The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:7053 advisory.

  - In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data     internal to the PostScript interpreter, in base/sbcp.c. This affects BCPEncode, BCPDecode, TBCPEncode, and     TBCPDecode. If the write buffer is filled to one byte less than full, and one then tries to write an     escaped character, two bytes are written. (CVE-2023-28879)

  - A buffer overflow flaw was found in base/gdevdevn.c:1973 in devn_pcx_write_rle() in ghostscript. This     issue may allow a local attacker to cause a denial of service via outputting a crafted PDF file for a DEVN     device with gs. (CVE-2023-38559)

  - A flaw was found in ghostscript. The fix for CVE-2020-16305 in ghostscript was not included in     RHSA-2021:1852-06 advisory as it was claimed to be. This issue only affects the ghostscript package as     shipped with Red Hat Enterprise Linux 8. (CVE-2023-4042)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:7015 advisory.

  - Due to failure in validating the length provided by an attacker-crafted RTPS packet, Wireshark version     4.0.5 and prior, by default, is susceptible to a heap-based buffer overflow, and possibly code execution     in the context of the process running Wireshark. (CVE-2023-0666)

  - VMS TCPIPtrace file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service     via crafted capture file (CVE-2023-2856)

  - NetScaler file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via     crafted capture file (CVE-2023-2858)

  - XRA dissector infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via     packet injection or crafted capture file (CVE-2023-2952)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2023:7029 advisory.

  - A vulnerability was found in libX11. The security flaw occurs because the functions in src/InitExt.c in     libX11 do not check that the values provided for the Request, Event, or Error IDs are within the bounds of     the arrays that those functions write to, using those IDs as array indexes. They trust that they were     called with values provided by an Xserver adhering to the bounds specified in the X11 protocol, as all X     servers provided by X.Org do. As the protocol only specifies a single byte for these values, an out-of-     bounds value provided by a malicious server (or a malicious proxy-in-the-middle) can only overwrite other     portions of the Display structure and not write outside the bounds of the Display structure itself,     possibly causing the client to crash with this memory corruption. (CVE-2023-3138)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:7038 advisory.

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
    Versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4 contain a vulnerability similar to CVE-2017-5226, but     using the `TIOCLINUX` ioctl command instead of `TIOCSTI`. If a Flatpak app is run on a Linux virtual     console such as `/dev/tty1`, it can copy text from the virtual console and paste it into the command     buffer, from which the command might be run after the Flatpak app has exited. Ordinary graphical terminal     emulators like xterm, gnome-terminal and Konsole are unaffected. This vulnerability is specific to the     Linux virtual consoles `/dev/tty1`, `/dev/tty2` and so on. A patch is available in versions 1.10.8,     1.12.8, 1.14.4, and 1.15.4. As a workaround, don't run Flatpak on a Linux virtual console. Flatpak is     primarily designed to be used in a Wayland or X11 graphical environment. (CVE-2023-28100)

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In     versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4, if an attacker publishes a Flatpak app with elevated     permissions, they can hide those permissions from users of the `flatpak(1)` command-line interface by     setting other permissions to crafted values that contain non-printable control characters such as `ESC`. A     fix is available in versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. As a workaround, use a GUI like GNOME     Software rather than the command-line interface, or only install apps whose maintainers you trust.
    (CVE-2023-28101)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2023:7096 advisory.

  - cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In     affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol,     but provide only immutable buffers. This would allow immutable objects (such as `bytes`) to be mutated,     thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an     exception. This issue has been present since `update_into` was originally introduced in cryptography 1.8.
    (CVE-2023-23931)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2023:6916 advisory.

  - A flaw was found in X.Org Server Overlay Window. A Use-After-Free may lead to local privilege escalation.
    If a client explicitly destroys the compositor overlay window (aka COW), the Xserver would leave a     dangling pointer to that window in the CompScreen structure, which will trigger a use-after-free later.
    (CVE-2023-1393)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:6933 advisory.

