The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2021-2247:11 advisory.

    * OpenJDK: Incorrect comparison during range check elimination (Hotspot, 8264066) (CVE-2021-2388)
      * OpenJDK: FTP PASV command response can cause FtpClient to connect to arbitrary host (Networking,     8258432) (CVE-2021-2341)
      * OpenJDK: Incorrect verification of JAR files with multiple MANIFEST.MF files (Library, 8260967)     (CVE-2021-2369)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.302.b08-0.67. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1528 advisory.

    Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Networking). Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle     GraalVM Enterprise Edition: 20.3.2 and 21.1.0. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise     Edition. Successful attacks require human interaction from a person other than the attacker. Successful     attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Oracle     GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability does not apply to Java deployments, typically in servers, that load and run     only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Confidentiality     impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N). (CVE-2021-2341)

    Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Library). Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle GraalVM     Enterprise Edition: 20.3.2 and 21.1.0. Easily exploitable vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition.
    Successful attacks require human interaction from a person other than the attacker. Successful attacks of     this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Oracle     GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability does not apply to Java deployments, typically in servers, that load and run     only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 4.3 (Integrity impacts).
    CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N). (CVE-2021-2369)

    Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Hotspot). Supported versions that are affected are Java SE: 8u291, 11.0.11, 16.0.1; Oracle GraalVM     Enterprise Edition: 20.3.2 and 21.1.0. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition.
    Successful attacks require human interaction from a person other than the attacker. Successful attacks of     this vulnerability can result in takeover of Java SE, Oracle GraalVM Enterprise Edition. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS     Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). (CVE-2021-2388)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3292 advisory.

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Networking). Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle     GraalVM Enterprise Edition: 20.3.2 and 21.1.0. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise     Edition. Successful attacks require human interaction from a person other than the attacker. Successful     attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Oracle     GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability does not apply to Java deployments, typically in servers, that load and run     only trusted code (e.g., code installed by an administrator). (CVE-2021-2341)

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Library). Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle GraalVM     Enterprise Edition: 20.3.2 and 21.1.0. Easily exploitable vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition.
    Successful attacks require human interaction from a person other than the attacker. Successful attacks of     this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Oracle     GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability does not apply to Java deployments, typically in servers, that load and run     only trusted code (e.g., code installed by an administrator). (CVE-2021-2369)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3293 advisory.

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Networking). Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle     GraalVM Enterprise Edition: 20.3.2 and 21.1.0. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise     Edition. Successful attacks require human interaction from a person other than the attacker. Successful     attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Oracle     GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability does not apply to Java deployments, typically in servers, that load and run     only trusted code (e.g., code installed by an administrator). (CVE-2021-2341)

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Library). Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle GraalVM     Enterprise Edition: 20.3.2 and 21.1.0. Easily exploitable vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition.
    Successful attacks require human interaction from a person other than the attacker. Successful attacks of     this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Oracle     GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability does not apply to Java deployments, typically in servers, that load and run     only trusted code (e.g., code installed by an administrator). (CVE-2021-2369)

  - Vulnerability in the Java SE product of Oracle Java SE (component: JNDI). The supported version that is     affected is Java SE: 7u301. Difficult to exploit vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using     APIs in the specified Component, e.g., through a web service which supplies data to the APIs.
    (CVE-2021-2432)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of java-11-openjdk installed on the remote host is prior to 11.0.12.0.7-0. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2JAVA-OPENJDK11-2025-011 advisory.

    Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Networking). Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle     GraalVM Enterprise Edition: 20.3.2 and 21.1.0. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise     Edition. Successful attacks require human interaction from a person other than the attacker. Successful     attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Oracle     GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability does not apply to Java deployments, typically in servers, that load and run     only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Confidentiality     impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N). (CVE-2021-2341)

    Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Library). Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle GraalVM     Enterprise Edition: 20.3.2 and 21.1.0. Easily exploitable vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition.
    Successful attacks require human interaction from a person other than the attacker. Successful attacks of     this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Oracle     GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability does not apply to Java deployments, typically in servers, that load and run     only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 4.3 (Integrity impacts).
    CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N). (CVE-2021-2369)

    Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Hotspot). Supported versions that are affected are Java SE: 8u291, 11.0.11, 16.0.1; Oracle GraalVM     Enterprise Edition: 20.3.2 and 21.1.0. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition.
    Successful attacks require human interaction from a person other than the attacker. Successful attacks of     this vulnerability can result in takeover of Java SE, Oracle GraalVM Enterprise Edition. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS     Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). (CVE-2021-2388)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:2781 advisory.

