 type-3 header stack buffer overflow (CVE-2019-3822)

  - curl: SMTP end-of-response out-of-bounds read (CVE-2019-3823)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:2004 advisory.

  - icedtea-web: unsigned code injection in a signed JAR file (CVE-2019-10181)

  - icedtea-web: path traversal while processing  elements of JNLP files results in arbitrary file     overwrite (CVE-2019-10182)

  - icedtea-web: directory traversal in the nested jar auto-extraction leading to arbitrary file overwrite     (CVE-2019-10185)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2019:1527 advisory.

  - WALinuxAgent: swapfile created with weak permissions (CVE-2019-0804)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3699 advisory.

  - evolution-ews: all certificate errors ignored if error is ignored during initial account setup in gnome-     online-accounts (CVE-2019-3890)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:0980 advisory.

  - httpd: privilege escalation from modules scripts (CVE-2019-0211)

  - httpd: mod_ssl: access control bypass when using per-location client certification authentication     (CVE-2019-0215)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:1167 advisory.

  - hardware: Microarchitectural Store Buffer Data Sampling (MSBDS) (CVE-2018-12126)

  - hardware: Micro-architectural Load Port Data Sampling - Information Leak (MLPDS) (CVE-2018-12127)

  - hardware: Microarchitectural Fill Buffer Data Sampling (MFBDS) (CVE-2018-12130)

  - hardware: Microarchitectural Data Sampling Uncacheable Memory (MDSUM) (CVE-2019-11091)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:3403 advisory.

  - containers/image: not enforcing TLS when sending username+password credentials to token servers leading to     credential disclosure (CVE-2019-10214)

  - QEMU: slirp: heap buffer overflow during packet reassembly (CVE-2019-14378)

  - kubernetes: Incorrect rule injection in CNI portmap plugin (CVE-2019-9946)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:1259 advisory.

  - dotnet: NuGet Tampering Vulnerability (CVE-2019-0757)

  - dotnet: timeouts for regular expressions are not enforced (CVE-2019-0820)

  - dotnet: infinite loop in Uri.TryCreate leading to ASP.Net Core Denial of Service (CVE-2019-0980)

  - dotnet: crash in IPAddress.TryCreate leading to ASP.Net Core Denial of Service (CVE-2019-0981)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2019:0966 advisory.

  - Mozilla: Proxy Auto-Configuration file can define localhost access to be proxied (CVE-2018-18506)

  - Mozilla: Memory safety bugs fixed in Firefox 66 and Firefox ESR 60.6 (CVE-2019-9788)

  - Mozilla: Use-after-free when removing in-use DOM elements (CVE-2019-9790)

  - Mozilla: Type inference is incorrect for constructors entered through on-stack replacement with IonMonkey     (CVE-2019-9791)

  - Mozilla: IonMonkey leaks JS_OPTIMIZED_OUT magic value to script (CVE-2019-9792)

  - Mozilla: Improper bounds checks when Spectre mitigations are disabled (CVE-2019-9793)

  - Mozilla: Type-confusion in IonMonkey JIT compiler (CVE-2019-9795)

  - Mozilla: Use-after-free with SMIL animation controller (CVE-2019-9796)

  - Mozilla: IonMonkey MArraySlice has incorrect alias information (CVE-2019-9810)

  - Mozilla: Ionmonkey type confusion with __proto__ mutations (CVE-2019-9813)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2019:3497 advisory.

  - nodejs: Denial of Service with large HTTP headers (CVE-2018-12121)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:3494 advisory.

  - containers/image: not enforcing TLS when sending username+password credentials to token servers leading to     credential disclosure (CVE-2019-10214)

  - QEMU: slirp: heap buffer overflow during packet reassembly (CVE-2019-14378)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:0981 advisory.

  - python-sqlalchemy: SQL Injection when the order_by parameter can be controlled (CVE-2019-7164)

  - python-sqlalchemy: SQL Injection when the group_by parameter can be controlled (CVE-2019-7548)

  - python: Information Disclosure due to urlsplit improper NFKC normalization (CVE-2019-9636)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2019:1152 advisory.

  - python-jinja2: str.format_map allows sandbox escape (CVE-2019-10906)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:3583 advisory.

  - libsolv: illegal address access in pool_whatprovides in src/pool.h (CVE-2018-20534)

  - libcomps: use after free when merging two objmrtrees (CVE-2019-3817)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:2925 advisory.

  - nodejs: Insufficient Slowloris fix causing DoS via server.headersTimeout bypass (CVE-2019-5737)

  - HTTP/2: large amount of data requests leads to denial of service (CVE-2019-9511)

  - HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512)

  - HTTP/2: flood using PRIORITY frames results in excessive resource consumption (CVE-2019-9513)

  - HTTP/2: flood using HEADERS frames results in unbounded memory growth (CVE-2019-9514)

  - HTTP/2: flood using SETTINGS frames results in unbounded memory growth (CVE-2019-9515)

  - HTTP/2: 0-length headers lead to denial of service (CVE-2019-9516)

  - HTTP/2: request for large response leads to denial of service (CVE-2019-9517)

  - HTTP/2: flood using empty frames results in excessive resource consumption (CVE-2019-9518)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:1771 advisory.

