An update of the apache package has been released.

According to the versions of the tomcat packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - When serving resources from a network location using     the NTFS file system, Apache Tomcat versions 10.0.0-M1     to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and     7.0.0 to 7.0.106 were susceptible to JSP source code     disclosure in some configurations. The root cause was     the unexpected behaviour of the JRE API     File.getCanonicalPath() which in turn was caused by the     inconsistent behaviour of the Windows API     (FindFirstFileW) in some circumstances.(CVE-2021-24122)

  - The fix for CVE-2020-9484 was incomplete. When using     Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41,     8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a     configuration edge case that was highly unlikely to be     used, the Tomcat instance was still vulnerable to     CVE-2020-9494. Note that both the previously published     prerequisites for CVE-2020-9484 and the previously     published mitigations for CVE-2020-9484 also apply to     this issue.(CVE-2021-25329)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of tomcat7 installed on the remote host is prior to 7.0.108-1.40. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1493 advisory.

    A deserialization flaw was discovered in Apache Tomcat's use of a FileStore. Under specific circumstances,     an attacker can use a specially crafted request to trigger Remote Code Execution through deserialization     of the file under their control. The highest threat from the vulnerability is to data confidentiality and     integrity as well as system availability. (CVE-2020-9484)

    The fix forCVE-2020-9484was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41,     8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used,     the Tomcat instance was still vulnerable toCVE-2020-9494. Note that both the previously published     prerequisites forCVE-2020-9484and the previously published mitigations forCVE-2020-9484also apply to this     issue. (CVE-2021-25329)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 5.15.6. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.15.6 advisory.

  - encoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a denial of service (invalid write     access and application crash) or possibly have unspecified other impact via a crafted UTF-8 character     sequence. (CVE-2021-26937)

  - Vulnerability in the Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition product of Oracle Java     SE (component: Libraries). Supported versions that are affected are Java SE: 7u291, 8u281, 11.0.10, 16;
    Java SE Embedded: 8u281; Oracle GraalVM Enterprise Edition: 19.3.5, 20.3.1.2 and 21.0.0.2. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition. Successful attacks require human     interaction from a person other than the attacker. Successful attacks of this vulnerability can result in     unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded,     Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments     that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox     for security. (CVE-2021-2163)

  - In the Linux kernel before 5.3.9, there are multiple out-of-bounds write bugs that can be caused by a     malicious USB device in the Linux kernel HID drivers, aka CID-d9d4b1e46d95. This affects drivers/hid/hid-     axff.c, drivers/hid/hid-dr.c, drivers/hid/hid-emsff.c, drivers/hid/hid-gaff.c, drivers/hid/hid-holtekff.c,     drivers/hid/hid-lg2ff.c, drivers/hid/hid-lg3ff.c, drivers/hid/hid-lg4ff.c, drivers/hid/hid-lgff.c,     drivers/hid/hid-logitech-hidpp.c, drivers/hid/hid-microsoft.c, drivers/hid/hid-sony.c, drivers/hid/hid-     tmff.c, and drivers/hid/hid-zpff.c. (CVE-2019-19532)

  - In create_pinctrl of core.c, there is a possible out of bounds read due to a use after free. This could     lead to local information disclosure with no additional execution privileges needed. User interaction is     not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-140550171     (CVE-2020-0427)

  - A flaw was found in the Linux kernel. A use-after-free memory flaw was found in the perf subsystem     allowing a local attacker with permission to monitor perf events to corrupt memory and possibly escalate     privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as     system availability. (CVE-2020-14351)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1058-1 advisory.

    Update to Tomcat 9.0.115:

    - CVE-2025-48989: HTTP/2 protocol (including DNS over HTTPS) is vulnerable to 'MadeYouReset' DoS attack     (bsc#1243895).
    - CVE-2025-52434: race condition on connection close when using the APR/Native connector could lead to a     JVM crash       (bsc#1246389).
    - CVE-2025-53506: uncontrolled resource HTTP/2 client consumption vulnerability (bsc#1246318).
    - CVE-2025-66614: client certificate verification bypass due to virtual host mapping (bsc#1258371).
    - CVE-2026-24733: improper input validation on HTTP/0.9 requests (bsc#1258385).
    - CVE-2023-44487: Rapid reset attack (bsc#1216182).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
147818	Photon OS 2.0: Apache PHSA-2021-2.0-0328	Nessus	PhotonOS Local Security Checks	2021/3/16	2024/7/23	high
153352	EulerOS 2.0 SP2 : tomcat (EulerOS-SA-2021-2435)	Nessus	Huawei Local Security Checks	2021/9/14	2023/11/30	high
148378	Amazon Linux AMI : tomcat7 (ALAS-2021-1493)	Nessus	Amazon Linux Local Security Checks	2021/4/7	2024/12/17	high
164567	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.15.6)	Nessus	Misc.	2022/9/1	2025/7/22	critical
303957	SUSE SLES12 Security Update : tomcat (SUSE-SU-2026:1058-1)	Nessus	SuSE Local Security Checks	2026/3/27	2026/4/30	critical

检测

插件搜索

high

high

high

critical

critical