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Networking). Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle     GraalVM Enterprise Edition: 20.3.2 and 21.1.0. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise     Edition. Successful attacks require human interaction from a person other than the attacker. Successful     attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Oracle     GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability does not apply to Java deployments, typically in servers, that load and run     only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Confidentiality     impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N). (CVE-2021-2341)

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Library). Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle GraalVM     Enterprise Edition: 20.3.2 and 21.1.0. Easily exploitable vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition.
    Successful attacks require human interaction from a person other than the attacker. Successful attacks of     this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Oracle     GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability does not apply to Java deployments, typically in servers, that load and run     only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 4.3 (Integrity impacts).
    CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N). (CVE-2021-2369)

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Hotspot). Supported versions that are affected are Java SE: 8u291, 11.0.11, 16.0.1; Oracle GraalVM     Enterprise Edition: 20.3.2 and 21.1.0. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition.
    Successful attacks require human interaction from a person other than the attacker. Successful attacks of     this vulnerability can result in takeover of Java SE, Oracle GraalVM Enterprise Edition. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS     Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). (CVE-2021-2388)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-2776 advisory.

    [1:1.8.0.302.b08-0]
    - Update to aarch64-shenandoah-jdk8u302-b08 (EA)
    - Update release notes for 8u302-b08.
    - Switch to GA mode for final release.
    - This tarball is embargoed until 2021-07-20 @ 1pm PT.
    - Resolves: rhbz#1972395

    [1:1.8.0.302.b07-0.0.ea]
    - Update to aarch64-shenandoah-jdk8u302-b07 (EA)
    - Update release notes for 8u302-b07.
    - Switch to EA mode.
    - Cleanup architecture handling
    - Fixed not-including fastdebug build in case of --without fastdebug
    - Re-order source files to sync with Fedora.
    - Introduced nm based check to verify alt-java on x86_64 is patched, and no other alt-java or java is     patched
    - Patch600, rh1750419-redhat_alt_java.patch, amended to die, if it is used wrongly
    - Introduced ssbd_arches with currently only valid arch of x86_64 to separate real alt-java architectures
    - Use the 'reverse' build loop (debug first) as the main and only build loop to get more diagnostics.
    - Remove restriction on disabling product build, as debug packages no longer have javadoc packages.
    - Fix name of javadoc debug packages in Obsoletes declarations and add version where it was removed.
    - Resolves: rhbz#1972395

    [1:1.8.0.302.b07-0.0.ea]
    - Add a test verifying system crypto policies can be disabled
    - Resolves: rhbz#1972395

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2784 advisory.

    The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: Incorrect comparison during range check elimination (Hotspot, 8264066) (CVE-2021-2388)

    * OpenJDK: FTP PASV command response can cause FtpClient to connect to arbitrary host (Networking,     8258432) (CVE-2021-2341)

    * OpenJDK: Incorrect verification of JAR files with multiple MANIFEST.MF files (Library, 8260967)     (CVE-2021-2369)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:4089 advisory.

    IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

    This update upgrades IBM Java SE 8 to version 8 SR6-FP35.

    Security Fix(es):

    * OpenJDK: FTP PASV command response can cause FtpClient to connect to arbitrary host (Networking,     8258432) (CVE-2021-2341)

    * OpenJDK: Incorrect verification of JAR files with multiple MANIFEST.MF files (Library, 8260967)     (CVE-2021-2369)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the openjdk11 package has been released.

The remote SUSE Linux SLES11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:14875-1 advisory.

    - Update to Java 7.1 Service Refresh 5 Fix Pack 0
    - CVE-2021-41035: before version 0.29.0, the openj9 JVM does not throw IllegalAccessError for     MethodHandles that invoke inaccessible interface methods. (bsc#1194198, bsc#1192052)
    - CVE-2021-35586: Excessive memory allocation in BMPImageReader. (bsc#1191914)
    - CVE-2021-35564: Certificates with end dates too far in the future can corrupt keystore. (bsc#1191913)
    - CVE-2021-35559: Excessive memory allocation in RTFReader. (bsc#1191911)
    - CVE-2021-35556: Excessive memory allocation in RTFParser. (bsc#1191910)
    - CVE-2021-35565: Loop in HttpsServer triggered during TLS session close. (bsc#1191909)
    - CVE-2021-35588: Incomplete validation of inner class references in ClassFileParser. (bsc#1191905)
    - CVE-2021-2341: Fixed a flaw inside the FtpClient. (bsc#1188564)
    - CVE-2021-2369: JAR file handling problem containing multiple MANIFEST.MF files. (bsc#1188565)
    - CVE-2021-2432: Fixed a vulnerability in the omponent JNDI. (bsc#1188568)
    - CVE-2021-2163: Incomplete enforcement of JAR signing disabled algorithms. (bsc#1185055)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0107-1 advisory.

    - Update to Java 8.0 Service Refresh 7 Fix Pack 0
    - CVE-2021-41035: before version 0.29.0, the openj9 JVM does not throw IllegalAccessError for     MethodHandles that invoke inaccessible interface methods. (bsc#1194198, bsc#1192052)
    - CVE-2021-35586: Excessive memory allocation in BMPImageReader. (bsc#1191914)
    - CVE-2021-35564: Certificates with end dates too far in the future can corrupt keystore. (bsc#1191913)
    - CVE-2021-35559: Excessive memory allocation in RTFReader. (bsc#1191911)
    - CVE-2021-35556: Excessive memory allocation in RTFParser. (bsc#1191910)
    - CVE-2021-35565: Loop in HttpsServer triggered during TLS session close. (bsc#1191909)
    - CVE-2021-35588: Incomplete validation of inner class references in ClassFileParser. (bsc#1191905)
    - CVE-2021-2341: Fixed a flaw inside the FtpClient. (bsc#1188564)
    - CVE-2021-2369: JAR file handling problem containing multiple MANIFEST.MF files. (bsc#1188565)
    - CVE-2021-2163: Incomplete enforcement of JAR signing disabled algorithms. (bsc#1185055)
    - CVE-2021-35560: Fixed a vulnerability in the component Deployment. (bsc#1191902)
    - CVE-2021-35578: Fixed unexpected exception raised during TLS handshake. (bsc#1191904)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:0108-1 advisory.

  - Vulnerability in the Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition product of Oracle Java     SE (component: Libraries). Supported versions that are affected are Java SE: 7u291, 8u281, 11.0.10, 16;
    Java SE Embedded: 8u281; Oracle GraalVM Enterprise Edition: 19.3.5, 20.3.1.2 and 21.0.0.2. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition. Successful attacks require human     interaction from a person other than the attacker. Successful attacks of this vulnerability can result in     unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded,     Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments     that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox     for security. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N). (CVE-2021-2163)

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Networking). Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle     GraalVM Enterprise Edition: 20.3.2 and 21.1.0. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise     Edition. Successful attacks require human interaction from a person other than the attacker. Successful     attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Oracle     GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability does not apply to Java deployments, typically in servers, that load and run     only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Confidentiality     impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N). (CVE-2021-2341)

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Library). Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle GraalVM     Enterprise Edition: 20.3.2 and 21.1.0. Easily exploitable vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition.
    Successful attacks require human interaction from a person other than the attacker. Successful attacks of     this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Oracle     GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability does not apply to Java deployments, typically in servers, that load and run     only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 4.3 (Integrity impacts).
    CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N). (CVE-2021-2369)

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Swing). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM     Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition.
    Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of     service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to     Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java     applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java     sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that     load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3     (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2021-35556)

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Swing). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM     Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition.
    Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of     service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to     Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java     applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java     sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component,     e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability     impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2021-35559)

  - Vulnerability in the Java SE product of Oracle Java SE (component: Deployment). The supported version that     is affected is Java SE: 8u301. Difficult to exploit vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Java SE. Successful attacks require human interaction     from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of     Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java     Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes     from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS     Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). (CVE-2021-35560)

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Keytool). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM     Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition.
    Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to     some of Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to     Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java     applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java     sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component,     e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Integrity impacts).
    CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). (CVE-2021-35564)

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    JSSE). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12; Oracle GraalVM Enterprise     Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network     access via TLS to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this     vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of     Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability can only be exploited by supplying     data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted     Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2021-35565)

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    JSSE). Supported versions that are affected are Java SE: 8u301, 11.0.12, 17; Oracle GraalVM Enterprise     Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network     access via TLS to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this     vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of     Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability can only be exploited by supplying     data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted     Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2021-35578)

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    ImageIO). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM     Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition.
    Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of     service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to     Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java     applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java     sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component,     e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability     impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2021-35586)

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Hotspot). Supported versions that are affected are Java SE: 7u311, 8u301; Oracle GraalVM Enterprise     Edition: 20.3.3 and 21.2.0. Difficult to exploit vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful     attacks require human interaction from a person other than the attacker. Successful attacks of this     vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of     Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through     a web service which supplies data to the APIs. CVSS 3.1 Base Score 3.1 (Availability impacts). CVSS     Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L). (CVE-2021-35588)

  - In Eclipse Openj9 before version 0.29.0, the JVM does not throw IllegalAccessError for MethodHandles that     invoke inaccessible interface methods. (CVE-2021-41035)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 6.0.2. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-6.0.2 advisory.