  - cyrus-imapd: buffer overflow in CalDAV request handling triggered by a long iCalendar property name     (CVE-2019-11356)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:3338 advisory.

  - edk2: Stack buffer overflow with corrupted BMP (CVE-2018-12181)

  - edk2: Buffer overflows in PartitionDxe and UdfDxe with long file names and invalid UDF media     (CVE-2019-0160)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:2582 advisory.

  - pango: pango_log2vis_get_embedding_levels() heap-based buffer overflow (CVE-2019-1010238)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2019:4111 advisory.

  - Mozilla: Buffer overflow in plain text serializer (CVE-2019-17005)

  - Mozilla: Use-after-free in worker destruction (CVE-2019-17008)

  - Mozilla: Use-after-free when performing device orientation checks (CVE-2019-17010)

  - Mozilla: Use-after-free when retrieving a document in antitracking (CVE-2019-17011)

  - Mozilla: Memory safety bugs fixed in Firefox 71 and Firefox ESR 68.3 (CVE-2019-17012)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:4361 advisory.

  - fribidi: buffer overflow in fribidi_get_par_embedding_levels_ex() in lib/fribidi-bidi.c leading to denial     of service and possible code execution (CVE-2019-18397)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:1142 advisory.

  - freeradius: eap-pwd: fake authentication using reflection (CVE-2019-11234)

  - freeradius: eap-pwd: authentication bypass via an invalid curve attack (CVE-2019-11235)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:4273 advisory.

  - HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512)

  - HTTP/2: flood using HEADERS frames results in unbounded memory growth (CVE-2019-9514)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:2593 advisory.

  - squid: heap-based buffer overflow in HttpHeader::getAuth (CVE-2019-12527)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2019:3590 advisory.

  - python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading to possible attack on     internal service (CVE-2019-11236)

  - python-urllib3: Certification mishandle when error should be thrown (CVE-2019-11324)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3421 advisory.

  - mod_auth_mellon: open redirect in logout url when using URLs with backslashes (CVE-2019-3877)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:3702 advisory.

  - openssh: scp client improper directory name validation (CVE-2018-20685)

  - openssh: Missing character encoding in progress display allows for spoofing of scp client output     (CVE-2019-6109)

  - openssh: Improper validation of object names allows malicious server to overwrite files via scp client     (CVE-2019-6111)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:4356 advisory.

  - git: Arbitrary path overwriting via export-marks in-stream command feature (CVE-2019-1348)

  - git: Recursive submodule cloning allows using git directory twice with synonymous directory name written     in .git/ (CVE-2019-1349)

  - git: Files inside the .git directory may be overwritten during cloning via NTFS Alternate Data Streams     (CVE-2019-1352)

  - git: Remote code execution in recursive clones with nested submodules (CVE-2019-1387)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:3345 advisory.

  - QEMU: qxl: null pointer dereference while releasing spice resources (CVE-2019-12155)

  - ntfs-3g: heap-based buffer overflow leads to local root privilege escalation (CVE-2019-9755)

  - QEMU: slirp: information leakage in tcp_emu() due to uninitialized stack variables (CVE-2019-9824)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2019:1623 advisory.

  - libical: Heap buffer over read in icalparser.c parser_get_next_char (CVE-2019-11703)

  - libical: Heap buffer overflow in icalmemory_strdup_and_dequote function in icalvalue.c (CVE-2019-11704)

  - libical: Stack buffer overflow in icalrecur_add_bydayrules in icalrecur.c (CVE-2019-11705)

  - libical: Type confusion in icaltimezone_get_vtimezone_properties function in icalproperty.c     (CVE-2019-11706)

  - Mozilla: Type confusion in Array.pop (CVE-2019-11707)

  - Mozilla: Sandbox escape using Prompt:Open (CVE-2019-11708)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3707 advisory.

  - dbus: DBusServer DBUS_COOKIE_SHA1 authentication bypass (CVE-2019-12749)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:1143 advisory.

  - flatpak: Sandbox bypass via IOCSTI (incomplete fix for CVE-2017-5226) (CVE-2019-10063)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2019:3196 advisory.

