The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0717 advisory.

    IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

    This update upgrades IBM Java SE 8 to version 8 SR6-FP25.

    Security Fix(es):

    * IBM JDK: Stack-based buffer overflow when converting from UTF-8 characters to platform encoding     (CVE-2020-27221)

    * OpenJDK: Unexpected exceptions raised by DOMKeyInfoFactory and DOMXMLSignatureFactory (Security,     8231415) (CVE-2020-2773)

    * OpenJDK: Credentials sent over unencrypted LDAP connection (JNDI, 8237990) (CVE-2020-14781)

    * OpenJDK: Certificate blacklist bypass via alternate certificate encodings (Libraries, 8237995)     (CVE-2020-14782)

    * OpenJDK: Race condition in NIO Buffer boundary checks (Libraries, 8244136) (CVE-2020-14803)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4306 advisory.

    The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: Credentials sent over unencrypted LDAP connection (JNDI, 8237990) (CVE-2020-14781)

    * OpenJDK: Certificate blacklist bypass via alternate certificate encodings (Libraries, 8237995)     (CVE-2020-14782)

    * OpenJDK: Integer overflow leading to out-of-bounds access (Hotspot, 8241114) (CVE-2020-14792)

    * OpenJDK: Incomplete check for invalid characters in URI to path conversion (Libraries, 8242685)     (CVE-2020-14797)

    * OpenJDK: Race condition in NIO Buffer boundary checks (Libraries, 8244136) (CVE-2020-14803)

    * OpenJDK: High memory usage during deserialization of Proxy class with many interfaces (Serialization,     8236862) (CVE-2020-14779)

    * OpenJDK: Missing permission check in path to URI conversion (Libraries, 8242680) (CVE-2020-14796)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * java-11-openjdk property java.vendor is N/A (BZ#1873389)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4350 advisory.

    [1:1.8.0.272.b10-1]
    - Add backport of JDK-8215727: 'Restore JFR thread sampler loop to old / previous behaviour'
    - Resolves: rhbz#1876665

    [1:1.8.0.272.b10-0]
    - Update to aarch64-shenandoah-jdk8u272-b10.
    - Switch to GA mode for final release.
    - Update release notes for 8u272 release.
    - Add backport of JDK-8254177 to update to tzdata 2020b
    - Require tzdata 2020b due to resource changes in JDK-8254177
    - Delay tzdata 2020b dependency until tzdata update has shipped.
    - Adjust JDK-8062808/PR3548 following constantPool.hpp context change in JDK-8243302
    - Adjust PR3593 following g1StringDedupTable.cpp context change in JDK-8240124 & JDK-8244955
    - This tarball is embargoed until 2020-10-20 @ 1pm PT.
    - Resolves: rhbz#1876665

    [1:1.8.0.272.b09-0.1.ea]
    - Include a test in the RPM to check the build has the correct vendor information.
    - Use 'oj_' prefix on new vendor globals to avoid a conflict with RPM's vendor value.
    - Improve quoting of vendor name
    - Resolves: rhbz#1876665

    [1:1.8.0.272.b09-0.1.ea]
    - Set vendor property and vendor URLs
    - Made URLs to be preconfigured by OS
    - Resolves: rhbz#1876665

    [1:1.8.0.272.b09-0.0.ea]
    - Update to aarch64-shenandoah-jdk8u272-b09 (EA).
    - Resolves: rhbz#1876665

    [1:1.8.0.272.b08-0.0.ea]
    - Update to aarch64-shenandoah-jdk8u272-b08 (EA).
    - Resolves: rhbz#1876665

    [1:1.8.0.272.b07-0.0.ea]
    - Update to aarch64-shenandoah-jdk8u272-b07.
    - Resolves: rhbz#1876665

    [1:1.8.0.272.b06-0.0.ea]
    - Update to aarch64-shenandoah-jdk8u272-b06.
    - Update tarball generation script to use PR3799, following inclusion of JDK-8245468 (TLSv1.3)
    - Resolves: rhbz#1876665

    [1:1.8.0.272.b05-0.2.ea]
    - Enable JFR on x86, now we have JDK-8252096: Shenandoah: adjust SerialPageShiftCount for x86_32 and JFR
    - Resolves: rhbz#1876665

    [1:1.8.0.272.b05-0.1.ea]
    - Update to aarch64-shenandoah-jdk8u272-b05-shenandoah-merge-2020-08-28.
    - Add additional s390 log2_intptr case in shenandoahUtils.cpp introduced by JDK-8245464
    - Resolves: rhbz#1876665

    [1:1.8.0.272.b05-0.0.ea]
    - Update to aarch64-shenandoah-jdk8u272-b05.
    - Fix context in JDK-8186464/RH1433262 patch, following JDK-8078334 @randomness tag addition.
    - Add additional s390 size_t case in g1ConcurrentMarkObjArrayProcessor.cpp introduced by JDK-8057003
    - Resolves: rhbz#1876665