  - A flaw was found in the Routing decision classifier in the Linux kernel's Traffic Control networking     subsystem in the way it handled changing of classification filters, leading to a use-after-free condition.
    This flaw allows unprivileged local users to escalate their privileges on the system. The highest threat     from this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2021-3715)

  - Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP     transfer-encoding request header in some circumstances leading to the possibility to request smuggling     when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if     the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured the identify encoding;
    and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding.
    (CVE-2021-33037)

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Networking). Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle     GraalVM Enterprise Edition: 20.3.2 and 21.1.0. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise     Edition. Successful attacks require human interaction from a person other than the attacker. Successful     attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Oracle     GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability does not apply to Java deployments, typically in servers, that load and run     only trusted code (e.g., code installed by an administrator). (CVE-2021-2341)

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Library). Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle GraalVM     Enterprise Edition: 20.3.2 and 21.1.0. Easily exploitable vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition.
    Successful attacks require human interaction from a person other than the attacker. Successful attacks of     this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Oracle     GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability does not apply to Java deployments, typically in servers, that load and run     only trusted code (e.g., code installed by an administrator). (CVE-2021-2369)

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Hotspot). Supported versions that are affected are Java SE: 8u291, 11.0.11, 16.0.1; Oracle GraalVM     Enterprise Edition: 20.3.2 and 21.1.0. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition.
    Successful attacks require human interaction from a person other than the attacker. Successful attacks of     this vulnerability can result in takeover of Java SE, Oracle GraalVM Enterprise Edition. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). (CVE-2021-2388)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
294730	MiracleLinux 8 : java-11-openjdk-11.0.12.0.7-0.el8 (AXSA:2021-2247:11)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
153166	Amazon Linux AMI : java-1.8.0-openjdk (ALAS-2021-1528)	Nessus	Amazon Linux Local Security Checks	2021/9/9	2024/12/11	high
208567	CentOS 7 : java-1.8.0-ibm (RHSA-2021:3292)	Nessus	CentOS Local Security Checks	2024/10/9	2024/10/9	medium
208642	CentOS 7 : java-1.7.1-ibm (RHSA-2021:3293)	Nessus	CentOS Local Security Checks	2024/10/9	2025/5/28	low
234962	Amazon Linux 2 : java-11-openjdk (ALASJAVA-OPENJDK11-2025-011)	Nessus	Amazon Linux Local Security Checks	2025/4/29	2025/4/29	high
157530	AlmaLinux 8 : java-11-openjdk (ALSA-2021:2781)	Nessus	Alma Linux Local Security Checks	2022/2/9	2023/11/13	high
151984	Oracle Linux 8 : java-1.8.0-openjdk (ELSA-2021-2776)	Nessus	Oracle Linux Local Security Checks	2021/7/22	2024/11/1	high
151909	RHEL 7 : java-11-openjdk (RHSA-2021:2784)	Nessus	Red Hat Local Security Checks	2021/7/21	2024/11/7	high
154840	RHEL 8 : java-1.8.0-ibm (RHSA-2021:4089)	Nessus	Red Hat Local Security Checks	2021/11/2	2024/11/8	medium
203865	Photon OS 3.0: Openjdk11 PHSA-2023-3.0-0601	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/11/25	high
156812	SUSE SLES11: java-1_7_1-ibm / java-1_7_1-ibm-alsa / java-1_7_1-ibm-devel / etc (SUSE-SU-2022:14875-1)	Nessus	SuSE Local Security Checks	2022/1/19	2026/6/26	critical
156813	SUSE SLES12: java-1_8_0-ibm / java-1_8_0-ibm-alsa / java-1_8_0-ibm-devel / etc (SUSE-SU-2022:0107-1)	Nessus	SuSE Local Security Checks	2022/1/19	2026/6/26	critical
156852	openSUSE 15 Security Update : java-1_8_0-ibm (openSUSE-SU-2022:0108-1)	Nessus	SuSE Local Security Checks	2022/1/19	2023/11/20	critical
164560	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.0.2)	Nessus	Misc.	2022/9/1	2025/10/6	high

检测

插件搜索

high

high

medium

low

high

high

high

high

medium

high

critical

critical

critical

high