The version of Oracle Enterprise Manager Cloud Control installed on the remote host is affected by multiple vulnerabilities in Enterprise Manager Base Platform component:

  - An unspecified vulnerability in the subcomponent Networking     (jQuery) of Enterprise Manager Ops Center. Supported versions     that are affected are 12.2.2 and 12.3.3. An easy to exploit     vulnerability could allow an unauthenticated attacker with     network access via HTTP to compromise Enterprise Manager Ops     Center. A successful attacks requires human interaction and     can result in unauthorized update, insert or delete access     to some of Enterprise Manager Ops Center accessible data.
    (CVE-2015-9251)

  - An unspecified vulnerability in the subcomponent Networking     (OpenSSL) of the Enterprise Manager Ops Center. Supported     versions that are affected are 12.2.2 and 12.3.3. An easy     to exploit vulnerability could allow an unauthenticated     attacker with network access via HTTPS to compromise     Enterprise Manager Ops Center. A successful attack of this     vulnerability could result in unauthorized ability to cause     a hang or frequently repeatable crash (complete DOS) of     Enterprise Manager Ops Center. (CVE-2018-0732)

  - An unspecified vulnerability in the subcomponent Networking     (cURL) of Enterprise Manager Ops Center. Supported versions     that are affected are 12.2.2 and 12.3.3. Difficult to exploit     vulnerability allows unauthenticated attacker with network     access via HTTP to compromise Enterprise Manager Ops Center.
    A successful attack requires human interaction from a person     other than the attacker and can result in takeover of     Enterprise Manager Ops Center. (CVE-2018-1000300)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3558 advisory.

    The Apache HTTP Server is a powerful, efficient, and extensible web server. The httpd24 packages provide a     recent stable release of version 2.4 of the Apache HTTP Server, along with the mod_auth_kerb module.

    The following packages have been upgraded to a later upstream version: httpd24-httpd (2.4.34),     httpd24-curl (7.61.1). (BZ#1590833, BZ#1648928)

    Security Fix(es):

    * httpd: Improper handling of headers in mod_session can allow a remote user to modify session data for     CGI applications (CVE-2018-1283)

    * httpd: Out of bounds read in mod_cache_socache can allow a remote attacker to cause DoS (CVE-2018-1303)

    * httpd: mod_http2: Too much time allocated to workers, possibly leading to DoS (CVE-2018-1333)

    * httpd: DoS for HTTP/2 connections by continuous SETTINGS frames (CVE-2018-11763)

    * httpd: Out of bounds write in mod_authnz_ldap when using too small Accept-Language values     (CVE-2017-15710)

    * httpd: <FilesMatch> bypass with a trailing newline in the file name (CVE-2017-15715)

    * httpd: Out of bounds access after failure in reading the HTTP request (CVE-2018-1301)

    * httpd: Weak Digest auth nonce generation in mod_auth_digest (CVE-2018-1312)

    * curl: Multiple security issues were fixed in httpd24-curl (CVE-2016-5419, CVE-2016-5420, CVE-2016-5421,     CVE-2016-7141, CVE-2016-7167, CVE-2016-8615, CVE-2016-8616, CVE-2016-8617, CVE-2016-8618, CVE-2016-8619,     CVE-2016-8620, CVE-2016-8621, CVE-2016-8622, CVE-2016-8623, CVE-2016-8624, CVE-2016-8625, CVE-2016-9586,     CVE-2017-1000100, CVE-2017-1000101, CVE-2017-1000254, CVE-2017-1000257, CVE-2017-7407, CVE-2017-8816,     CVE-2017-8817, CVE-2018-1000007, CVE-2018-1000120, CVE-2018-1000121, CVE-2018-1000122, CVE-2018-1000301,     CVE-2018-14618)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank the Curl project for reporting CVE-2017-8816, CVE-2017-8817, CVE-2017-1000254,     CVE-2017-1000257, CVE-2018-1000007, CVE-2018-1000120, CVE-2018-1000122, CVE-2018-1000301, CVE-2016-9586,     CVE-2017-1000100, CVE-2017-1000101, CVE-2018-14618, and CVE-2018-1000121. Upstream acknowledges Alex     Nichols as the original reporter of CVE-2017-8816; the OSS-Fuzz project as the original reporter of     CVE-2017-8817 and CVE-2018-1000301; Max Dymond as the original reporter of CVE-2017-1000254 and     CVE-2018-1000122; Brian Carpenter and the OSS-Fuzz project as the original reporters of CVE-2017-1000257;
    Craig de Stigter as the original reporter of CVE-2018-1000007; Duy Phan Thanh as the original reporter of     CVE-2018-1000120; Even Rouault as the original reporter of CVE-2017-1000100; Brian Carpenter as the     original reporter of CVE-2017-1000101; Zhaoyang Wu as the original reporter of CVE-2018-14618; and Dario     Weisser as the original reporter of CVE-2018-1000121.

