The version of WebLogic Server installed on the remote host is affected by multiple vulnerabilities as referenced in the January 2021 CPU advisory.

  - An unspecified vulnerability exists in the Core component. An unauthenticated, remote attacker with     network access via IIOP, T3 can exploit this issue to compromise the server. Successful attacks of this     vulnerability can result in takeover of Oracle WebLogic Server. (CVE-2021-2108)

  - An unspecified vulnerability exists in the Console component. An authenticated, remote attacker with     network access via HTTP can exploit this issue to compromise the server. Successful attacks of this     vulnerability can result in takeover of Oracle WebLogic Server. (CVE-2021-2109)

  - An unspecified vulnerability exists in the Samples component. An unauthenticated, remote attacker with     network access via IIOP, T3 can exploit this issue to compromise the server. Successful attacks of this     vulnerability can result in takeover of Oracle WebLogic Server. (CVE-2021-2075)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2023-0808 advisory.

  - The go command may execute arbitrary code at build time when using cgo. This may occur when running go     get on a malicious module, or when running any other command which builds untrusted code. This is can by     triggered by linker flags, specified via a #cgo LDFLAGS directive. Flags containing embedded spaces are     mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in     the argument of another flag. This only affects usage of the gccgo compiler. (CVE-2023-29405)

  - When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by     finalizing the operation with a rename from a temporary name to the final target file name.In that rename     operation, it might accidentally *widen* the permissions for the target file, leaving the updated file     accessible to more users than intended. (CVE-2022-32207)

  - decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS. (CVE-2022-38900)

  - The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.
    (CVE-2022-33987)

  - Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the     name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3. (CVE-2022-37601)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security fix for CVE-2018-10237

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2423 advisory.

    Red Hat JBoss Enterprise Application Platform is a platform for Java     applications based on the JBoss Application Server.

    This release of Red Hat JBoss Enterprise Application Platform 7.1.4 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.1.3, and includes bug fixes and enhancements, which are documented     in the Release Notes document linked to in the References.

    Security Fix(es):

    * guava: Unbounded memory allocation in AtomicDoubleArray and CompoundOrdering classes allow remote     attackers to cause a denial of service (CVE-2018-10237)

    * bouncycastle: flaw in the low-level interface to RSA key pair generator (CVE-2018-1000180)

    * cxf: Improper size validation in message attachment header for JAX-WS and JAX-RS services     (CVE-2017-12624)

    * wildfly: wildfly-core: Path traversal can allow the extraction of .war archives to write arbitrary files     (CVE-2018-10862)

    * cxf-core: apache-cxf: TLS hostname verification does not work correctly with com.sun.net.ssl.*     (CVE-2018-8039)

    For more details about the security issue(s), including the impact, a CVSS     score, and other related information, refer to the CVE page(s) listed in the     References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2741 advisory.

    Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss     Application Server.

    This release of Red Hat JBoss Enterprise Application Platform 6.4.21 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 6.4.20, and includes bug fixes and enhancements, which are     documented in the Release Notes document linked to in the References.

    Security Fix(es):

    * hibernate-validator: Privilege escalation when running under the security manager (CVE-2017-7536)

    * guava: Unbounded memory allocation in AtomicDoubleArray and CompoundOrdering classes allow remote     attackers to cause a denial of service (CVE-2018-10237)

    * picketlink: The fix for CVE-2017-2582 breaks the feature of attribute replacement with system property     in picketlink.xml (CVE-2017-2582)

    * jbossweb: tomcat: A bug in the UTF-8 decoder can lead to DoS (CVE-2018-1336)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    The CVE-2017-2582 issue was discovered by Hynek Mlnarik (Red Hat) and the CVE-2017-7536 issue was     discovered by Gunnar Morling (Red Hat).

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2018:2598 advisory.

    OpenDaylight (ODL) is a modular open platform for customizing and automating networks of any size and     scale. The OpenDaylight Project arose out of the SDN movement, with a clear focus on network     programmability.

