The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-0325 advisory.

    - core: fix bypassing of mod_headers rules via chunked requests (CVE-2013-5704)
    - mod_cache: fix NULL pointer dereference on empty Content-Type (CVE-2014-3581)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A flaw was found in the way httpd handled HTTP Trailer headers when processing requests using chunked encoding. A malicious client could use Trailer headers to set additional HTTP headers after header processing was performed by other modules. This could, for example, lead to a bypass of header restrictions defined with mod_headers.
(CVE-2013-5704)

A NULL pointer dereference flaw was found in the way the mod_cache httpd module handled Content-Type headers. A malicious HTTP server could cause the httpd child process to crash when the Apache HTTP server was configured to proxy to a server with caching enabled.
(CVE-2014-3581)

This update also fixes the following bugs :

  - Previously, the mod_proxy_fcgi Apache module always kept     the back-end connections open even when they should have     been closed. As a consequence, the number of open file     descriptors was increasing over the time. With this     update, mod_proxy_fcgi has been fixed to check the state     of the back- end connections, and it closes the idle     back-end connections as expected.

  - An integer overflow occurred in the ab utility when a     large request count was used. Consequently, ab     terminated unexpectedly with a segmentation fault while     printing statistics after the benchmark. This bug has     been fixed, and ab no longer crashes in this scenario.

  - Previously, when httpd was running in the foreground and     the user pressed Ctrl+C to interrupt the httpd     processes, a race condition in signal handling occurred.
    The SIGINT signal was sent to all children followed by     SIGTERM from the main process, which interrupted the     SIGINT handler. Consequently, the affected processes     became unresponsive or terminated unexpectedly. With     this update, the SIGINT signals in the child processes     are ignored, and httpd no longer hangs or crashes in     this scenario.

In addition, this update adds the following enhancements :

  - With this update, the mod_proxy module of the Apache     HTTP Server supports the Unix Domain Sockets (UDS). This     allows mod_proxy back ends to listen on UDS sockets     instead of TCP sockets, and as a result, mod_proxy can     be used to connect UDS back ends.

  - This update adds support for using the SetHandler     directive together with the mod_proxy module. As a     result, it is possible to configure SetHandler to use     proxy for incoming requests, for example, in the     following format: SetHandler     'proxy:fcgi://127.0.0.1:9000'.

  - The htaccess API changes introduced in httpd 2.4.7 have     been backported to httpd shipped with Scientific Linux     7.1. These changes allow for the MPM-ITK module to be     compiled as an httpd module.

After installing the updated packages, the httpd daemon will be restarted automatically.

The remote host is affected by the vulnerability described in GLSA-201504-03 (Apache: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Apache HTTP Server.
      Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker may be able to execute arbitrary code or cause a       Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

New httpd packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix security issues.

Apache2 updated to fix four security issues and one non-security bug.

The following vulnerabilities have been fixed :

  - mod_headers rules could be bypassed via chunked     requests. Adds 'MergeTrailers' directive to restore     legacy behavior. (bsc#871310, CVE-2013-5704)

  - An empty value in Content-Type could lead to a crash     through a null pointer dereference and a denial of     service. (bsc#899836, CVE-2014-3581)

  - Remote attackers could bypass intended access     restrictions in mod_lua LuaAuthzProvider when multiple     Require directives with different arguments are used.
    (bsc#909715, CVE-2014-8109)

  - Remote attackers could cause a denial of service     (child-process crash) by sending a crafted WebSocket     Ping frame after a Lua script has called the wsupgrade     function. (bsc#918352, CVE-2015-0228)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the httpd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The log_cookie function in mod_log_config.c in the     mod_log_config module in the Apache HTTP Server before     2.4.8 allows remote attackers to cause a denial of     service (segmentation fault and daemon crash) via a     crafted cookie that is not properly handled during     truncation.(CVE-2014-0098)

  - A race condition flaw, leading to heap-based buffer     overflows, was found in the mod_status httpd module. A     remote attacker able to access a status page served by     mod_status on a server using a threaded     Multi-Processing Module (MPM) could send a specially     crafted request that would cause the httpd child     process to crash or, possibly, allow the attacker to     execute arbitrary code with the privileges of the     'apache' user.(CVE-2014-0226)