    Bug Fix(es):

    * Previously, the Apache HTTP Server from the httpd24 Software Collection was unable to handle situations     when static content was repeatedly requested in a browser by refreshing the page. As a consequence, HTTP/2     connections timed out and httpd became unresponsive. This bug has been fixed, and HTTP/2 connections now     work as expected in the described scenario. (BZ#1518737)

    Enhancement(s):

    * This update adds the mod_md module to the httpd24 Software Collection. This module enables managing     domains across virtual hosts and certificate provisioning using the Automatic Certificate Management     Environment (ACME) protocol. The mod_md module is available only for Red Hat Enterprise Linux 7.
    (BZ#1640722)

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Software Collections 3.2 Release     Notes linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2019-3739:01 advisory.

    * httpd: Improper handling of headers in mod_session can allow a remote user to modify session data for     CGI applications (CVE-2018-1283)
    * httpd: Out of bounds read in mod_cache_socache can allow a remote attacker to cause DoS (CVE-2018-1303)
    * httpd: mod_http2: Too much time allocated to workers, possibly leading to DoS (CVE-2018-1333)
    * httpd: DoS for HTTP/2 connections by continuous SETTINGS frames (CVE-2018-11763)
    * httpd: Out of bounds write in mod_authnz_ldap when using too small Accept-Language values     (CVE-2017-15710)
    * httpd:  bypass with a trailing newline in the file name (CVE-2017-15715)
    * httpd: Out of bounds access after failure in reading the HTTP request (CVE-2018-1301)
    * httpd: Weak Digest auth nonce generation in mod_auth_digest (CVE-2018-1312)
    * curl: Multiple security issues were fixed in httpd24-curl (CVE-2016-5419, CVE-2016-5420, CVE-2016-5421,     CVE-2016-7141, CVE-2016-7167, CVE-2016-8615, CVE-2016-8616, CVE-2016-8617, CVE-2016-8618, CVE-2016-8619,     CVE-2016-8620, CVE-2016-8621, CVE-2016-8622, CVE-2016-8623, CVE-2016-8624, CVE-2016-8625, CVE-2016-9586,     CVE-2017-1000100, CVE-2017-1000101, CVE-2017-1000254, CVE-2017-1000257, CVE-2017-7407, CVE-2017-8816,     CVE-2017-8817, CVE-2018-1000007, CVE-2018-1000120, CVE-2018-1000121, CVE-2018-1000122, CVE-2018-1000301,     CVE-2018-14618)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that there was an issue in the curl a command-line tool for downloading (eg.) data over HTTP.

curl could have be tricked into reading data beyond the end of a heap based buffer used to store downloaded content.

For more information, please see upstream's advisory at :

https://curl.haxx.se/docs/adv_2018-b138.html

For Debian 7 'Wheezy', this issue has been fixed in curl version 7.26.0-1+wheezy25+deb7u1.

We recommend that you upgrade your curl packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for curl fixes several issues :

Security issues fixed :

  - CVE-2018-1000301: Fixed a RTSP bad headers buffer     over-read could crash the curl client (bsc#1092098)

Non security issues fixed :

  - If the DEFAULT_SUSE cipher list is not available use the     HIGH cipher alias before failing. (bsc#1086825)

This update was imported from the SUSE:SLE-12:Update update project.

The version of Oracle Secure Global Desktop installed on the remote host is 5.3 / 5.4 and is missing a security patch from the July 2018 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilities:

 - curl version curl 7.54.1 to and including curl 7.59.0 contains a  Heap-based Buffer Overflow vulnerability in FTP connection closing  down functionality which can lead to DoS and RCE conditions. This  vulnerability appears to have been fixed in curl < 7.54.1 and  curl >= 7.60.0. (CVE-2018-1000300)

 - Security constraints defined by annotations of Servlets in Apache  Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and  7.0.0 to 7.0.84 were only applied once a Servlet had been loaded.  It was possible - depending on the order Servlets were loaded - for  some security constraints not to be applied. This could have exposed  resources to unauthorized users. (CVE-2018-1305)

 - ASN.1 types with a recursive definition could exceed the stack  given malicious input with excessive recursion. This could result  in a Denial Of Service attack. Fixed in OpenSSL 1.1.0h (Affected  1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n).
 (CVE-2018-0739)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3157 advisory.

    The curl packages provide the libcurl library and the curl utility for downloading files from servers     using various protocols, including HTTP, FTP, and LDAP.

    The nss-pem package provides the PEM file reader for Network Security Services (NSS) implemented as a     PKCS#11 module.

