The version of AOS installed on the remote host is prior to 5.16.1.3. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.16.1.3 advisory.

  - When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to     Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP     connection. If such connections are available to an attacker, they can be exploited in ways that may be     surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped     with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected     (and recommended in the security guide) that this Connector would be disabled if not required. This     vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the     web application - processing any file in the web application as a JSP Further, if the web application     allowed file upload and stored those files within the web application (or the attacker was able to control     the content of the web application by some other means) then this, along with the ability to process a     file as a JSP, made remote code execution possible. It is important to note that mitigation is only     required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth     approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to     Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP     Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading     to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.
    (CVE-2020-1938)

  - rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel through 5.3.6 lacks a     certain upper-bound check, leading to a buffer overflow. (CVE-2019-17666)

  - The Linux kernel before 5.1-rc5 allows page->_refcount reference count overflow, with resultant use-after-     free issues, if about 140 GiB of RAM exists. This is related to fs/fuse/dev.c, fs/pipe.c, fs/splice.c,     include/linux/mm.h, include/linux/pipe_fs_i.h, kernel/trace/trace.c, mm/gup.c, and mm/hugetlb.c. It can     occur with FUSE requests. (CVE-2019-11487)

  - A flaw was found in the fix for CVE-2019-11135, in the Linux upstream kernel versions before 5.5 where,     the way Intel CPUs handle speculative execution of instructions when a TSX Asynchronous Abort (TAA) error     occurs. When a guest is running on a host CPU affected by the TAA flaw (TAA_NO=0), but is not affected by     the MDS issue (MDS_NO=1), the guest was to clear the affected buffers by using a VERW instruction     mechanism. But when the MDS_NO=1 bit was exported to the guests, the guests did not use the VERW mechanism     to clear the affected buffers. This issue affects guests running on Cascade Lake CPUs and requires that     host has 'TSX' enabled. Confidentiality of data is the highest threat associated with this vulnerability.
    (CVE-2019-19338)

  - The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon     receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover     credentials by sniffing the network. (CVE-2018-18074)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle Business Process Management Suite installed on the remote host is affected by the following vulnerabilities as referenced in the January 2021 CPU advisory:

  - An XML External Entity (XXE) vulnerability exists in the dom4j library which allows DTDs and external     entities by default. An unauthenticated, remote attacker can exploit this issue, to compromise the server.
    Successful attacks of this vulnerability can result in takeover of Oracle Business Process Management     Suite. (CVE-2020-10683)

  - A deserialization flaw exists in the Oracle BAM (Business Activity Monitoring) product of Oracle     Fusion Middleware (component: General (Xstream)) due to the introduction of a regression for a previous     deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker     to run arbitrary shell commands when unmarshalling XML or any supported format. (CVE-2019-10173)

  - A denial of service (DoS) vulnerability exists in the Oracle Managed File Transfer product of Oracle     Fusion Middleware (component: MFT Runtime Server (Apache Tomcat)) due to improper validation of the     payload length in a WebSocket frame. An unauthenticated, remote attacker can exploit this issue to     trigger an infinite loop and cause a hang or frequently repeatable crash of Oracle Managed File Transfer.
    (CVE-2020-13935)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

The version of tomcat installed on the remote host is prior to 7.0.76-10. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2047 advisory.

    A privilege escalation flaw was found in Tomcat when the JMX Remote Lifecycle Listener was enabled. A     local attacker without access to the Tomcat process or configuration files could be able to manipulate the     RMI registry to perform a man-in-the-middle attack. The attacker could then capture user names and     passwords used to access the JMX interface and gain complete control over the Tomcat instance.
    (CVE-2019-12418)

    When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98     there was a narrow window where an attacker could perform a session fixation attack. The window was     considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has     been treated as a security vulnerability. (CVE-2019-17563)

    A flaw was found in Apache Tomcat, where the payload length in a WebSocket frame was not correctly     validated. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload     lengths could lead to a denial of service. The highest threat from this vulnerability is to system     availability. (CVE-2020-13935)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities were discovered in the Tomcat servlet and JSP engine, which could result in code execution or denial of service.

Several security vulnerabilities have been discovered in the Tomcat servlet and JSP engine.

CVE-2020-13934

An h2c direct connection to Apache Tomcat did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service.

