The remote host is running a version of macOS / Mac OS X that is prior to 10.15. It is, therefore, affected by multiple vulnerabilities. 

  - An application may be able to execute arbitrary code with kernel privileges (CVE-2019-8748)

  - Multiple issues in PHP (CVE-2019-11041, CVE-2019-11042)

  - Processing a maliciously crafted movie may result in the disclosure of process memory (CVE-2019-8705)

  - The 'Share Mac Analytics' setting may not be disabled when a user deselects the switch to share analytics (CVE-2019-8757)

  - An application may be able to execute arbitrary code with system privileges (CVE-2019-8758)

  - A malicious application may be able to determine kernel memory layout (CVE-2019-8755)

  - An application may be able to execute arbitrary code with kernel privileges (CVE-2019-8717)

  - An application may be able to execute arbitrary code with kernel privileges (CVE-2019-8781)

  - A local user may be able to view a user's locked notes (CVE-2019-8730)

  - An attacker may be able to exfiltrate the contents of an encrypted PDF (CVE-2019-8772)

  - A malicious application may be able to access recent documents (CVE-2019-8770)

  - An application may be able to execute arbitrary code with system privileges (CVE-2019-8701)

  - Processing a maliciously crafted text file may lead to arbitrary code execution (CVE-2019-8745)

  - Visiting a maliciously crafted website may reveal browsing history (CVE-2019-8769)

  - A user may be unable to delete browsing history items (CVE-2019-8768)

Note that Nessus has not tested for this issue but has instead relied only on the operating system's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-3662 advisory.

    php     [7.3.20-1]
    - update to 7.3.20 #1856655

    php-pear     [1:1.10.9-1]
    - update PEAR to 1.10.9
    - update Archive_Tar to 1.4.7
    - update Console_Getopt to 1.4.2

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP running on the   remote web server is 7.4.x prior to 7.4.0. It is, therefore, affected by multiple vulnerabilities including a buffer   overflow

When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.(CVE-2019-11042)

When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.(CVE-2019-11041)

Two heap buffer overflows were found in the EXIF parsing code of PHP, a widely-used open source general purpose scripting language.

For Debian 8 'Jessie', these problems have been fixed in version 5.6.40+dfsg-0+deb8u5.

We recommend that you upgrade your php5 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of PHP running on the remote web server is 7.2.x prior to 7.2.21. It is, therefore, affected by buffer overflow vulnerabilities in exif_read_data and exif_scan_thumbnail functions.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:3662 advisory.

  - php: Out-of-bounds read due to integer overflow in iconv_mime_decode_headers() (CVE-2019-11039)

  - php: Buffer over-read in exif_read_data() (CVE-2019-11040)

  - php: Heap buffer over-read in exif_scan_thumbnail() (CVE-2019-11041)

  - php: Heap buffer over-read in exif_process_user_comment() (CVE-2019-11042)

  - php: DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at     that byte (CVE-2019-11045)

  - php: Information disclosure in exif_read_data() (CVE-2019-11047)

  - php: Integer wraparounds when receiving multipart forms (CVE-2019-11048)

  - php: Out of bounds read when parsing EXIF information (CVE-2019-11050)

  - oniguruma: Use-after-free in onig_new_deluxe() in regext.c (CVE-2019-13224)

  - oniguruma: NULL pointer dereference in match_at() in regexec.c (CVE-2019-13225)

  - oniguruma: Stack exhaustion in regcomp.c because of recursion in regparse.c (CVE-2019-16163)

  - oniguruma: Heap-based buffer over-read in function gb18030_mbc_enc_len in file gb18030.c (CVE-2019-19203)

  - oniguruma: Heap-based buffer over-read in function fetch_interval_quantifier in regparse.c     (CVE-2019-19204)

  - oniguruma: Heap-based buffer overflow in str_lower_case_match in regexec.c (CVE-2019-19246)

  - pcre: Out of bounds read in JIT mode when \X is used in non-UTF mode (CVE-2019-20454)

  - php: Out of bounds read in php_strip_tags_ex (CVE-2020-7059)

  - php: Global buffer-overflow in mbfl_filt_conv_big5_wchar function (CVE-2020-7060)

  - php: NULL pointer dereference in PHP session upload progress (CVE-2020-7062)

  - php: Files added to tar with Phar::buildFromIterator have all-access permissions (CVE-2020-7063)

  - php: Information disclosure in exif_read_data() function (CVE-2020-7064)

  - php: Using mb_strtolower() function with UTF-32LE encoding leads to potential code execution     (CVE-2020-7065)

  - php: Information disclosure in function get_headers (CVE-2020-7066)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2020_3662 advisory.