  - Apache OpenOffice versions before 4.1.14 may be configured to add an empty entry to the Java class path.
    This may lead to run arbitrary Java code from the current directory. (CVE-2022-38745)

  - Improper Validation of Array Index vulnerability in the spreadsheet component of The Document Foundation     LibreOffice allows an attacker to craft a spreadsheet document that will cause an array index underflow     when loaded. In the affected versions of LibreOffice certain malformed spreadsheet formulas, such as     AGGREGATE, could be created with less parameters passed to the formula interpreter than it expected,     leading to an array index underflow, in which case there is a risk that arbitrary code could be executed.
    This issue affects: The Document Foundation LibreOffice 7.4 versions prior to 7.4.6; 7.5 versions prior to     7.5.1. (CVE-2023-0950)

  - A flaw was found in the Libreoffice package. An attacker can craft an odb containing a database/script     file with a SCRIPT command where the contents of the file could be written to a new file whose location     was determined by the attacker. (CVE-2023-1183)

  - Improper access control in editor components of The Document Foundation LibreOffice allowed an attacker to     craft a document that would cause external links to be loaded without prompt. In the affected versions of     LibreOffice documents that used floating frames linked to external files, would load the contents of     those frames without prompting the user for permission to do so. This was inconsistent with the treatment     of other linked content in LibreOffice. This issue affects: The Document Foundation LibreOffice 7.4     versions prior to 7.4.7; 7.5 versions prior to 7.5.3. (CVE-2023-2255)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2023:7160 advisory.

  - A vulnerbility was found in OpenSC. This security flaw cause a buffer overrun vulnerability in pkcs15     cardos_have_verifyrc_package. The attacker can supply a smart card package with malformed ASN1 context.
    The cardos_have_verifyrc_package function scans the ASN1 buffer for 2 tags, where remaining length is     wrongly caculated due to moved starting pointer. This leads to possible heap-based buffer oob read. In     cases where ASAN is enabled while compiling this causes a crash. Further info leak or more damage is     possible. (CVE-2023-2977)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2023:7057 advisory.

  - There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory     in server and cause crash. (CVE-2023-33460)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2023:6976 advisory.

  - json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated     by printbuf_memappend. (CVE-2020-12762)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:6967 advisory.

  - An issue was discovered in Qt 5.x before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1.
    QDnsLookup has a buffer over-read via a crafted reply from a DNS server. (CVE-2023-33285)

  - An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2.
    Certificate validation for TLS does not always consider whether the root of a chain is a configured CA     certificate. (CVE-2023-34410)

  - In Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2, there can be an application     crash in QXmlStreamReader via a crafted XML string that triggers a situation in which a prefix is greater     than a length. (CVE-2023-37369)

  - An issue was discovered in Qt before 5.15.15, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3.
    There are infinite loops in recursive entity expansion. (CVE-2023-38197)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This plugin has been deprecated due to only referencing a CVE that has been rejected.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2023:6919 advisory.

  - Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA     pool that was not assigned to any issues during 2019. Notes: none. (CVE-2019-14560)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2023:7112 advisory.

  - A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If     the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the     first entry. This may allow an attacker with enough access to retrieve the password from the memory.
    (CVE-2023-4641) (CVE-2023-4641)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2023:6961 advisory.

  - In Qt before 5.15.14, 6.0.x through 6.2.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1, QtSvg     QSvgFont m_unitsPerEm initialization is mishandled. (CVE-2023-32573)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2023:7052 advisory.

  - An issue was discovered in Libreswan before 4.12. When an IKEv2 Child SA REKEY packet contains an invalid     IPsec protocol ID number of 0 or 1, an error notify INVALID_SPI is sent back. The notify payload's     protocol ID is copied from the incoming packet, but the code that verifies outgoing packets fails an     assertion that the protocol ID must be ESP (2) or AH(3) and causes the pluto daemon to crash and restart.
    NOTE: the earliest affected version is 3.20. (CVE-2023-38710)

  - An issue was discovered in Libreswan before 4.12. When an IKEv1 Quick Mode connection configured with     ID_IPV4_ADDR or ID_IPV6_ADDR receives an IDcr payload with ID_FQDN, a NULL pointer dereference causes a     crash and restart of the pluto daemon. NOTE: the earliest affected version is 4.6. (CVE-2023-38711)

  - An issue was discovered in Libreswan 3.x and 4.x before 4.12. When an IKEv1 ISAKMP SA Informational     Exchange packet contains a Delete/Notify payload followed by further Notifies that act on the ISAKMP SA,     such as a duplicated Delete/Notify message, a NULL pointer dereference on the deleted state causes the     pluto daemon to crash and restart. (CVE-2023-38712)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2023:7022 advisory.