    [1:1.8.0.272.b04-0.0.ea]
    - Update to aarch64-shenandoah-jdk8u272-b04.
    - Update tarball generation script to use PR3795, following inclusion of JDK-8177334
    - Resolves: rhbz#1876665

    [1:1.8.0.272.b03-0.0.ea]
    - Update to aarch64-shenandoah-jdk8u272-b03.
    - Resolves: rhbz#1876665

    [1:1.8.0.272.b02-0.0.ea]
    - Update to aarch64-shenandoah-jdk8u272-b02.
    - Remove JDK-8154313 backport now applied upstream.
    - Change target from 'zip-docs' to 'docs-zip', which is the naming used upstream.
    - Resolves: rhbz#1876665

    [1:1.8.0.272.b01-0.1.ea]
    - Update to aarch64-shenandoah-jdk8u272-b01.
    - Switch to EA mode.
    - Add debugging output for build.
    - JFR must now be explicitly disabled when unwanted (e.g. x86), following switch of upstream default.
    - Remove ZipConstants change from JDK-8186464 backport, now provided upstream by JDK-8075774
    - Resolves: rhbz#1876665

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - OpenJDK: Credentials sent over unencrypted LDAP     connection (JNDI, 8237990) (CVE-2020-14781)

  - OpenJDK: Certificate blacklist bypass via alternate     certificate encodings (Libraries, 8237995)     (CVE-2020-14782)

  - OpenJDK: Integer overflow leading to out-of-bounds     access (Hotspot, 8241114) (CVE-2020-14792)

  - OpenJDK: Incomplete check for invalid characters in URI     to path conversion (Libraries, 8242685) (CVE-2020-14797)

  - OpenJDK: Race condition in NIO Buffer boundary checks     (Libraries, 8244136) (CVE-2020-14803)

  - OpenJDK: High memory usage during deserialization of     Proxy class with many interfaces (Serialization,     8236862) (CVE-2020-14779)

  - OpenJDK: Missing permission check in path to URI     conversion (Libraries, 8242680) (CVE-2020-14796)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.272.b10-1.56. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1460 advisory.

    Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization).
    Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
    Note: Applies to client and server deployment of Java. This vulnerability can be exploited through     sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying     data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed     Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2020-14779)

    Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JNDI). Supported     versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server     deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web     service. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). (CVE-2020-14781)

    Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported     versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: Applies to     client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start     applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the     specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as     through a web service. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). (CVE-2020-14782)

    Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Hotspot). Supported     versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other     than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or     delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to     a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of     Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java     applets. It can also be exploited by supplying data to APIs in the specified Component without using     sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1     Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N). (CVE-2020-14792)

    Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported     versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other     than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a     subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability does not apply to Java deployments, typically in servers, that load and run     only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Confidentiality     impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N). (CVE-2020-14796)

    Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported     versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: Applies to     client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start     applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the     specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as     through a web service. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). (CVE-2020-14797)

    Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are     affected are Java SE: 11.0.8 and 15. Easily exploitable vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can     result in unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in     servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base     Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
    (CVE-2020-14803)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the java-1.8.0-openjdk packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: Hotspot). Supported     versions that are affected are Java SE: 7u271, 8u261,     11.0.8 and 15 Java SE Embedded: 8u261. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful     attacks require human interaction from a person other     than the attacker. Successful attacks of this     vulnerability can result in unauthorized update, insert     or delete access to some of Java SE, Java SE Embedded     accessible data as well as unauthorized read access to     a subset of Java SE, Java SE Embedded accessible     data.(CVE-2020-14792)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: Serialization). Supported     versions that are affected are Java SE: 7u271, 8u261,     11.0.8 and 15 Java SE Embedded: 8u261. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful     attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of     service (partial DOS) of Java SE, Java SE     Embedded.(CVE-2020-14779)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: JNDI). Supported versions     that are affected are Java SE: 7u271, 8u261, 11.0.8 and     15 Java SE Embedded: 8u261. Difficult to exploit     vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise     Java SE, Java SE Embedded. Successful attacks of this     vulnerability can result in unauthorized read access to     a subset of Java SE, Java SE Embedded accessible     data.(CVE-2020-14781)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: Libraries). Supported     versions that are affected are Java SE: 7u271, 8u261,     11.0.8 and 15 Java SE Embedded: 8u261. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful     attacks require human interaction from a person other     than the attacker. Successful attacks of this     vulnerability can result in unauthorized read access to     a subset of Java SE, Java SE Embedded accessible     data.(CVE-2020-14796)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: Libraries). Supported     versions that are affected are Java SE: 7u271, 8u261,     11.0.8 and 15 Java SE Embedded: 8u261. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful     attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of     Java SE, Java SE Embedded accessible     data.(CVE-2020-14797)

  - Vulnerability in the Java SE product of Oracle Java SE     (component: Libraries). Supported versions that are     affected are Java SE: 11.0.8 and 15. Easily exploitable     vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise     Java SE. Successful attacks of this vulnerability can     result in unauthorized read access to a subset of Java     SE accessible data.(CVE-2020-14803)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: Libraries). Supported     versions that are affected are Java SE: 7u271, 8u261,     11.0.8 and 15 Java SE Embedded: 8u261. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful     attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of     Java SE, Java SE Embedded accessible     data.(CVE-2020-14782)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5586 advisory.