  - It was discovered that the HTTP parser in httpd     incorrectly allowed certain characters not permitted by     the HTTP protocol specification to appear unencoded in     HTTP request headers. If httpd was used in conjunction     with a proxy or backend server that interpreted those     characters differently, a remote attacker could     possibly use this flaw to inject data into HTTP     responses, resulting in proxy cache     poisoning.(CVE-2016-8743)

  - A NULL pointer dereference flaw was found in the way     the mod_cache httpd module handled Content-Type     headers. A malicious HTTP server could cause the httpd     child process to crash when the Apache HTTP server was     configured to proxy to a server with caching     enabled.(CVE-2014-3581)

  - Multiple flaws were found in the way httpd parsed HTTP     requests and responses using chunked transfer encoding.
    A remote attacker could use these flaws to create a     specially crafted request, which httpd would decode     differently from an HTTP proxy software in front of it,     possibly leading to HTTP request smuggling     attacks.(CVE-2015-3183)

  - In Apache httpd 2.0.23 to 2.0.65, 2.2.0 to 2.2.34, and     2.4.0 to 2.4.29, mod_authnz_ldap, if configured with     AuthLDAPCharsetConfig, uses the Accept-Language header     value to lookup the right charset encoding when     verifying the user's credentials. If the header value     is not present in the charset conversion table, a     fallback mechanism is used to truncate it to a two     characters value to allow a quick retry (for example,     'en-US' is truncated to 'en'). A header value of less     than two characters forces an out of bound write of one     NUL byte to a memory location that is not part of the     string. In the worst case, quite unlikely, the process     would crash which could be used as a Denial of Service     attack. In the more likely case, this memory is already     reserved for future use and the issue has no effect at     all.(CVE-2017-15710)

  - A NULL pointer dereference flaw was found in the     httpd's mod_ssl module. A remote attacker could use     this flaw to cause an httpd child process to crash if     another module used by httpd called a certain API     function during the processing of an HTTPS     request.(CVE-2017-3169)

  - It was discovered that httpd used the value of the     Proxy header from HTTP requests to initialize the     HTTP_PROXY environment variable for CGI scripts, which     in turn was incorrectly used by certain HTTP client     implementations to configure the proxy for outgoing     HTTP requests. A remote attacker could possibly use     this flaw to redirect HTTP requests performed by a CGI     script to an attacker-controlled proxy via a malicious     HTTP request.(CVE-2016-5387)

  - A buffer over-read flaw was found in the httpd's     mod_mime module. A user permitted to modify httpd's     MIME configuration could use this flaw to cause httpd     child process to crash.(CVE-2017-7679)

  - A specially crafted HTTP request header could have     crashed the Apache HTTP Server prior to version 2.4.30     due to an out of bound read while preparing data to be     cached in shared memory. It could be used as a Denial     of Service attack against users of mod_cache_socache.
    The vulnerability is considered as low risk since     mod_cache_socache is not widely used, mod_cache_disk is     not concerned by this vulnerability.(CVE-2018-1303)

  - It was discovered that the httpd's mod_auth_digest     module did not properly initialize memory before using     it when processing certain headers related to digest     authentication. A remote attacker could possibly use     this flaw to disclose potentially sensitive information     or cause httpd child process to crash by sending     specially crafted requests to a server.(CVE-2017-9788)

  - A flaw was found in the way httpd handled HTTP Trailer     headers when processing requests using chunked     encoding. A malicious client could use Trailer headers     to set additional HTTP headers after header processing     was performed by other modules. This could, for     example, lead to a bypass of header restrictions     defined with mod_headers.(CVE-2013-5704)

  - A buffer over-read flaw was found in the httpd's     ap_find_token() function. A remote attacker could use     this flaw to cause httpd child process to crash via a     specially crafted HTTP request.(CVE-2017-7668)

  - A race condition was found in mod_auth_digest when the     web server was running in a threaded MPM configuration.
    It could allow a user with valid credentials to     authenticate using another username, bypassing     configured access control restrictions.(CVE-2019-0217)