    * php: Out-of-bounds read due to integer overflow in iconv_mime_decode_headers() (CVE-2019-11039)

    * php: Buffer over-read in exif_read_data() (CVE-2019-11040)

    * php: DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at     that byte (CVE-2019-11045)

    * php: Information disclosure in exif_read_data() (CVE-2019-11047)

    * php: Integer wraparounds when receiving multipart forms (CVE-2019-11048)

    * oniguruma: Use-after-free in onig_new_deluxe() in regext.c (CVE-2019-13224)

    * oniguruma: NULL pointer dereference in match_at() in regexec.c (CVE-2019-13225)

    * oniguruma: Stack exhaustion in regcomp.c because of recursion in regparse.c (CVE-2019-16163)

    * oniguruma: Heap-based buffer over-read in function gb18030_mbc_enc_len in file gb18030.c     (CVE-2019-19203)

    * oniguruma: Heap-based buffer over-read in function fetch_interval_quantifier in regparse.c     (CVE-2019-19204)

    * pcre: Out of bounds read in JIT mode when \X is used in non-UTF mode (CVE-2019-20454)

    * php: Out of bounds read in php_strip_tags_ex (CVE-2020-7059)

    * php: Global buffer-overflow in mbfl_filt_conv_big5_wchar function (CVE-2020-7060)

    * php: NULL pointer dereference in PHP session upload progress (CVE-2020-7062)

    * php: Files added to tar with Phar::buildFromIterator have all-access permissions (CVE-2020-7063)

    * php: Information disclosure in exif_read_data() function (CVE-2020-7064)

    * php: Using mb_strtolower() function with UTF-32LE encoding leads to potential code execution     (CVE-2020-7065)

    * php: Heap buffer over-read in exif_scan_thumbnail() (CVE-2019-11041)

    * php: Heap buffer over-read in exif_process_user_comment() (CVE-2019-11042)

    * php: Out of bounds read when parsing EXIF information (CVE-2019-11050)

    * oniguruma: Heap-based buffer overflow in str_lower_case_match in regexec.c (CVE-2019-19246)

    * php: Information disclosure in function get_headers (CVE-2020-7066)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Tenable SecurityCenter application installed on the remote host is less than 5.19.0 and is therefore affected by multiple vulnerabilities in the following components: 
  - Apache FOP
  - Underscore
  - Handlebars
  - PHP
  - sqlite

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
130057	macOS < 10.15 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	2019/10/18	2024/5/28	high
140482	Oracle Linux 8 : php:7.3 (ELSA-2020-3662)	Nessus	Oracle Linux Local Security Checks	2020/9/10	2024/11/1	critical
131732	PHP 7.4.x < 7.4.0 Multiple Vulnerabilities.	Nessus	CGI abuses	2019/12/6	2025/5/26	critical
137966	EulerOS Virtualization 3.0.6.0 : php (EulerOS-SA-2020-1747)	Nessus	Huawei Local Security Checks	2020/7/1	2023/4/25	critical
129011	Amazon Linux AMI : php72 (ALAS-2019-1284)	Nessus	Amazon Linux Local Security Checks	2019/9/19	2024/4/24	high
127820	Debian DLA-1878-1 : php5 security update	Nessus	Debian Local Security Checks	2019/8/13	2024/5/6	high
127131	PHP 7.2.x < 7.2.21 Multiple Vulnerabilities.	Nessus	CGI abuses	2019/8/12	2025/5/26	high
145957	CentOS 8 : php:7.3 (CESA-2020:3662)	Nessus	CentOS Local Security Checks	2021/2/1	2024/1/24	critical
358880	Rocky Linux 8 [CIQ] Security Update: apcu-panel / libzip / libzip-debuginfo / libzip-debugsource / etc Multiple Vulnerabilities (crlsa-2020_3662)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/2	critical
152986	Tenable SecurityCenter < 5.19.0 Multiple Vulnerabilities (TNS-2021-14)	Nessus	Misc.	2021/9/3	2024/5/10	critical

检测

插件搜索

high

critical

critical

critical

high

high

high

critical

critical

critical