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization).
    Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
    Note: Applies to client and server deployment of Java. This vulnerability can be exploited through     sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying     data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed     Java applets, such as through a web service. (CVE-2020-14779)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JNDI). Supported     versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server     deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web     service. (CVE-2020-14781)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported     versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: Applies to     client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start     applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the     specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as     through a web service. (CVE-2020-14782, CVE-2020-14797)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported     versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other     than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a     subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability does not apply to Java deployments, typically in servers, that load and run     only trusted code (e.g., code installed by an administrator). (CVE-2020-14796)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2020-784:09 advisory.

    * OpenJDK: Credentials sent over unencrypted LDAP connection (JNDI, 8237990) (CVE-2020-14781)
      * OpenJDK: Certificate blacklist bypass via alternate certificate encodings (Libraries, 8237995)     (CVE-2020-14782)
      * OpenJDK: Integer overflow leading to out-of-bounds access (Hotspot, 8241114) (CVE-2020-14792)
      * OpenJDK: Incomplete check for invalid characters in URI to path conversion (Libraries, 8242685)     (CVE-2020-14797)
      * OpenJDK: Race condition in NIO Buffer boundary checks (Libraries, 8244136) (CVE-2020-14803)
      * OpenJDK: High memory usage during deserialization of Proxy class with many interfaces (Serialization,     8236862) (CVE-2020-14779)
      * OpenJDK: Missing permission check in path to URI conversion (Libraries, 8242680) (CVE-2020-14796)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 5.19.1. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.19.1 advisory.

  - In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length     checks. In cases where the application calling the library did not perform a sanity check on the inputs it     could result in a crash due to a buffer overflow. (CVE-2019-17006)

  - Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. (CVE-2019-5482)

  - In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives.
    When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may     contain files with permissions the attacker did not have or in paths he did not have access to. Extracting     those archives from a high-privilege user without carefully reviewing them may lead to the compromise of     the system. (CVE-2019-14866)

  - If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to     8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the     HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP     headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This     could lead to users seeing responses for unexpected resources. (CVE-2020-13943)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported     versions that are affected are 5.6.45 and prior, 5.7.27 and prior and 8.0.17 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2019-2974)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
147140	RHEL 7 : java-1.8.0-ibm (RHSA-2021:0717)	Nessus	Red Hat Local Security Checks	2021/3/5	2024/11/7	critical
141811	RHEL 8 : java-11-openjdk (RHSA-2020:4306)	Nessus	Red Hat Local Security Checks	2020/10/22	2024/11/7	medium
141933	Oracle Linux 7 : java-1.8.0-openjdk (ELSA-2020-4350)	Nessus	Oracle Linux Local Security Checks	2020/10/27	2024/11/1	medium
142014	Scientific Linux Security Update : java-1.8.0-openjdk on SL7.x x86_64 (20201027)	Nessus	Scientific Linux Local Security Checks	2020/10/28	2024/2/13	medium
143168	openSUSE Security Update : java-11-openjdk (openSUSE-2020-1994)	Nessus	SuSE Local Security Checks	2020/11/23	2024/2/8	medium
143292	openSUSE Security Update : java-1_8_0-openjdk (openSUSE-2020-2083)	Nessus	SuSE Local Security Checks	2020/11/30	2024/2/8	high
143318	openSUSE Security Update : java-1_8_0-openjdk (openSUSE-2020-2048)	Nessus	SuSE Local Security Checks	2020/11/30	2024/2/7	high
143712	SUSE SLED15 / SLES15 Security Update : java-11-openjdk (SUSE-SU-2020:3359-1)	Nessus	SuSE Local Security Checks	2020/12/9	2022/12/5	medium
145003	Amazon Linux AMI : java-1.8.0-openjdk (ALAS-2021-1460)	Nessus	Amazon Linux Local Security Checks	2021/1/14	2024/12/11	medium
146108	EulerOS 2.0 SP5 : java-1.8.0-openjdk (EulerOS-SA-2021-1198)	Nessus	Huawei Local Security Checks	2021/2/4	2022/12/5	medium
208568	CentOS 7 : java-1.7.1-ibm (RHSA-2020:5586)	Nessus	CentOS Local Security Checks	2024/10/9	2024/10/9	low
294562	MiracleLinux 8 : java-11-openjdk-11.0.9.11-0.el8 (AXSA:2020-784:09)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/21	medium
164584	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.19.1)	Nessus	Misc.	2022/9/1	2025/7/22	critical

检测

插件搜索

critical

medium

medium

medium

medium

high

high

medium

medium

medium

low

medium

critical