    Security Fix(es):

    * guava: Unbounded memory allocation in AtomicDoubleArray and CompoundOrdering classes allow remote     attackers to cause a denial of service (CVE-2018-10237)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Previously, when there are no DPNs associated with the controller, an Invalid dpnId, for example, zero,     was selected as the NAPT Switch. Since the dpnId was zero, necessary flows for supporting external     connectivity for VMs were missing in the pipeline. So VMs were unable to connect to internet.
    Now, the Invalid dpnId is not chosen as an NAPT Switch and as soon as a new DPN is associated with the     OpenDaylight controller, it will schedule the NAPT Switches for all the routers, that did not have the     NAPT switch scheduled.
    As a result, VMs are now able to reach internet. (BZ#1597304)

    * Some flows were missing from the ARP table and the flow programming generated an error due to a missing     group. As a result, L2 failed and affected most of the traffic.
    The flow programming now waits for the group to be added. The group is always present and L2 traffic     succeeds. (BZ#1598399)

    * In OVS2.9, conntrack adds extra headers that the OpenFlow plugin cannot parse. As a result, traffic from     the VM to a PNF on external network failed.
    The extra headers are now explicit cleared. Traffic to PNF on external network does not fail. (BZ#1600608)

    * Some flows were missing from the SNAT table and the flow programming generated an error due to a missing     group. As a result, SNAT traffic from compute, where the flow is missing,  failed and affected most of the     traffic.
    As a result, the flow programming now waits for the group to be added.  The group is always present and     SNAT works. (BZ#1602404)

    * Previously, the transaction did not close in netvirt.vpnmanager.VpnOpStatusListener. This resulted in     memory leaks at scale and/or in longevity. This issue has been resolved and now OpenDaylight requires less     memory to run. (BZ#1607965)

    * Previously, the transaction did not close in netvirt.fibmanager.VrfEntryListener. This resulted in     memory leaks at scale and/or in longevity. This issue has been resolved and OpenDaylight now requires less     memory to run. (BZ#1585227)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2742 advisory.

    Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss     Application Server.

    This release of Red Hat JBoss Enterprise Application Platform 6.4.21 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 6.4.20, and includes bug fixes and enhancements, which are     documented in the Release Notes document linked to in the References.

    Security Fix(es):

    * hibernate-validator: Privilege escalation when running under the security manager (CVE-2017-7536)

    * guava: Unbounded memory allocation in AtomicDoubleArray and CompoundOrdering classes allow remote     attackers to cause a denial of service (CVE-2018-10237)

    * picketlink: The fix for CVE-2017-2582 breaks the feature of attribute replacement with system property     in picketlink.xml (CVE-2017-2582)

    * jbossweb: tomcat: A bug in the UTF-8 decoder can lead to DoS (CVE-2018-1336)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    The CVE-2017-2582 issue was discovered by Hynek Mlnarik (Red Hat) and the CVE-2017-7536 issue was     discovered by Gunnar Morling (Red Hat).

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
145264	Oracle WebLogic Server Multiple Vulnerabilities (Jan 2021 CPU)	Nessus	Misc.	2021/1/22	2024/11/29	critical
194928	Splunk Enterprise 8.2.0 < 8.2.12, 9.0.0 < 9.0.6, 9.1.0 < 9.1.1 (SVD-2023-0808)	Nessus	CGI abuses	2024/5/2	2024/7/29	critical
109804	Fedora 26 : guava (2018-db8f322bb0)	Nessus	Fedora Local Security Checks	2018/5/15	2024/10/8	medium
109927	Fedora 27 : guava (2018-e4c2507720)	Nessus	Fedora Local Security Checks	2018/5/21	2024/10/4	medium
112029	RHEL 6 : Red Hat JBoss Enterprise Application Platform 7.1.4 on RHEL 6 (RHSA-2018:2423)	Nessus	Red Hat Local Security Checks	2018/8/21	2025/4/29	high
117771	RHEL 7 : Red Hat JBoss Enterprise Application Platform 6.4.21 (RHSA-2018:2741)	Nessus	Red Hat Local Security Checks	2018/9/27	2025/4/29	high
194116	RHEL 7 : opendaylight (RHSA-2018:2598)	Nessus	Red Hat Local Security Checks	2024/4/27	2025/4/29	medium
194122	RHEL 5 : Red Hat JBoss Enterprise Application Platform 6.4.21 (RHSA-2018:2742)	Nessus	Red Hat Local Security Checks	2024/4/27	2025/3/20	high
120431	Fedora 28 : guava (2018-54a5bcc7e4)	Nessus	Fedora Local Security Checks	2019/1/3	2024/7/5	medium
120756	Fedora 28 : guava20 (2018-bf292e6cdf)	Nessus	Fedora Local Security Checks	2019/1/3	2024/7/1	medium

检测

插件搜索

critical

critical

medium

medium

high

high

medium

high

medium

medium