CVE-2020-13935

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat. Invalid payload lengths could trigger an infinite loop.
Multiple requests with invalid payload lengths could lead to a denial of service.

For Debian 9 stretch, these problems have been fixed in version 8.5.54-0+deb9u3.

We recommend that you upgrade your tomcat8 packages.

For the detailed security status of tomcat8 please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/tomcat8

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Apache Software Foundation reports :

An h2c direct connection did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service.

The payload length in a WebSocket frame was not correctly validated.
Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.

A specially crafted sequence of HTTP/2 requests could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.

This update for tomcat fixes the following issues :

  - Fixed CVEs :

  - CVE-2020-13934 (bsc#1174121)

  - CVE-2020-13935 (bsc#1174117)

This update was imported from the SUSE:SLE-15-SP1:Update update project.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4004 advisory.

    Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

    Security Fix(es):

    * tomcat: multiple requests with invalid payload length in a WebSocket frame could lead to DoS     (CVE-2020-13935)

    * tomcat: session fixation when using FORM authentication (CVE-2019-17563)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - tomcat: multiple requests with invalid payload length in     a WebSocket frame could lead to DoS (CVE-2020-13935)

  - tomcat: session fixation when using FORM authentication     (CVE-2019-17563)

The remote Redhat Enterprise Linux 5 / 6 / 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:3383 advisory.

    Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss     Application Server.

    This asynchronous patch is an update for JBoss Enterprise Application Platform 6.4 for Red Hat Enterprise     Linux 5, 6, and 7. All users of Red Hat JBoss Enterprise Application Platform 6.4 are advised to upgrade     to this updated package.

    Security Fix(es):

    * jbossweb: tomcat: multiple requests with invalid payload length in a WebSocket frame could lead to DoS     (CVE-2020-13935)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, see the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5460 advisory.

    Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on the WildFly     application runtime.

    This release of Red Hat JBoss Enterprise Application Platform 6.4.24 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 6.4.23 and includes bug fixes and enhancements. See the Red Hat     JBoss Enterprise Application Platform 6.4.24 Release Notes for information about the most significant bug     fixes and enhancements included in this release.

    Security Fix(es):

    * tomcat: multiple requests with invalid payload length in a WebSocket frame could lead to DoS     (CVE-2020-13935)

    * jbossweb: Incomplete fix of CVE-2020-13935 for WebSocket in JBossWeb could lead to DoS (CVE-2020-14384)

    * log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender (CVE-2022-23305)

    * log4j: Unsafe deserialization flaw in Chainsaw log viewer (CVE-2022-23307)

    * log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender     (CVE-2021-4104)

    * log4j: Remote code execution in Log4j 1.x when application is configured to use JMSSink (CVE-2022-23302)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of tomcat installed on the remote host is prior to 8.5.87-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2TOMCAT8.5-2023-013 advisory.

    A privilege escalation flaw was found in Tomcat when the JMX Remote Lifecycle Listener was enabled. A     local attacker without access to the Tomcat process or configuration files could be able to manipulate the     RMI registry to perform a man-in-the-middle attack. The attacker could then capture user names and     passwords used to access the JMX interface and gain complete control over the Tomcat instance.
    (CVE-2019-12418)

    When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98     there was a narrow window where an attacker could perform a session fixation attack. The window was     considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has     been treated as a security vulnerability. (CVE-2019-17563)

    A flaw was found in Apache Tomcat, where the payload length in a WebSocket frame was not correctly     validated. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload     lengths could lead to a denial of service. The highest threat from this vulnerability is to system     availability. (CVE-2020-13935)

    The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to     Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug in Apache     Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.0.0-M1 to 9.0.60 and 8.5.0 to 8.5.77 that could cause     client connections to share an Http11Processor instance resulting in responses, or part responses, to be     received by the wrong client. (CVE-2021-43980)

    The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape     the type, message or description values. In some circumstances these are constructed from user provided     data and it was therefore possible for users to supply values that invalidated or manipulated the JSON     output. (CVE-2022-45143)

    Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting     in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note     that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is     not enabled by default and must be explicitly configured. (CVE-2023-24998)

    When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the     X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2,     10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This     could result in the user agent transmitting the session cookie over an insecure channel. (CVE-2023-28708)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 5.18. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.18 advisory.