    Security Fix(es):

    * curl: HTTP authentication leak in redirects (CVE-2018-1000007)

    * curl: FTP path trickery leads to NIL byte out of bounds write (CVE-2018-1000120)

    * curl: RTSP RTP buffer over-read (CVE-2018-1000122)

    * curl: Out-of-bounds heap read when missing RTSP headers allows information leak of denial of service     (CVE-2018-1000301)

    * curl: LDAP NULL pointer dereference (CVE-2018-1000121)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank the Curl project for reporting these issues. Upstream acknowledges Craig de     Stigter as the original reporter of CVE-2018-1000007; Duy Phan Thanh as the original reporter of     CVE-2018-1000120; Max Dymond as the original reporter of CVE-2018-1000122; the OSS-fuzz project as the     original reporter of CVE-2018-1000301; and Dario Weisser as the original reporter of CVE-2018-1000121.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle HTTP Server installed on the remote host is affected by vulnerabilities as noted in the October 2018 CPU advisory:

  - A vulnerability exists in the Oracle HTTP Server component     of Oracle Fusion Middleware (subcomponent: Web Listener     (curl)). The affected version is 12.2.1.3. This is a     difficult to exploit vulnerability that allows an     unauthenticated attacker with network access via HTTP to     compromise Oracle HTTP Server. A successful attacks     requires human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in takeover of Oracle HTTP Server. (CVE-2018-1000300)     
  - A denial of service (DoS) vulnerability exists in curl due     to Buffer Over-read. Affected versions are from curl version     7.20.0 to curl 7.59.0. The vulnerable component can be     tricked into reading data beyond the end of the heap.
    An unauthenticated attacked with network access can exploit     this issue to cause the application to stop responding.
    (CVE-2018-1000301)

  - A buffer over-read vulnerability exists in curl that could lead to     information leakage. Affected versions are from  7.20.0 to     curl 7.58.0. A vulnerability in the RTSP+RTP handling code     could allows an attacker to cause a denial of service or     information leakage. An unauthenticated attacked with     network access can exploit this vulnerability to cause     a denial of service (DoS) or to leak information     from the vulnerable application.
    (CVE-2018-1000122)

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2019-3745:01 advisory.

    * httpd: Improper handling of headers in mod_session can allow a remote user to modify session data for     CGI applications (CVE-2018-1283)
    * httpd: Out of bounds read in mod_cache_socache can allow a remote attacker to cause DoS (CVE-2018-1303)
    * httpd: mod_http2: Too much time allocated to workers, possibly leading to DoS (CVE-2018-1333)
    * httpd: DoS for HTTP/2 connections by continuous SETTINGS frames (CVE-2018-11763)
    * httpd: Out of bounds write in mod_authnz_ldap when using too small Accept-Language values     (CVE-2017-15710)
    * httpd:  bypass with a trailing newline in the file name (CVE-2017-15715)
    * httpd: Out of bounds access after failure in reading the HTTP request (CVE-2018-1301)
    * httpd: Weak Digest auth nonce generation in mod_auth_digest (CVE-2018-1312)
    * curl: Multiple security issues were fixed in httpd24-curl (CVE-2016-5419, CVE-2016-5420, CVE-2016-5421,     CVE-2016-7141, CVE-2016-7167, CVE-2016-8615, CVE-2016-8616, CVE-2016-8617, CVE-2016-8618, CVE-2016-8619,     CVE-2016-8620, CVE-2016-8621, CVE-2016-8622, CVE-2016-8623, CVE-2016-8624, CVE-2016-8625, CVE-2016-9586,     CVE-2017-1000100, CVE-2017-1000101, CVE-2017-1000254, CVE-2017-1000257, CVE-2017-7407, CVE-2017-8816,     CVE-2017-8817, CVE-2018-1000007, CVE-2018-1000120, CVE-2018-1000121, CVE-2018-1000122, CVE-2018-1000301,     CVE-2018-14618)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
131184	Oracle Enterprise Manager Ops Center (Jan 2019 CPU)	Nessus	Misc.	2019/11/21	2024/11/4	critical
194113	RHEL 6 / 7 : httpd24 (RHSA-2018:3558)	Nessus	Red Hat Local Security Checks	2024/4/27	2025/3/16	critical
289086	MiracleLinux 7 : httpd24-nghttp2-1.7.1-7.el7, httpd24-curl-7.61.1-1.el7, httpd24-httpd-2.4.34-7.el7 (AXSA:2019-3739:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical
109872	Debian DLA-1379-1 : curl security update	Nessus	Debian Local Security Checks	2018/5/17	2024/10/7	critical
109931	openSUSE Security Update : curl (openSUSE-2018-471)	Nessus	SuSE Local Security Checks	2018/5/21	2024/10/4	critical
111333	Oracle Secure Global Desktop Multiple Vulnerabilities (July 2018 CPU)	Nessus	Misc.	2018/7/25	2021/10/25	critical
118532	RHEL 7 : curl and nss-pem (RHSA-2018:3157)	Nessus	Red Hat Local Security Checks	2018/10/31	2025/4/15	critical
124090	Oracle Fusion Middleware Oracle HTTP Server Multiple Vulnerabilities (October 2018 CPU)	Nessus	Web Servers	2019/4/16	2024/6/19	critical
289425	MiracleLinux 4 : httpd24-nghttp2-1.7.1-7.AXS4, httpd24-curl-7.61.1-1.AXS4, httpd24-httpd-2.4.34-7.AXS4 (AXSA:2019-3745:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical