New httpd packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix security issues.

Apache2 updated to fix four security issues and one non-security bug.

The following vulnerabilities have been fixed :

  - mod_headers rules could be bypassed via chunked     requests. Adds 'MergeTrailers' directive to restore     legacy behavior. (bsc#871310, CVE-2013-5704)

  - An empty value in Content-Type could lead to a crash     through a null pointer dereference and a denial of     service. (bsc#899836, CVE-2014-3581)

  - Remote attackers could bypass intended access     restrictions in mod_lua LuaAuthzProvider when multiple     Require directives with different arguments are used.
    (bsc#909715, CVE-2014-8109)

  - Remote attackers could cause a denial of service     (child-process crash) by sending a crafted WebSocket     Ping frame after a Lua script has called the wsupgrade     function. (bsc#918352, CVE-2015-0228)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Apache HTTP SERVER PROJECT reports :

mod_deflate: The DEFLATE input filter (inflates request bodies) now limits the length and compression ratio of inflated request bodies to avoid denial of service via highly compressed bodies. See directives DeflateInflateLimitRequestBody, DeflateInflateRatioLimit, and DeflateInflateRatioBurst.

mod_cgid: Fix a denial of service against CGI scripts that do not consume stdin that could lead to lingering HTTPD child processes filling up the scoreboard and eventually hanging the server. By default, the client I/O timeout (Timeout directive) now applies to communication with scripts. The CGIDScriptTimeout directive can be used to set a different timeout for communication with scripts.

Fix a race condition in scoreboard handling, which could lead to a heap buffer overflow.

core: HTTP trailers could be used to replace HTTP headers late during request processing, potentially undoing or otherwise confusing modules that examined or modified request headers earlier. Adds 'MergeTrailers' directive to restore legacy behavior.

According to the versions of the httpd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The log_cookie function in mod_log_config.c in the     mod_log_config module in the Apache HTTP Server before     2.4.8 allows remote attackers to cause a denial of     service (segmentation fault and daemon crash) via a     crafted cookie that is not properly handled during     truncation.(CVE-2014-0098)

  - A race condition flaw, leading to heap-based buffer     overflows, was found in the mod_status httpd module. A     remote attacker able to access a status page served by     mod_status on a server using a threaded     Multi-Processing Module (MPM) could send a specially     crafted request that would cause the httpd child     process to crash or, possibly, allow the attacker to     execute arbitrary code with the privileges of the     'apache' user.(CVE-2014-0226)

  - It was discovered that the HTTP parser in httpd     incorrectly allowed certain characters not permitted by     the HTTP protocol specification to appear unencoded in     HTTP request headers. If httpd was used in conjunction     with a proxy or backend server that interpreted those     characters differently, a remote attacker could     possibly use this flaw to inject data into HTTP     responses, resulting in proxy cache     poisoning.(CVE-2016-8743)

  - A NULL pointer dereference flaw was found in the way     the mod_cache httpd module handled Content-Type     headers. A malicious HTTP server could cause the httpd     child process to crash when the Apache HTTP server was     configured to proxy to a server with caching     enabled.(CVE-2014-3581)

  - Multiple flaws were found in the way httpd parsed HTTP     requests and responses using chunked transfer encoding.
    A remote attacker could use these flaws to create a     specially crafted request, which httpd would decode     differently from an HTTP proxy software in front of it,     possibly leading to HTTP request smuggling     attacks.(CVE-2015-3183)

  - In Apache httpd 2.0.23 to 2.0.65, 2.2.0 to 2.2.34, and     2.4.0 to 2.4.29, mod_authnz_ldap, if configured with     AuthLDAPCharsetConfig, uses the Accept-Language header     value to lookup the right charset encoding when     verifying the user's credentials. If the header value     is not present in the charset conversion table, a     fallback mechanism is used to truncate it to a two     characters value to allow a quick retry (for example,     'en-US' is truncated to 'en'). A header value of less     than two characters forces an out of bound write of one     NUL byte to a memory location that is not part of the     string. In the worst case, quite unlikely, the process     would crash which could be used as a Denial of Service     attack. In the more likely case, this memory is already     reserved for future use and the issue has no effect at     all.(CVE-2017-15710)

  - A NULL pointer dereference flaw was found in the     httpd's mod_ssl module. A remote attacker could use     this flaw to cause an httpd child process to crash if     another module used by httpd called a certain API     function during the processing of an HTTPS     request.(CVE-2017-3169)

  - It was discovered that httpd used the value of the     Proxy header from HTTP requests to initialize the     HTTP_PROXY environment variable for CGI scripts, which     in turn was incorrectly used by certain HTTP client     implementations to configure the proxy for outgoing     HTTP requests. A remote attacker could possibly use     this flaw to redirect HTTP requests performed by a CGI     script to an attacker-controlled proxy via a malicious     HTTP request.(CVE-2016-5387)

  - A buffer over-read flaw was found in the httpd's     mod_mime module. A user permitted to modify httpd's     MIME configuration could use this flaw to cause httpd     child process to crash.(CVE-2017-7679)

  - A specially crafted HTTP request header could have     crashed the Apache HTTP Server prior to version 2.4.30     due to an out of bound read while preparing data to be     cached in shared memory. It could be used as a Denial     of Service attack against users of mod_cache_socache.
    The vulnerability is considered as low risk since     mod_cache_socache is not widely used, mod_cache_disk is     not concerned by this vulnerability.(CVE-2018-1303)

  - It was discovered that the httpd's mod_auth_digest     module did not properly initialize memory before using     it when processing certain headers related to digest     authentication. A remote attacker could possibly use     this flaw to disclose potentially sensitive information     or cause httpd child process to crash by sending     specially crafted requests to a server.(CVE-2017-9788)

  - A flaw was found in the way httpd handled HTTP Trailer     headers when processing requests using chunked     encoding. A malicious client could use Trailer headers     to set additional HTTP headers after header processing     was performed by other modules. This could, for     example, lead to a bypass of header restrictions     defined with mod_headers.(CVE-2013-5704)

  - A buffer over-read flaw was found in the httpd's     ap_find_token() function. A remote attacker could use     this flaw to cause httpd child process to crash via a     specially crafted HTTP request.(CVE-2017-7668)

  - A race condition was found in mod_auth_digest when the     web server was running in a threaded MPM configuration.
    It could allow a user with valid credentials to     authenticate using another username, bypassing     configured access control restrictions.(CVE-2019-0217)

  - A NULL pointer dereference flaw was found in the     mod_cache httpd module. A malicious HTTP server could     cause the httpd child process to crash when the Apache     HTTP Server was used as a forward proxy with caching.
    (CVE-2013-4352)

  - he dav_xml_get_cdata function in main/util.c in the     mod_dav module in the Apache HTTP Server before 2.4.8     does not properly remove whitespace characters from     CDATA sections, which allows remote attackers to cause     a denial of service (daemon crash) via a crafted DAV     WRITE request. (CVE-2013-6438)

  - A denial of service flaw was found in the mod_proxy     httpd module. A remote attacker could send a specially     crafted request to a server configured as a reverse     proxy using a threaded Multi-Processing Modules (MPM)     that would cause the httpd child process to crash.
    (CVE-2014-0117)

  - A denial of service flaw was found in the way httpd's     mod_deflate module handled request body decompression     (configured via the 'DEFLATE' input filter). A remote     attacker able to send a request whose body would be     decompressed could use this flaw to consume an     excessive amount of system memory and CPU on the target     system.(CVE-2014-0118)

  - A denial of service flaw was found in the way httpd's     mod_cgid module executed CGI scripts that did not read     data from the standard input. A remote attacker could     submit a specially crafted request that would cause the     httpd child process to hang     indefinitely.(CVE-2014-0231)

  - It was discovered that in httpd 2.4, the internal API     function ap_some_auth_required() could incorrectly     indicate that a request was authenticated even when no     authentication was used. An httpd module using this API     function could consequently allow access that should     have been denied. (CVE-2015-3185)

  - It was discovered that the mod_session_crypto module of     httpd did not use any mechanisms to verify integrity of     the encrypted session data stored in the user's     browser. A remote attacker could use this flaw to     decrypt and modify session data using a padding oracle     attack. (CVE-2016-0736)

  - It was discovered that the mod_auth_digest module of     httpd did not properly check for memory allocation     failures. A remote attacker could use this flaw to     cause httpd child processes to repeatedly crash if the     server used HTTP digest authentication.(CVE-2016-2161)

  - It was discovered that the use of httpd's     ap_get_basic_auth_pw() API function outside of the     authentication phase could lead to authentication     bypass. A remote attacker could possibly use this flaw     to bypass required authentication if the API was used     incorrectly by one of the modules used by     httpd.(CVE-2017-3167)

  - A use-after-free flaw was found in the way httpd     handled invalid and previously unregistered HTTP     methods specified in the Limit directive used in an     .htaccess file. A remote attacker could possibly use     this flaw to disclose portions of the server memory, or     cause httpd child process to crash. (CVE-2017-9798)

  - In Apache httpd 2.2.0 to 2.4.29, when generating an     HTTP Digest authentication challenge, the nonce sent to     prevent reply attacks was not correctly generated using     a pseudo-random seed. In a cluster of servers using a     common Digest authentication configuration, HTTP     requests could be replayed across servers by an     attacker without detection. (CVE-2018-1312)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of IBM HTTP Server running on the remote host is affected by multiple vulnerabilities, as follows:

  - Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or execute arbitrary code, via a crafted request that triggers improper scoreboard handling within the status_handler function in modules/generators/mod_status.c and the lua_ap_scoreboard_worker function in modules/lua/lua_request.c. (CVE-2014-0226)

  - The mod_cgid module in the Apache HTTP Server before 2.4.10 does not have a timeout mechanism, which allows remote attackers to cause a denial of service (process hang) via a request to a CGI script that does not read from its stdin file descriptor. (CVE-2014-0231)

  - The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service (resource consumption) via crafted request data that decompresses to a much larger size. (CVE-2014-0118)

  - The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass 'RequestHeader unset' directives by placing a header in the trailer portion of data sent with chunked transfer coding.
NOTE: the vendor states 'this is not a security issue in httpd as such.' (CVE-2013-5704)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass 'RequestHeader unset' directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states 'this is not a security issue in httpd as such.'

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2015-347:01 advisory.

    The Apache HTTP Server is a powerful, efficient, and extensible     web server.
    Security issues fixed with this release:
    CVE-2013-5704     The mod_headers module in the Apache HTTP Server 2.2.22 allows remote     attackers to bypass RequestHeader unset directives by placing a     header in the trailer portion of data sent with chunked transfer     coding.  NOTE: the vendor states this is not a security issue in httpd     as such.
    Fixed bugs:
    * The order of mod_proxy workers was not checked when httpd configuration was     reloaded. When mod_proxy workers were removed, added, or their order was     changed, their parameters and scores could become mixed. With this update,     the order of mod_proxy workers has been made internally consistent during     configuration reload.
    * The local host certificate created during firstboot contained CA extensions,     which caused the httpd service to return warning messages. With this update,     the bug hes been fixed.
    * The default mod_ssl configuration no longer enables support for SSL cipher     suites using the single DES, IDEA, or SEED encryption algorithms.
    * The apachectl script did not take into account the HTTPD_LANG variable set in     the /etc/sysconfig/httpd file during graceful restarts. Consequently, httpd did     not use a changed value of HTTPD_LANG when the daemon was restarted gracefully.
    To fix this bug, the script has been fixed to handle the HTTPD_LANG variable correctly.
    * The mod_deflate module failed to check the original file size while extracting     files larger than 4 GB, making it impossible to extract large files. With this update,     the problem has been fixed.
    * The httpd service did not check configuration before restart. When a     configuration contained an error, an attempt to restart httpd gracefully failed.
    With this update, the problem has been fixed.
    * The SSL_CLIENT_VERIFY environment variable was incorrectly handled when the     SSLVerifyClient optional_no_ca and SSLSessionCache options were used. When     an SSL session was resumed, the SSL_CLIENT_VERIFY value was set to SUCCESS     instead of the previously set GENEROUS. SSL_CLIENT_VERIFY is now correctly set     to GENEROUS in this scenario.
    * The ab utility did not correctly handle situations when an SSL connection was     closed after some data had already been read. As a consequence, ab did not work     correctly with SSL servers and printed SSL read failed error messages. With     this update, the described bug has been fixed.
    * When a client presented a revoked certificate, log entries were created only     at the debug level. The log level of messages regarding a revoked certificate     has been increased to INFO, and administrators are now properly informed of this     situation.
    Enhancements:
    * A mod_proxy worker can now be set into drain mode (N) using the     balancer-manager web interface or using the httpd configuration file. A worker     in drain mode accepts only existing sticky sessions destined for itself and     ignores all other requests. The worker waits until all clients currently     connected to this worker complete their work before the worker is stopped. As a     result, drain mode enables to perform maintenance on a worker without affecting     clients.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated httpd and httpd22 packages that fix two security issues are now available for Red Hat JBoss Web Server 2.1.0 for Red Hat Enterprise Linux 5, 6, and 7.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available from the CVE links in the References section.

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library.

Multiple flaws were found in the way httpd parsed HTTP requests and responses using chunked transfer encoding. A remote attacker could use these flaws to create a specially crafted request, which httpd would decode differently from an HTTP proxy software in front of it, possibly leading to HTTP request smuggling attacks. (CVE-2015-3183)

A flaw was found in the way httpd handled HTTP Trailer headers when processing requests using chunked encoding. A malicious client could use Trailer headers to set additional HTTP headers after header processing was performed by other modules. This could, for example, lead to a bypass of header restrictions defined with mod_headers.
(CVE-2013-5704)

Users of httpd or httpd22 are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.
After installing the updated packages, the httpd or httpd22 service must be restarted manually for this update to take effect.

Updated Red Hat JBoss Web Server 3.0.2 packages are now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library.

It was found that Tomcat would keep connections open after processing requests with a large enough request body. A remote attacker could potentially use this flaw to exhaust the pool of available connections and prevent further, legitimate connections to the Tomcat server.
(CVE-2014-0230)

A flaw was found in the way httpd handled HTTP Trailer headers when processing requests using chunked encoding. A malicious client could use Trailer headers to set additional HTTP headers after header processing was performed by other modules. This could, for example, lead to a bypass of header restrictions defined with mod_headers.
(CVE-2013-5704)

Multiple flaws were found in the way httpd parsed HTTP requests and responses using chunked transfer encoding. A remote attacker could use these flaws to create a specially crafted request, which httpd would decode differently from an HTTP proxy software in front of it, possibly leading to HTTP request smuggling attacks. (CVE-2015-3183)

* This enhancement update adds the Red Hat JBoss Web Server 3.0.2 packages to Red Hat Enterprise Linux 6. These packages provide a number of enhancements over the previous version of Red Hat JBoss Web Server. (JIRA#JWS-228)

Users of Red Hat JBoss Web Server are advised to upgrade to these updated packages, which add this enhancement.

- core: fix bypassing of mod_headers rules via chunked     requests (CVE-2013-5704)

    - mod_cache: fix NULL pointer dereference on empty       Content-Type (CVE-2014-3581)

    - mod_proxy_fcgi: fix a potential crash with long       headers (CVE-2014-3583)

    - mod_lua: fix handling of the Require line when a       LuaAuthzProvider is used in multiple Require       directives with different arguments (CVE-2014-8109)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2523-1 advisory.

    Martin Holst Swende discovered that the mod_headers module allowed HTTP trailers to replace HTTP headers     during request processing. A remote attacker could possibly use this issue to bypass RequestHeaders     directives. (CVE-2013-5704)

    Mark Montague discovered that the mod_cache module incorrectly handled empty HTTP Content-Type headers. A     remote attacker could use this issue to cause the server to stop responding, leading to a denial of     service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 14.10. (CVE-2014-3581)

    Teguh P. Alko discovered that the mod_proxy_fcgi module incorrectly handled long response headers. A     remote attacker could use this issue to cause the server to stop responding, leading to a denial of     service. This issue only affected Ubuntu 14.10. (CVE-2014-3583)

    It was discovered that the mod_lua module incorrectly handled different arguments within different     contexts. A remote attacker could possibly use this issue to bypass intended access restrictions. This     issue only affected Ubuntu 14.10. (CVE-2014-8109)

    Guido Vranken discovered that the mod_lua module incorrectly handled a specially crafted websocket PING in     certain circumstances. A remote attacker could possibly use this issue to cause the server to stop     responding, leading to a denial of service. This issue only affected Ubuntu 14.10. (CVE-2015-0228)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of Apache 2.2.x running on the remote host is prior to 2.2.28. It is, therefore, affected by the following vulnerabilities :

  - A flaw exists within the 'mod_headers' module which     allows a remote attacker to inject arbitrary headers.
    This is done by placing a header in the trailer portion     of data being sent using chunked transfer encoding.
    (CVE-2013-5704)

  - A flaw exists within the 'mod_deflate' module when     handling highly compressed bodies. Using a specially     crafted request, a remote attacker can exploit this to     cause a denial of service by exhausting memory and CPU     resources. (CVE-2014-0118)

  - The 'mod_status' module contains a race condition that     can be triggered when handling the scoreboard. A remote     attacker can exploit this to cause a denial of service,     execute arbitrary code, or obtain sensitive credential     information. (CVE-2014-0226)

  - The 'mod_cgid' module lacks a time out mechanism. Using     a specially crafted request, a remote attacker can use     this flaw to cause a denial of service by causing child     processes to linger indefinitely, eventually filling up     the scoreboard. (CVE-2014-0231)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The IBM WebSphere Application Server running on the remote host is version 8.5 prior to Fix Pack 8.5.5.4. It is, therefore, affected by the following vulnerabilities :

  - Multiple errors exist related to the included IBM HTTP     server that can allow remote code execution or denial     of service. (CVE-2013-5704, CVE-2014-0118,     CVE-2014-0226, CVE-2014-0231 / PI22070)

  - An unspecified error exists related to HTTP headers     that can allow information disclosure. (CVE-2014-3021     / PI08268)

  - An error exists related to the way SSL 3.0 handles     padding bytes when decrypting messages encrypted using     block ciphers in cipher block chaining (CBC) mode. A     man-in-the-middle attacker can decrypt a selected byte     of a cipher text in as few as 256 tries if they are able     to force a victim application to repeatedly send the     same data over newly created SSL 3.0 connections. This     is also known as the 'POODLE' issue. (CVE-2014-3566 /     PI28435, PI28436, PI28437)

  - An unspecified input validation errors exist related to     the administrative console that can allow cross-site     scripting and cross-site request forgery attacks.
    (CVE-2014-4770, CVE-2014-4816 / PI23055)

  - An unspecified error exists that can allow OpenID and     OpenID Connect cookies to be spoofed, allowing     information disclosure. (CVE-2014-6164 / PI23430)

  - An error exists related to the Communications Enabled     Applications (CEA) service that can allow XML External     Entity Injection (XXE) attacks leading to information     disclosure. This only occurs if CEA is enabled. By     default this is disabled. (CVE-2014-6166 / PI25310)

  - An input validation error exists related to session     input using URL rewriting that can allow cross-site     scripting attacks. (CVE-2014-6167 / PI23819)

  - An error exists related to the administrative console     that can allow 'click-jacking' attacks. (CVE-2014-6174 /     PI27152)

  - An error exists related to deployment descriptor     security constraints and ServletSecurity annotations on     a servlet that can allow privilege escalation. Note that     this issue only affects the 'Liberty Profile'.
    (CVE-2014-8890 / PI29911)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
82916	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : httpd (SSA:2015-111-03)	Nessus	Slackware Local Security Checks	2015/4/22	2021/1/14	medium
83945	SUSE SLES12 Security Update : apache2 (SUSE-SU-2015:0974-1)	Nessus	SuSE Local Security Checks	2015/6/2	2021/1/6	medium
76780	FreeBSD : apache22 -- several vulnerabilities (f927e06c-1109-11e4-b090-20cf30e32f6d)	Nessus	FreeBSD Local Security Checks	2014/7/25	2021/1/6	medium
124922	EulerOS Virtualization 3.0.1.0 : httpd (EulerOS-SA-2019-1419)	Nessus	Huawei Local Security Checks	2019/5/14	2024/5/23	critical
144289	IBM HTTP Server 8.5.0.0 <= 8.5.5.2 / 8.0.0.0 <= 8.0.0.9 / 7.0.0.0 <= 7.0.0.33 / 6.1.0.0. <= 6.1.0.47 / 6.0.2.0 <= 6.0.2.43 Multiple Vulnerabilities (509275)	Nessus	Web Servers	2020/12/15	2022/4/11	high
78357	Amazon Linux AMI : httpd (ALAS-2014-414)	Nessus	Amazon Linux Local Security Checks	2014/10/12	2018/4/18	medium
288961	MiracleLinux 4 : httpd-2.2.15-45.0.1.AXS4 (AXSA:2015-347:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high
88077	RHEL 5 / 6 / 7 : JBoss Web Server (RHSA-2016:0061)	Nessus	Red Hat Local Security Checks	2016/1/22	2019/10/24	medium
87457	RHEL 6 : JBoss Web Server (RHSA-2015:2659)	Nessus	Red Hat Local Security Checks	2015/12/17	2021/2/5	medium
81581	Fedora 20 : httpd-2.4.10-2.fc20 (2014-17153)	Nessus	Fedora Local Security Checks	2015/3/2	2021/1/11	medium
81755	Ubuntu 14.04 LTS : Apache HTTP Server vulnerabilities (USN-2523-1)	Nessus	Ubuntu Local Security Checks	2015/3/11	2025/9/3	high
77531	Apache 2.2.x < 2.2.28 Multiple Vulnerabilities	Nessus	Web Servers	2014/9/4	2020/4/27	high
80398	IBM WebSphere Application Server 8.5 < Fix Pack 8.5.5.4 Multiple Vulnerabilities (POODLE)	Nessus	Web Servers	2015/1/7	2019/11/25	medium

检测

插件搜索

medium

medium

medium

critical

high

medium

high

medium

medium

medium

high

high

medium