  - A race condition exists in the Tang server functionality for key generation and key rotation. This flaw     results in a small time window where Tang private keys become readable by other processes on the same     host. (CVE-2023-1672)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2023:7046 advisory.

  - An issue was discovered in Dnsmasq before 2.90. The default maximum EDNS.0 UDP packet size was set to 4096     but should be 1232 because of DNS Flag Day 2020. (CVE-2023-28450)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2023:6917 advisory.

  - A flaw was found in X.Org Server Overlay Window. A Use-After-Free may lead to local privilege escalation.
    If a client explicitly destroys the compositor overlay window (aka COW), the Xserver would leave a     dangling pointer to that window in the CompScreen structure, which will trigger a use-after-free later.
    (CVE-2023-1393)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:7139 advisory.

  - An out-of-bounds read vulnerability was found in Samba due to insufficient length checks in     winbindd_pam_auth_crap.c. When performing NTLM authentication, the client replies to cryptographic     challenges back to the server. These replies have variable lengths, and Winbind fails to check the lan     manager response length. When Winbind is used for NTLM authentication, a maliciously crafted request can     trigger an out-of-bounds read in Winbind, possibly resulting in a crash. (CVE-2022-2127)

  - An infinite loop vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing     Spotlight mdssvc RPC packets sent by the client, the core unmarshalling function sl_unpack_loop() did not     validate a field in the network packet that contains the count of elements in an array-like structure. By     passing 0 as the count value, the attacked function will run in an endless loop consuming 100% CPU. This     flaw allows an attacker to issue a malformed RPC request, triggering an infinite loop, resulting in a     denial of service condition. (CVE-2023-34966)

  - A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing     Spotlight mdssvc RPC packets, one encoded data structure is a key-value style dictionary where the keys     are character strings, and the values can be any of the supported types in the mdssvc protocol. Due to a     lack of type checking in callers of the dalloc_value_for_key() function, which returns the object     associated with a key, a caller may trigger a crash in talloc_get_size() when talloc detects that the     passed-in pointer is not a valid talloc pointer. With an RPC worker process shared among multiple client     connections, a malicious client or attacker can trigger a process crash in a shared RPC mdssvc worker     process, affecting all other clients this worker serves. (CVE-2023-34967)

  - A path disclosure vulnerability was found in Samba. As part of the Spotlight protocol, Samba discloses the     server-side absolute path of shares, files, and directories in the results for search queries. This flaw     allows a malicious client or an attacker with a targeted RPC request to view the information that is part     of the disclosed path. (CVE-2023-34968)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2023:7090 advisory.

  - GNU libmicrohttpd before 0.9.76 allows remote DoS (Denial of Service) due to improper parsing of a     multipart/form-data boundary in the postprocessor.c MHD_create_post_processor() method. This allows an     attacker to remotely send a malicious HTTP POST packet that includes one or more '\0' bytes in a     multipart/form-data boundary field, which - assuming a specific heap layout - will result in an out-of-     bounds read and a crash in the find_boundary() function. (CVE-2023-27371)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2023:7190 advisory.

  - A vulnerability was found in the avahi library. This flaw allows an unprivileged user to make a dbus call,     causing the avahi daemon to crash. (CVE-2023-1981)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2023:6943 advisory.

  - Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this     information to find hashed passwords and possibly escalate their privilege. (CVE-2023-1786)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2023:7189 advisory.

  - When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to     /etc/fwupd/redfish.conf without proper restriction, allowing any user on the system to read the same     configuration file. (CVE-2022-3287)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:6267 advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2023:5994 advisory.