  - A NULL pointer dereference flaw was found in the     mod_cache httpd module. A malicious HTTP server could     cause the httpd child process to crash when the Apache     HTTP Server was used as a forward proxy with caching.
    (CVE-2013-4352)

  - he dav_xml_get_cdata function in main/util.c in the     mod_dav module in the Apache HTTP Server before 2.4.8     does not properly remove whitespace characters from     CDATA sections, which allows remote attackers to cause     a denial of service (daemon crash) via a crafted DAV     WRITE request. (CVE-2013-6438)

  - A denial of service flaw was found in the mod_proxy     httpd module. A remote attacker could send a specially     crafted request to a server configured as a reverse     proxy using a threaded Multi-Processing Modules (MPM)     that would cause the httpd child process to crash.
    (CVE-2014-0117)

  - A denial of service flaw was found in the way httpd's     mod_deflate module handled request body decompression     (configured via the 'DEFLATE' input filter). A remote     attacker able to send a request whose body would be     decompressed could use this flaw to consume an     excessive amount of system memory and CPU on the target     system.(CVE-2014-0118)

  - A denial of service flaw was found in the way httpd's     mod_cgid module executed CGI scripts that did not read     data from the standard input. A remote attacker could     submit a specially crafted request that would cause the     httpd child process to hang     indefinitely.(CVE-2014-0231)

  - It was discovered that in httpd 2.4, the internal API     function ap_some_auth_required() could incorrectly     indicate that a request was authenticated even when no     authentication was used. An httpd module using this API     function could consequently allow access that should     have been denied. (CVE-2015-3185)

  - It was discovered that the mod_session_crypto module of     httpd did not use any mechanisms to verify integrity of     the encrypted session data stored in the user's     browser. A remote attacker could use this flaw to     decrypt and modify session data using a padding oracle     attack. (CVE-2016-0736)

  - It was discovered that the mod_auth_digest module of     httpd did not properly check for memory allocation     failures. A remote attacker could use this flaw to     cause httpd child processes to repeatedly crash if the     server used HTTP digest authentication.(CVE-2016-2161)

  - It was discovered that the use of httpd's     ap_get_basic_auth_pw() API function outside of the     authentication phase could lead to authentication     bypass. A remote attacker could possibly use this flaw     to bypass required authentication if the API was used     incorrectly by one of the modules used by     httpd.(CVE-2017-3167)

  - A use-after-free flaw was found in the way httpd     handled invalid and previously unregistered HTTP     methods specified in the Limit directive used in an     .htaccess file. A remote attacker could possibly use     this flaw to disclose portions of the server memory, or     cause httpd child process to crash. (CVE-2017-9798)

  - In Apache httpd 2.2.0 to 2.4.29, when generating an     HTTP Digest authentication challenge, the nonce sent to     prevent reply attacks was not correctly generated using     a pseudo-random seed. In a cluster of servers using a     common Digest authentication configuration, HTTP     requests could be replayed across servers by an     attacker without detection. (CVE-2018-1312)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1972 advisory.

    - Remove mod_proxy_fcgi fix for heap-based buffer overflow,       httpd-2.4.6 is not affected (CVE-2014-3583)
    - core: fix bypassing of mod_headers rules via chunked requests (CVE-2013-5704)
    - mod_cache: fix NULL pointer dereference on empty Content-Type (CVE-2014-3581)
    - mod_proxy_fcgi: fix heap-based buffer overflow (CVE-2014-3583)
    - mod_cgid: add security fix for CVE-2014-0231
    - mod_proxy: add security fix for CVE-2014-0117
    - mod_deflate: add security fix for CVE-2014-0118
    - mod_status: add security fix for CVE-2014-0226

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

- core: fix bypassing of mod_headers rules via chunked     requests (CVE-2013-5704)

    - mod_cache: fix NULL pointer dereference on empty       Content-Type (CVE-2014-3581)

    - mod_proxy_fcgi: fix a potential crash with long       headers (CVE-2014-3583)

    - mod_lua: fix handling of the Require line when a       LuaAuthzProvider is used in multiple Require       directives with different arguments (CVE-2014-8109)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A flaw was found in the way httpd handled HTTP Trailer headers when processing requests using chunked encoding. A malicious client could use Trailer headers to set additional HTTP headers after header processing was performed by other modules. This could, for example, lead to a bypass of header restrictions defined with mod_headers.
(CVE-2013-5704)

This update also fixes the following bugs :

  - The order of mod_proxy workers was not checked when     httpd configuration was reloaded. When mod_proxy workers     were removed, added, or their order was changed, their     parameters and scores could become mixed. The order of     mod_proxy workers has been made internally consistent     during configuration reload.

  - The local host certificate created during firstboot     contained CA extensions, which caused the httpd service     to return warning messages. This has been addressed by     local host certificates being generated with the     '-extensions v3_req' option.

  - The default mod_ssl configuration no longer enables     support for SSL cipher suites using the single DES,     IDEA, or SEED encryption algorithms.

  - The apachectl script did not take into account the     HTTPD_LANG variable set in the /etc/sysconfig/httpd file     during graceful restarts. Consequently, httpd did not     use a changed value of HTTPD_LANG when the daemon was     restarted gracefully. The script has been fixed to     handle the HTTPD_LANG variable correctly.

  - The mod_deflate module failed to check the original file     size while extracting files larger than 4 GB, making it     impossible to extract large files. Now, mod_deflate     checks the original file size properly according to     RFC1952, and it is able to decompress files larger than     4 GB.

  - The httpd service did not check configuration before     restart. When a configuration contained an error, an     attempt to restart httpd gracefully failed. Now, httpd     checks configuration before restart and if the     configuration is in an inconsistent state, an error     message is printed, httpd is not stopped and a restart     is not performed.

  - The SSL_CLIENT_VERIFY environment variable was     incorrectly handled when the 'SSLVerifyClient     optional_no_ca' and 'SSLSessionCache' options were used.
    When an SSL session was resumed, the SSL_CLIENT_VERIFY     value was set to 'SUCCESS' instead of the previously set     'GENEROUS'. SSL_CLIENT_VERIFY is now correctly set to     GENEROUS in this scenario.

  - The ab utility did not correctly handle situations when     an SSL connection was closed after some data had already     been read. As a consequence, ab did not work correctly     with SSL servers and printed 'SSL read failed' error     messages. With this update, ab works as expected with     HTTPS servers.

  - When a client presented a revoked certificate, log     entries were created only at the debug level. The log     level of messages regarding a revoked certificate has     been increased to INFO, and administrators are now     properly informed of this situation.

In addition, this update adds the following enhancement :

  - A mod_proxy worker can now be set into drain mode (N)     using the balancer-manager web interface or using the     httpd configuration file. A worker in drain mode accepts     only existing sticky sessions destined for itself and     ignores all other requests. The worker waits until all     clients currently connected to this worker complete     their work before the worker is stopped. As a result,     drain mode enables to perform maintenance on a worker     without affecting clients.

After installing the updated packages, the httpd service will be restarted automatically.

Updated Red Hat JBoss Web Server 3.0.2 packages are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library.

It was found that Tomcat would keep connections open after processing requests with a large enough request body. A remote attacker could potentially use this flaw to exhaust the pool of available connections and prevent further, legitimate connections to the Tomcat server.
(CVE-2014-0230)

A flaw was found in the way httpd handled HTTP Trailer headers when processing requests using chunked encoding. A malicious client could use Trailer headers to set additional HTTP headers after header processing was performed by other modules. This could, for example, lead to a bypass of header restrictions defined with mod_headers.
(CVE-2013-5704)

Multiple flaws were found in the way httpd parsed HTTP requests and responses using chunked transfer encoding. A remote attacker could use these flaws to create a specially crafted request, which httpd would decode differently from an HTTP proxy software in front of it, possibly leading to HTTP request smuggling attacks. (CVE-2015-3183)

* This enhancement update adds the Red Hat JBoss Web Server 3.0.2 packages to Red Hat Enterprise Linux 7. These packages provide a number of enhancements over the previous version of Red Hat JBoss Web Server. (JIRA#JWS-229)

Users of Red Hat JBoss Web Server are advised to upgrade to these updated packages, which add this enhancement.

The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass 'RequestHeader unset' directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states 'this is not a security issue in httpd as such.' (CVE-2013-5704)

The remote host is running a version of Mac OS X 10.8.5 or 10.9.5 that is missing Security Update 2015-004. It is, therefore, affected multiple vulnerabilities in the following components :

  - Apache
  - ATS
  - Certificate Trust Policy
  - CoreAnimation
  - FontParser
  - Graphics Driver
  - ImageIO
  - IOHIDFamily
  - Kernel
  - LaunchServices
  - Open Directory Client
  - OpenLDAP
  - OpenSSL
  - PHP
  - QuickLook
  - SceneKit
  - Security - Code SIgning
  - UniformTypeIdentifiers

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The remote Mac OS X host has a version of OS X Server installed that is prior to 5.0.3. It is, therefore, affected by the following vulnerabilities :

  - A flaw exists in the mod_headers module that allows HTTP     trailers to replace HTTP headers late during request     processing. A remote attacker can exploit this to inject     arbitrary headers. This can also cause some modules to     function incorrectly or appear to function incorrectly.
    (CVE-2013-5704)

  - A privilege escalation vulnerability exists due to the     'make check' command not properly invoking initdb to     specify authentication requirements for a database     cluster to be used for tests. A local attacker can     exploit this issue to gain temporary server access and     elevated privileges. (CVE-2014-0067)

  - A NULL pointer dereference flaw exists in module     mod_cache. A remote attacker, using an empty HTTP     Content-Type header, can exploit this vulnerability to     crash a caching forward proxy configuration, resulting     in a denial of service if using a threaded MPM.
    (CVE-2014-3581)

  - A out-of-bounds memory read flaw exists in module     mod_proxy_fcgi. An attacker, using a remote FastCGI     server to send long response headers, can exploit this     vulnerability to cause a denial of service by causing     a buffer over-read. (CVE-2014-3583)

  - A flaw exists in module mod_lua when handling a     LuaAuthzProvider used in multiple Require directives     with different arguments. An attacker can exploit this     vulnerability to bypass intended access restrictions.
    (CVE-2014-8109)

  - An information disclosure vulnerability exists due to     improper handling of restricted column values in     constraint-violation error messages. An authenticated,     remote attacker can exploit this to gain access to     sensitive information. (CVE-2014-8161)

  - A flaw exists within the Domain Name Service due to an     error in the code used to follow delegations. A remote     attacker, with a maliciously-constructed zone or query,     can cause the service to issue unlimited queries,     resulting in resource exhaustion. (CVE-2014-8500)

  - A flaw exists in the lua_websocket_read() function in     the 'mod_lua' module due to incorrect handling of     WebSocket PING frames. A remote attacker can exploit     this, by sending a crafted WebSocket PING frame after a     Lua script has called the wsupgrade() function, to crash     a child process, resulting in a denial of service     condition. (CVE-2015-0228)

  - Multiple vulnerabilities exist due to several buffer     overflow errors related to the 'to_char' functions. An     authenticated, remote attacker can exploit these issues     to cause a denial of service or arbitrary code     execution. (CVE-2015-0241)

  - Multiple vulnerabilities exist due to several     stack-based buffer overflow errors in various *printf()     functions. The overflows are due to improper validation     of user-supplied input when formatting a floating point     number where the requested precision is greater than     approximately 500. An authenticated, remote attacker     can exploit these issues to cause a denial of service or     arbitrary code execution. (CVE-2015-0242)

  - Multiple vulnerabilities exist due to an overflow     condition in multiple functions in the 'pgcrypto'     extension. The overflows are due to improper validation     of user-supplied input when tracking memory sizes. An     authenticated, remote attacker can exploit these issues     to cause a denial of service or arbitrary code     execution. (CVE-2015-0243)

  - A SQL injection vulnerability exists due to improper     sanitization of user-supplied input when handling     crafted binary data within a command parameter. An     authenticated, remote attacker can exploit this issue     to inject or manipulate SQL queries, allowing the     manipulation or disclosure of arbitrary data.
    (CVE-2015-0244)

  - A NULL pointer dereference flaw exists in the     read_request_line() function due to a failure to     initialize the protocol structure member. A remote     attacker can exploit this flaw, on installations that     enable the INCLUDES filter and has an ErrorDocument 400     directive specifying a local URI, by sending a request     that lacks a method, to cause a denial of service     condition. (CVE-2015-0253)

  - A denial of service vulnerability exists due to an error     relating to DNSSEC validation and the managed-keys     feature. A remote attacker can trigger an incorrect     trust-anchor management scenario in which no key is     ready for use, resulting in an assertion failure and     daemon crash. (CVE-2015-1349)

  - A flaw exists in PostgreSQL client disconnect timeout     expiration that is triggered when a timeout interrupt     is fired partway through the session shutdown sequence.     (CVE-2015-3165)

  - A flaw exists in the printf() functions due to a failure     to check for errors. A remote attacker can use this to     gain access to sensitive information. (CVE-2015-3166)

  - The pgcrypto component in PostgreSQL has multiple error     messages for decryption with an incorrect key. A remote     attacker can use this to recover keys from other     systems. (CVE-2015-3167)

  - A flaw exists in the chunked transfer coding     implementation due to a failure to properly parse chunk     headers. A remote attacker can exploit this to conduct     HTTP request smuggling attacks. (CVE-2015-3183)

  - A flaw exists in the ap_some_auth_required() function     due to a failure to consider that a Require directive     may be associated with an authorization setting rather     than an authentication setting. A remote attacker can     exploit this, if a module that relies on the 2.2 API     behavior exists, to bypass intended access restrictions.
    (CVE-2015-3185)

  - Multiple unspecified XML flaws exist in the Wiki Server     based on Twisted. (CVE-2015-5911)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
81802	Oracle Linux 7 : httpd (ELSA-2015-0325)	Nessus	Oracle Linux Local Security Checks	2015/3/13	2024/10/22	high
82252	Scientific Linux Security Update : httpd on SL7.x x86_64 (20150305)	Nessus	Scientific Linux Local Security Checks	2015/3/26	2021/1/14	medium
82733	GLSA-201504-03 : Apache: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2015/4/13	2021/1/11	medium
82916	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : httpd (SSA:2015-111-03)	Nessus	Slackware Local Security Checks	2015/4/22	2021/1/14	medium
83945	SUSE SLES12 Security Update : apache2 (SUSE-SU-2015:0974-1)	Nessus	SuSE Local Security Checks	2015/6/2	2021/1/6	medium
124922	EulerOS Virtualization 3.0.1.0 : httpd (EulerOS-SA-2019-1419)	Nessus	Huawei Local Security Checks	2019/5/14	2024/5/23	critical
181022	Oracle Linux 6 : httpd24-httpd (ELSA-2014-1972)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2024/10/22	high
81837	Fedora 21 : httpd-2.4.10-15.fc21 (2014-17195)	Nessus	Fedora Local Security Checks	2015/3/17	2021/1/11	medium
85196	Scientific Linux Security Update : httpd on SL6.x i386/x86_64 (20150722)	Nessus	Scientific Linux Local Security Checks	2015/8/4	2021/1/14	medium
87458	RHEL 7 : JBoss Web Server (RHSA-2015:2660)	Nessus	Red Hat Local Security Checks	2015/12/17	2021/2/5	medium
91367	F5 Networks BIG-IP : Apache vulnerability (K16863)	Nessus	F5 Networks Local Security Checks	2016/5/31	2021/3/10	medium
82700	Mac OS X Multiple Vulnerabilities (Security Update 2015-004) (FREAK)	Nessus	MacOS X Local Security Checks	2015/4/10	2024/5/28	critical
86066	Mac OS X : OS X Server < 5.0.3 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	2015/9/22	2019/11/22	critical

检测

插件搜索

high

medium

medium

medium

medium

critical

high

medium

medium

medium

medium

critical

critical