  - When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to     Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP     connection. If such connections are available to an attacker, they can be exploited in ways that may be     surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped     with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected     (and recommended in the security guide) that this Connector would be disabled if not required. This     vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the     web application - processing any file in the web application as a JSP Further, if the web application     allowed file upload and stored those files within the web application (or the attacker was able to control     the content of the web application by some other means) then this, along with the ability to process a     file as a JSP, made remote code execution possible. It is important to note that mitigation is only     required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth     approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to     Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP     Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading     to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.
    (CVE-2020-1938)

  - rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel through 5.3.6 lacks a     certain upper-bound check, leading to a buffer overflow. (CVE-2019-17666)

  - The Linux kernel before 5.1-rc5 allows page->_refcount reference count overflow, with resultant use-after-     free issues, if about 140 GiB of RAM exists. This is related to fs/fuse/dev.c, fs/pipe.c, fs/splice.c,     include/linux/mm.h, include/linux/pipe_fs_i.h, kernel/trace/trace.c, mm/gup.c, and mm/hugetlb.c. It can     occur with FUSE requests. (CVE-2019-11487)

  - A flaw was found in the fix for CVE-2019-11135, in the Linux upstream kernel versions before 5.5 where,     the way Intel CPUs handle speculative execution of instructions when a TSX Asynchronous Abort (TAA) error     occurs. When a guest is running on a host CPU affected by the TAA flaw (TAA_NO=0), but is not affected by     the MDS issue (MDS_NO=1), the guest was to clear the affected buffers by using a VERW instruction     mechanism. But when the MDS_NO=1 bit was exported to the guests, the guests did not use the VERW mechanism     to clear the affected buffers. This issue affects guests running on Cascade Lake CPUs and requires that     host has 'TSX' enabled. Confidentiality of data is the highest threat associated with this vulnerability.
    (CVE-2019-19338)

  - The xz_decomp function in xzlib.c in libxml2 2.9.1 does not properly detect compression errors, which     allows context-dependent attackers to cause a denial of service (process hang) via crafted XML data.
    (CVE-2015-8035)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
164582	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.16.1.3)	Nessus	Misc.	2022/9/1	2025/2/17	critical
145246	Oracle Business Process Management Suite (Jan 2021 CPU)	Nessus	Misc.	2021/1/22	2022/12/5	critical
175945	Amazon Linux 2 : tomcat (ALAS-2023-2047)	Nessus	Amazon Linux Local Security Checks	2023/5/17	2024/12/11	high
138647	Debian DSA-4727-1 : tomcat9 - security update	Nessus	Debian Local Security Checks	2020/7/20	2022/12/6	high
138859	Debian DLA-2286-1 : tomcat8 security update	Nessus	Debian Local Security Checks	2020/7/23	2024/2/29	high
138923	FreeBSD : Apache Tomcat -- Multiple Vulnerabilities (6a72eff7-ccd6-11ea-9172-4c72b94353b5)	Nessus	FreeBSD Local Security Checks	2020/7/27	2024/2/28	high
139021	openSUSE Security Update : tomcat (openSUSE-2020-1102)	Nessus	SuSE Local Security Checks	2020/7/28	2024/2/28	high
141038	RHEL 7 : tomcat (RHSA-2020:4004)	Nessus	Red Hat Local Security Checks	2020/9/29	2024/11/8	high
141699	Scientific Linux Security Update : tomcat on SL7.x x86_64 (20201001)	Nessus	Scientific Linux Local Security Checks	2020/10/21	2024/2/14	high
139460	RHEL 5 / 6 / 7 : Red Hat JBoss Enterprise Application Platform 6.4 (RHSA-2020:3383)	Nessus	Red Hat Local Security Checks	2020/8/10	2024/11/7	high
162638	RHEL 7 : Red Hat JBoss Enterprise Application Platform 6.4.24 (RHSA-2022:5460)	Nessus	Red Hat Local Security Checks	2022/7/1	2024/11/7	critical
181934	Amazon Linux 2 : tomcat (ALASTOMCAT8.5-2023-013)	Nessus	Amazon Linux Local Security Checks	2023/9/27	2024/12/11	high
164595	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.18)	Nessus	Misc.	2022/9/1	2025/9/1	critical

检测

插件搜索

critical

critical

high

high

high

high

high

high

high

high

critical

high

critical