The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2020-792:01 advisory.

    nodejs-dot-prop: prototype pollution (CVE-2020-8116)     nodejs: HTTP request smuggling due to CR-to-Hyphen conversion (CVE-2020-8201)     npm: Sensitive information exposure through logs (CVE-2020-15095)     libuv: buffer overflow in realpath (CVE-2020-8252)     nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)     nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a     constructor or __proto__ payload (CVE-2020-7598)     nodejs: TLS session reuse can lead to hostname verification bypass (CVE-2020-8172)     nodejs: memory corruption in napi_get_value_string_* functions (CVE-2020-8174)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-2848 advisory.

    - Fixes CVE-2020-11080, CVE-2020-8174, CVE-2020-10531

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for nodejs8 fixes the following issues :

  - CVE-2020-8174: Fixed multiple memory corruption in     napi_get_value_string_*() (bsc#1172443).

  - CVE-2020-11080: Fixed a potential denial of service when     receiving unreasonably large HTTP/2 SETTINGS frames     (bsc#1172442). 

  - CVE-2020-7598: Fixed an issue which could have tricked     minimist into adding or modifying properties of     Object.prototype (bsc#1166916).

This update was imported from the SUSE:SLE-15:Update update project.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3247 advisory.

    The ovirt-engine package provides the Red Hat Virtualization Manager, a     centralized management platform that allows system administrators to view and manage virtual machines. The     Manager provides a comprehensive range of features including search capabilities, resource management,     live migrations, and virtual infrastructure provisioning.

    The Manager is a JBoss Application Server application that provides several interfaces through which the     virtual environment can be accessed and interacted with, including an Administration Portal, a VM Portal,     and a Representational State Transfer (REST) Application Programming Interface (API).

    A list of bugs fixed in this update is available in the Technical Notes     book:

    https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.4/html-single/technical_notes

    Security Fix(es):

    * apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default     (CVE-2019-10086)

    * libquartz: XXE attacks via job description (CVE-2019-13990)

    * novnc: XSS vulnerability via the messages propagated to the status field (CVE-2017-18635)

    * bootstrap: XSS in the tooltip or popover data-template attribute (CVE-2019-8331)

    * nimbus-jose-jwt: Uncaught exceptions while parsing a JWT (CVE-2019-17195)

    * ovirt-engine: response_type parameter allows reflected XSS (CVE-2019-19336)

    * nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a     constructor or __proto__ payload (CVE-2020-7598)

    * ovirt-engine: Redirect to arbitrary URL allows for phishing (CVE-2020-10775)

    * Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)

    * jQuery: passing HTML containing <option> elements to manipulation methods could result in untrusted code     execution (CVE-2020-11023)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a     constructor or __proto__ payload. (CVE-2020-7598)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
293929	MiracleLinux 8 : nodejs:12 (AXSA:2020-792:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/21	high
138481	Oracle Linux 8 : nodejs:10 (ELSA-2020-2848)	Nessus	Oracle Linux Local Security Checks	2020/8/13	2024/11/1	high
138680	openSUSE Security Update : nodejs8 (openSUSE-2020-802)	Nessus	SuSE Local Security Checks	2020/7/20	2024/2/29	high
210560	RHEL 8 : RHV Manager (ovirt-engine) 4.4 (RHSA-2020:3247)	Nessus	Red Hat Local Security Checks	2024/11/8	2025/3/6	critical
250911	Linux Distros Unpatched Vulnerability : CVE-2020-7598	Nessus	Misc.	2025/8/18	2026/8/3	medium

检测

插件搜索

high

high

high

critical

medium