  - An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x     before 3.11.5. It primarily affects servers (such as HTTP servers) that use TLS client authentication. If     a TLS server-side socket is created, receives data into the socket buffer, and then is closed quickly,     there is a brief window where the SSLSocket instance will detect the socket as not connected and won't     initiate a handshake, but buffered data will still be readable from the socket buffer. This data will not     be authenticated if the server-side TLS peer is expecting client certificate authentication, and is     indistinguishable from valid TLS stream data. Data is limited in size to the amount that will fit in the     buffer. (The TLS connection cannot directly be used for data exfiltration because the vulnerable code path     requires that the connection be closed on initialization of the SSLSocket.) (CVE-2023-40217)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2023:5998 advisory.

  - An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x     before 3.11.5. It primarily affects servers (such as HTTP servers) that use TLS client authentication. If     a TLS server-side socket is created, receives data into the socket buffer, and then is closed quickly,     there is a brief window where the SSLSocket instance will detect the socket as not connected and won't     initiate a handshake, but buffered data will still be readable from the socket buffer. This data will not     be authenticated if the server-side TLS peer is expecting client certificate authentication, and is     indistinguishable from valid TLS stream data. Data is limited in size to the amount that will fit in the     buffer. (The TLS connection cannot directly be used for data exfiltration because the vulnerable code path     requires that the connection be closed on initialization of the SSLSocket.) (CVE-2023-40217)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2023:5989 advisory.

  - The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation     can reset many streams quickly, as exploited in the wild in August through October 2023. (CVE-2023-44487)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:5927 advisory.

  - In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, password_verify() function may     accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database,     it may lead to an application allowing any password for this entry as valid. (CVE-2023-0567)

  - In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, core path resolution function     allocate buffer one byte too small. When resolving paths with lengths close to system MAXPATHLEN setting,     this may lead to the byte after the allocated buffer being overwritten with NUL value, which might lead to     unauthorized data access or modification. (CVE-2023-0568)

  - In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, excessive number of parts in HTTP     form upload can cause high resource consumption and excessive number of log entries. This can cause denial     of service on the affected server by exhausting CPU resources or disk space. (CVE-2023-0662)

  - In PHP versions 8.0.* before 8.0.29, 8.1.* before 8.1.20, 8.2.* before 8.2.7 when using SOAP HTTP Digest     Authentication, random value generator was not checked for failure, and was using narrower range of values     than it should have. In case of random generator failure, it could lead to a disclosure of 31 bits of     uninitialized memory from the client to the server, and it also made easier to a malicious server to guess     the client's nonce. (CVE-2023-3247)

  - In PHP versions 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8 various XML functions     rely on libxml global state to track configuration variables, like whether external entities are loaded.
    This state is assumed to be unchanged unless the user explicitly changes it by calling appropriate     function. However, since the state is process-global, other modules - such as ImageMagick - may also use     this library within the same process, and change that global state for their internal purposes, and leave     it in a state where external entities loading is enabled. This can lead to the situation where external     XML is parsed with external entities loaded, which can lead to disclosure of any local files accessible to     PHP. This vulnerable state may persist in the same process across many requests, until the process is shut     down. (CVE-2023-3823)

  - In PHP version 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8, when loading phar file,     while reading PHAR directory entries, insufficient length checking may lead to a stack buffer overflow,     leading potentially to memory corruption or RCE. (CVE-2023-3824)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:5869 advisory.

  - When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the     application can intercept the operation and return a forged checksum to the node's policy implementation,     thus effectively disabling the integrity check. Impacts: This vulnerability affects all users using the     experimental policy mechanism in all active release lines: 18.x and, 20.x. Please note that at the time     this CVE was issued, the policy mechanism is an experimental feature of Node.js. (CVE-2023-38552)

  - Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The     injected code may be able to access data and functions that the WebAssembly module itself does not have     access to, similar to as if the WebAssembly module was a JavaScript module. Impacts: Thanks to dittyroma     for reporting the issue and to Tobias Nieen for fixing it. (CVE-2023-39333)

  - The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation     can reset many streams quickly, as exploited in the wild in August through October 2023. (CVE-2023-44487)

  - Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already     cleared Authorization headers on cross-origin redirects, but did not clear `Cookie` headers. By design,     `cookie` headers are forbidden request headers, disallowing them to be set in RequestInit.headers in     browser environments. Since undici handles headers more liberally than the spec, there was a disconnect     from the assumptions the spec made, and undici's implementation of fetch. As such this may lead to     accidental leakage of cookie to a third-party site or a malicious attacker who can control the redirection     target (ie. an open redirector) to leak the cookie to the third party site. This was patched in version     5.26.2. There are no known workarounds. (CVE-2023-45143)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2023:5721 advisory.

  - A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive     server resource consumption. While the total number of requests is bounded by the     http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create     a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound     the number of simultaneously executing handler goroutines to the stream concurrency limit     (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client     has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows     too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2     for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per     HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the     Server.MaxConcurrentStreams setting and the ConfigureServer function. (CVE-2023-39325)

  - rapid stream resets can cause excessive work () (CVE-2023-44487)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2023:5713 advisory.

  - The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation     can reset many streams quickly, as exploited in the wild in August through October 2023. (CVE-2023-44487)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2023:5683 advisory.

  - MariaDB v10.4 to v10.7 was discovered to contain an use-after-poison in prepare_inplace_add_virtual at     /storage/innobase/handler/handler0alter.cc. (CVE-2022-32081)

  - MariaDB v10.5 to v10.7 was discovered to contain an assertion failure at table->get_ref_count() == 0 in     dict0dict.cc. (CVE-2022-32082)

  - MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component sub_select.
    (CVE-2022-32084)

  - MariaDB v10.5 to v10.7 was discovered to contain a segmentation fault via the component     st_select_lex_unit::exclude_level. (CVE-2022-32089)

  - MariaDB v10.7 was discovered to contain an use-after-poison in in __interceptor_memset at     /libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc. (CVE-2022-32091)

  - In MariaDB before 10.9.2, compress_write in extra/mariabackup/ds_compress.cc does not release data_mutex     upon a stream write failure, which allows local users to trigger a deadlock. (CVE-2022-38791)

  - MariaDB Server before 10.3.34 thru 10.9.3 is vulnerable to Denial of Service. It is possible for function     spider_db_mbase::print_warnings to dereference a null pointer. (CVE-2022-47015)

  - A vulnerability was found in MariaDB. An OpenVAS port scan on ports 3306 and 4567 allows a malicious     remote client to cause a denial of service. (CVE-2023-5157)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:5362 advisory.

  - Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS)     via the function new Range, when untrusted user data is provided as a range. (CVE-2022-25883)

  - The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json     definition for a given module. This vulnerability affects all users using the experimental policy     mechanism in all active release lines: 16.x, 18.x and, 20.x. Please note that at the time this CVE was     issued, the policy is an experimental feature of Node.js. (CVE-2023-32002)

  - The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules     outside of the policy.json definition for a given module. This vulnerability affects all users using the     experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x. Please note that at the     time this CVE was issued, the policy is an experimental feature of Node.js. (CVE-2023-32006)

  - A privilege escalation vulnerability exists in the experimental policy mechanism in all active release     lines: 16.x, 18.x and, 20.x. The use of the deprecated API `process.binding()` can bypass the policy     mechanism by requiring internal modules and eventually take advantage of `process.binding('spawn_sync')`     run arbitrary code, outside of the limits defined in a `policy.json` file. Please note that at the time     this CVE was issued, the policy is an experimental feature of Node.js. (CVE-2023-32559)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:5264 advisory.

  - A buffer overflow was discovered in NTFS-3G before 2022.10.3. Crafted metadata in an NTFS image can cause     code execution. A local attacker can exploit this if the ntfs-3g binary is setuid root. A physically     proximate attacker can exploit this if NTFS-3G software is configured to execute upon attachment of an     external storage device. (CVE-2022-40284)

  - A flaw was found in the QEMU built-in VNC server. When a client connects to the VNC server, QEMU checks     whether the current number of connections crosses a certain threshold and if so, cleans up the previous     connection. If the previous connection happens to be in the handshake phase and fails, QEMU cleans up the     connection again, resulting in a NULL pointer dereference issue. This could allow a remote unauthenticated     client to cause a denial of service. (CVE-2023-3354)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:5269 advisory.

  - schema_element defeats protective search_path changes; It was found that certain database calls in     PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary     code. (CVE-2023-2454)

  - Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies     to be applied in certain cases where role-specific policies are used and a given query is planned under     one role and then executed under other roles. This scenario can happen under security definer functions or     when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an     incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects     only databases that have used CREATE POLICY to define a row security policy. (CVE-2023-2455)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2023:5050 advisory.

  - HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache     HTTP Server: from 2.4.30 through 2.4.55. Special characters in the origin response header can     truncate/split the response forwarded to the client. (CVE-2023-27522)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:4535 advisory.

  - In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment     of Kerberos transport encryption. In certain conditions a server can cause a libpq client to over-read and     report an error message containing uninitialized bytes. (CVE-2022-41862)

  - schema_element defeats protective search_path changes; It was found that certain database calls in     PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary     code. (CVE-2023-2454)

  - Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies     to be applied in certain cases where role-specific policies are used and a given query is planned under     one role and then executed under other roles. This scenario can happen under security definer functions or     when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an     incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects     only databases that have used CREATE POLICY to define a row security policy. (CVE-2023-2455)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2023:4537 advisory.

  - The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require     modules outside of the policy.json definition. This vulnerability affects all users using the experimental     policy mechanism in all active release lines: v16, v18 and, v20. Please note that at the time this CVE was     issued, the policy is an experimental feature of Node.js (CVE-2023-30581)

  - When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a     non-expect termination occurs making it susceptible to DoS attacks when the attacker could force     interruptions of application processing, as the process terminates when accessing public key info of     provided certificates from user code. The current context of the users will be gone, and that will cause a     DoS scenario. This vulnerability affects all active Node.js versions v16, v18, and, v20. (CVE-2023-30588)

  - The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit     HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient     to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence     should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20     (CVE-2023-30589)

  - The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or     outdated) keys, that is, it only generates a private key if none has been set yet, but the function is     also needed to compute the corresponding public key after calling setPrivateKey(). However, the     documentation says this API call: Generates private and public Diffie-Hellman key values. The documented     behavior is very different from the actual behavior, and this difference could easily lead to security     issues in applications that use these APIs as the DiffieHellman may be used as the basis for application-     level security, implications are consequently broad. (CVE-2023-30590)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:4527 advisory.

  - schema_element defeats protective search_path changes; It was found that certain database calls in     PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary     code. (CVE-2023-2454)

  - Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies     to be applied in certain cases where role-specific policies are used and a given query is planned under     one role and then executed under other roles. This scenario can happen under security definer functions or     when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an     incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects     only databases that have used CREATE POLICY to define a row security policy. (CVE-2023-2455)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:4536 advisory.

  - The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require     modules outside of the policy.json definition. This vulnerability affects all users using the experimental     policy mechanism in all active release lines: v16, v18 and, v20. Please note that at the time this CVE was     issued, the policy is an experimental feature of Node.js (CVE-2023-30581)

  - When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a     non-expect termination occurs making it susceptible to DoS attacks when the attacker could force     interruptions of application processing, as the process terminates when accessing public key info of     provided certificates from user code. The current context of the users will be gone, and that will cause a     DoS scenario. This vulnerability affects all active Node.js versions v16, v18, and, v20. (CVE-2023-30588)

  - The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit     HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient     to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence     should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20     (CVE-2023-30589)

  - The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or     outdated) keys, that is, it only generates a private key if none has been set yet, but the function is     also needed to compute the corresponding public key after calling setPrivateKey(). However, the     documentation says this API call: Generates private and public Diffie-Hellman key values. The documented     behavior is very different from the actual behavior, and this difference could easily lead to security     issues in applications that use these APIs as the DiffieHellman may be used as the basis for application-     level security, implications are consequently broad. (CVE-2023-30590)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:4152 advisory.

  - Every `named` instance configured to run as a recursive resolver maintains a cache database holding the     responses to the queries it has recently sent to authoritative servers. The size limit for that cache     database can be configured using the `max-cache-size` statement in the configuration file; it defaults to     90% of the total amount of memory available on the host. When the size of the cache reaches 7/8 of the     configured limit, a cache-cleaning algorithm starts to remove expired and/or least-recently used RRsets     from the cache, to keep memory use below the configured limit. It has been discovered that the     effectiveness of the cache-cleaning algorithm used in `named` can be severely diminished by querying the     resolver for specific RRsets in a certain order, effectively allowing the configured `max-cache-size`     limit to be significantly exceeded. This issue affects BIND 9 versions 9.11.0 through 9.16.41, 9.18.0     through 9.18.15, 9.19.0 through 9.19.13, 9.11.3-S1 through 9.16.41-S1, and 9.18.11-S1 through 9.18.15-S1.
    (CVE-2023-2828)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:4151 advisory.

  - A vulnerability classified as critical was found in Linux Kernel. Affected by this vulnerability is the     function l2cap_reassemble_sdu of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The     manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The associated     identifier of this vulnerability is VDB-211087. (CVE-2022-3564)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2023:4418 advisory.

  - OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). The AES GCM     decryption routine incorrectly uses the Tag length from the actual Authentication Tag provided in the JWE.
    The spec says that a fixed length of 16 octets must be applied. Therefore this bug allows an attacker to     provide a truncated Authentication Tag and to modify the JWE accordingly. Users should upgrade to a     version >= 0.6.2.2. Users unable to upgrade should avoid using AES GCM encryption and replace it with     another encryption algorithm (e.g. AES CBC). (CVE-2023-37464)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:3556 advisory.

  - An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting     methods by supplying a URL that starts with blank characters. (CVE-2023-24329)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:3741 advisory.

  - c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target     resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to     the target resolver. The target resolver erroneously interprets the 0 length as a graceful shutdown of the     connection. This issue has been patched in version 1.19.1. (CVE-2023-32067)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:2077 advisory.

  - There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode()     function and loop through to free best.bw and assign best = trial pointer. The second loop will then     return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the     AddressSanitizer will attempt a double free. (CVE-2023-1999)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1904 advisory.

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE     (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18,     17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit     vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE,     Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized     creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM     Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to     all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to     Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java     applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java     sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component,     e.g., through a web service which supplies data to the APIs. (CVE-2023-21930)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE     (component: Networking). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf,     11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit     vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise     Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition     accessible data. Note: This vulnerability applies to Java deployments, typically in clients running     sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g.,     code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also     be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to     the APIs. (CVE-2023-21937)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE     (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf,     11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.8, 21.3.4 and 22.3.0. Difficult to exploit     vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise     Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition     accessible data. Note: This vulnerability applies to Java deployments, typically in clients running     sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g.,     code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not     apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed     by an administrator). (CVE-2023-21938)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE     (component: Swing). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18,     17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Oracle Java SE, Oracle GraalVM     Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or     delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using     APIs in the specified Component, e.g., through a web service which supplies data to the APIs.
    (CVE-2023-21939)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE     (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18,     17.0.6; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability     allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE,     Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized     access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition     accessible data. Note: This vulnerability applies to Java deployments, typically in clients running     sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g.,     code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also     be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to     the APIs. (CVE-2023-21954)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE     (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18,     17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit     vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Java SE,     Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized     ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM     Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running     sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g.,     code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also     be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to     the APIs. (CVE-2023-21967)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE     (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf,     11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit     vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise     Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition     accessible data. Note: This vulnerability applies to Java deployments, typically in clients running     sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g.,     code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also     be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to     the APIs. (CVE-2023-21968)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:3944 advisory.

  - A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations,     impacting the confidentiality and integrity of the guest virtual machine. (CVE-2023-20867)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:3555 advisory.

  - An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting     methods by supplying a URL that starts with blank characters. (CVE-2023-24329)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:3481 advisory.

  - An issue was discovered in GNU Emacs through 28.2. htmlfontify.el has a command injection vulnerability.
    In the hfy-istext-command function, the parameter file and parameter srcdir come from external input, and     parameters are not escaped. If a file name or directory name contains shell metacharacters, code may be     executed. (CVE-2022-48339)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Severity
185638	CentOS 8 : ghostscript (CESA-2023:7053)	critical
185637	CentOS 8 : wireshark (CESA-2023:7015)	medium
185636	CentOS 8 : libX11 (CESA-2023:7029)	high
185635	CentOS 8 : flatpak (CESA-2023:7038)	medium
185634	CentOS 8 : python-cryptography (CESA-2023:7096)	medium
185633	CentOS 8 : xorg-x11-server (CESA-2023:6916)	high
185632	CentOS 8 : libreoffice (CESA-2023:6933)	high
185631	CentOS 8 : opensc (CESA-2023:7160)	high
185630	CentOS 8 : yajl (CESA-2023:7057)	medium
185629	CentOS 8 : libfastjson (CESA-2023:6976)	high
185628	CentOS 8 : qt5-qtbase (CESA-2023:6967)	medium
185627	CentOS 8 : edk2 (CESA-2023:6919) (deprecated)	high
185626	CentOS 8 : shadow-utils (CESA-2023:7112)	medium
185625	CentOS 8 : qt5-qtsvg (CESA-2023:6961)	medium
185624	CentOS 8 : libreswan (CESA-2023:7052)	medium
185623	CentOS 8 : tang (CESA-2023:7022)	medium
185622	CentOS 8 : dnsmasq (CESA-2023:7046)	high
185621	CentOS 8 : xorg-x11-server-Xwayland (CESA-2023:6917)	high
185620	CentOS 8 : samba (CESA-2023:7139)	medium
185619	CentOS 8 : libmicrohttpd (CESA-2023:7090)	medium
185618	CentOS 8 : avahi (CESA-2023:7190)	medium
185617	CentOS 8 : cloud-init (CESA-2023:6943)	medium
185616	CentOS 8 : fwupd (CESA-2023:7189)	medium
184198	CentOS 8 : squid:4 (CESA-2023:6267)	medium
183728	CentOS 8 : python27:2.7 (CESA-2023:5994)	medium
183727	CentOS 8 : python39:3.9 and python39-devel:3.9 (CESA-2023:5998)	medium
183726	CentOS 8 : varnish (CESA-2023:5989)	high
183434	CentOS 8 : php:8.0 (CESA-2023:5927)	critical
183343	CentOS 8 : nodejs:18 (CESA-2023:5869)	high
183196	CentOS 8 : go-toolset:rhel8 (CESA-2023:5721)	medium
183193	CentOS 8 : nginx:1.22 (CESA-2023:5713)	high
183000	CentOS 8 : mariadb:10.5 (CESA-2023:5683)	high
181894	CentOS 8 : nodejs:18 (CESA-2023:5362)	critical
181634	CentOS 8 : virt:rhel and virt-devel:rhel (CESA-2023:5264)	high
181625	CentOS 8 : postgresql:15 (CESA-2023:5269)	high
181246	CentOS 8 : httpd:2.4 (CESA-2023:5050)	high
179463	CentOS 8 : postgresql:12 (CESA-2023:4535)	high
179462	CentOS 8 : nodejs:16 (CESA-2023:4537)	high
179461	CentOS 8 : postgresql:13 (CESA-2023:4527)	high
179460	CentOS 8 : nodejs:18 (CESA-2023:4536)	high
179319	CentOS 7 : bind (RHSA-2023:4152)	high
179318	CentOS 7 : kernel (RHSA-2023:4151)	high
179183	CentOS 8 : mod_auth_openidc:2.3 (CESA-2023:4418)	high
178973	CentOS 7 : python3 (RHSA-2023:3556)	high
178972	CentOS 7 : c-ares (RHSA-2023:3741)	high
178971	CentOS 7 : libwebp (RHSA-2023:2077)	high
178970	CentOS 7 : java-1.8.0-openjdk (RHSA-2023:1904)	high
178969	CentOS 7 : open-vm-tools (RHSA-2023:3944)	low
178968	CentOS 7 : python (RHSA-2023:3555)	high
178967	CentOS 7 : emacs (RHSA-2023:3481)	high

Detections

Analytics

CentOS Local Security Checks Family for Nessus

critical

medium

high

medium

medium

high

high

high

medium

high

medium

high

medium

medium

medium

medium

high

high

medium

medium

medium

medium

medium

medium

medium

medium

high

critical

high

medium

high

high

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high

low

high

high