  - Mozilla: Use-after-free when creating index updates in IndexedDB (CVE-2019-11757)

  - Mozilla: Potentially exploitable crash due to 360 Total Security (CVE-2019-11758)

  - Mozilla: Stack buffer overflow in HKDF output (CVE-2019-11759)

  - Mozilla: Stack buffer overflow in WebRTC networking (CVE-2019-11760)

  - Mozilla: Unintended access to a privileged JSONView object (CVE-2019-11761)

  - Mozilla: document.domain-based origin isolation has same-origin-property violation (CVE-2019-11762)

  - Mozilla: Incorrect HTML parsing results in XSS bypass technique (CVE-2019-11763)

  - Mozilla: Memory safety bugs fixed in Firefox 70 and Firefox ESR 68.2 (CVE-2019-11764)

  - expat: heap-based buffer over-read via crafted XML input (CVE-2019-15903)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Severity
145621	CentOS 8 : libvorbis (CESA-2019:3703)	high
145620	CentOS 8 : go-toolset:rhel8 (CESA-2019:1519)	medium
145619	CentOS 8 : libqb (CESA-2019:3610)	high
145618	CentOS 8 : python27:2.7 (CESA-2019:3335)	critical
145617	CentOS 8 : dovecot (CESA-2019:2822)	critical
145616	CentOS 8 : firefox (CESA-2019:1764)	critical
145615	CentOS 8 : sudo (CESA-2019:3694)	high
145614	CentOS 8 : dovecot (CESA-2019:3467)	medium
145613	CentOS 8 : ghostscript (CESA-2019:2591)	critical
145612	CentOS 8 : mysql:8.0 (CESA-2019:2511)	high
145611	CentOS 8 : .NET Core on Red Hat Enterprise Linux (CESA-2019:2731)	high
145610	CentOS 8 : virt:rhel (CESA-2019:1268)	high
145609	CentOS 8 : mariadb:10.3 (CESA-2019:3708)	medium
145608	CentOS 8 : gettext (CESA-2019:3643)	critical
145607	CentOS 8 : libtiff (CESA-2019:3419)	high
145606	CentOS 8 : sssd (CESA-2019:3651)	medium
145605	CentOS 8 : lua (CESA-2019:3706)	high
145604	CentOS 8 : SDL (CESA-2019:3951)	high
145603	CentOS 8 : curl (CESA-2019:3701)	critical
145602	CentOS 8 : icedtea-web (CESA-2019:2004)	high
145601	CentOS 8 : WALinuxAgent (CESA-2019:1527)	medium
145600	CentOS 8 : evolution (CESA-2019:3699)	high
145599	CentOS 8 : httpd:2.4 (CESA-2019:0980)	high
145598	CentOS 8 : kernel (CESA-2019:1167)	medium
145597	CentOS 8 : container-tools:rhel8 (CESA-2019:3403)	high
145596	CentOS 8 : dotnet (CESA-2019:1259)	medium
145595	CentOS 8 : firefox (CESA-2019:0966)	critical
145594	CentOS 8 : http-parser (CESA-2019:3497)	high
145593	CentOS 8 : container-tools:1.0 (CESA-2019:3494)	high
145592	CentOS 8 : python27:2.7 (CESA-2019:0981)	critical
145591	CentOS 8 : python-jinja2 (CESA-2019:1152)	high
145590	CentOS 8 : yum (CESA-2019:3583)	high
145589	CentOS 8 : nodejs:10 (CESA-2019:2925)	high
145588	CentOS 8 : cyrus-imapd (CESA-2019:1771)	critical
145587	CentOS 8 : edk2 (CESA-2019:3338)	critical
145586	CentOS 8 : pango (CESA-2019:2582)	critical
145585	CentOS 8 : firefox (CESA-2019:4111)	high
145584	CentOS 8 : fribidi (CESA-2019:4361)	high
145583	CentOS 8 : freeradius:3.0 (CESA-2019:1142)	critical
145582	CentOS 8 : container-tools:1.0 (CESA-2019:4273)	high
145581	CentOS 8 : squid:4 (CESA-2019:2593)	high
145580	CentOS 8 : python-urllib3 (CESA-2019:3590)	high
145579	CentOS 8 : mod_auth_mellon (CESA-2019:3421)	medium
145578	CentOS 8 : openssh (CESA-2019:3702)	medium
145577	CentOS 8 : git (CESA-2019:4356)	high
145576	CentOS 8 : virt:rhel (CESA-2019:3345)	high
145575	CentOS 8 : thunderbird (CESA-2019:1623)	critical
145574	CentOS 8 : dbus (CESA-2019:3707)	high
145573	CentOS 8 : flatpak (CESA-2019:1143)	critical
145572	CentOS 8 : firefox (CESA-2019:3196)	high

Detections

Analytics

CentOS Local Security Checks Family for Nessus

high

medium

high

critical

critical

critical

high

medium

critical

high

high

high

medium

critical

high

medium

high

high

critical

high

medium

high

high

medium

high

medium

critical

high

high

critical

high

high

high

critical

critical

critical

high

high

critical

high

high

high

medium

medium

high

high

critical

high

critical

high