The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:5239 advisory.

  - Side-channel information leakage in graphics in Google Chrome prior to 87.0.4280.66 allowed a remote     attacker to leak cross-origin data via a crafted HTML page. (CVE-2020-16012)

  - A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even     after sanitization. An attacker already capable of exploiting an XSS vulnerability in privileged internal     pages could have used this attack to bypass our built-in sanitizer. This vulnerability affects Firefox <     83, Firefox ESR < 78.5, and Thunderbird < 78.5. (CVE-2020-26951)

  - It was possible to cause the browser to enter fullscreen mode without displaying the security UI; thus     making it possible to attempt a phishing attack or otherwise confuse the user. This vulnerability affects     Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. (CVE-2020-26953)

  - In some cases, removing HTML elements during sanitization would keep existing SVG event handlers and     therefore lead to XSS. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird <     78.5. (CVE-2020-26956)

  - Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted and     cached through a ServiceWorker. This could lead to a cross-site script inclusion vulnerability, or a     Content Security Policy bypass. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and     Thunderbird < 78.5. (CVE-2020-26958)

  - During browser shutdown, reference decrementing could have occured on a previously freed object, resulting     in a use-after-free, memory corruption, and a potentially exploitable crash. This vulnerability affects     Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. (CVE-2020-26959)

  - If the Compact() method was called on an nsTArray, the array could have been reallocated without updating     other pointers, leading to a potential use-after-free and exploitable crash. This vulnerability affects     Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. (CVE-2020-26960)

  - When DNS over HTTPS is in use, it intentionally filters RFC1918 and related IP ranges from the responses     as these do not make sense coming from a DoH resolver. However when an IPv4 address was mapped through     IPv6, these addresses were erroneously let through, leading to a potential DNS Rebinding attack. This     vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. (CVE-2020-26961)

  - Some websites have a feature Show Password where clicking a button will change a password field into a     textbook field, revealing the typed password. If, when using a software keyboard that remembers user     input, a user typed their password and used that feature, the type of the password field was changed,     resulting in a keyboard layout change and the possibility for the software keyboard to remember the typed     password. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5.
    (CVE-2020-26965)

  - Mozilla developers reported memory safety bugs present in Firefox 82 and Firefox ESR 78.4. Some of these     bugs showed evidence of memory corruption and we presume that with enough effort some of these could have     been exploited to run arbitrary code. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and     Thunderbird < 78.5. (CVE-2020-26968)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:5235 advisory.

  - Side-channel information leakage in graphics in Google Chrome prior to 87.0.4280.66 allowed a remote     attacker to leak cross-origin data via a crafted HTML page. (CVE-2020-16012)

  - A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even     after sanitization. An attacker already capable of exploiting an XSS vulnerability in privileged internal     pages could have used this attack to bypass our built-in sanitizer. This vulnerability affects Firefox <     83, Firefox ESR < 78.5, and Thunderbird < 78.5. (CVE-2020-26951)

  - It was possible to cause the browser to enter fullscreen mode without displaying the security UI; thus     making it possible to attempt a phishing attack or otherwise confuse the user. This vulnerability affects     Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. (CVE-2020-26953)

  - In some cases, removing HTML elements during sanitization would keep existing SVG event handlers and     therefore lead to XSS. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird <     78.5. (CVE-2020-26956)

  - Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted and     cached through a ServiceWorker. This could lead to a cross-site script inclusion vulnerability, or a     Content Security Policy bypass. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and     Thunderbird < 78.5. (CVE-2020-26958)

  - During browser shutdown, reference decrementing could have occured on a previously freed object, resulting     in a use-after-free, memory corruption, and a potentially exploitable crash. This vulnerability affects     Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. (CVE-2020-26959)

  - If the Compact() method was called on an nsTArray, the array could have been reallocated without updating     other pointers, leading to a potential use-after-free and exploitable crash. This vulnerability affects     Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. (CVE-2020-26960)

  - When DNS over HTTPS is in use, it intentionally filters RFC1918 and related IP ranges from the responses     as these do not make sense coming from a DoH resolver. However when an IPv4 address was mapped through     IPv6, these addresses were erroneously let through, leading to a potential DNS Rebinding attack. This     vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. (CVE-2020-26961)

  - Some websites have a feature Show Password where clicking a button will change a password field into a     textbook field, revealing the typed password. If, when using a software keyboard that remembers user     input, a user typed their password and used that feature, the type of the password field was changed,     resulting in a keyboard layout change and the possibility for the software keyboard to remember the typed     password. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5.
    (CVE-2020-26965)

  - Mozilla developers reported memory safety bugs present in Firefox 82 and Firefox ESR 78.4. Some of these     bugs showed evidence of memory corruption and we presume that with enough effort some of these could have     been exploited to run arbitrary code. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and     Thunderbird < 78.5. (CVE-2020-26968)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4035 advisory.

  - WebKitGTK and WPE WebKit prior to version 2.24.1 failed to properly apply configured HTTP proxy settings     when downloading livestream video (HLS, DASH, or Smooth Streaming), an error resulting in deanonymization.
    This issue was corrected by changing the way livestreams are downloaded. (CVE-2019-11070)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     12.3, macOS Mojave 10.14.5, tvOS 12.3, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12.
    Processing maliciously crafted web content may lead to arbitrary code execution. (CVE-2019-6237,     CVE-2019-8571, CVE-2019-8584, CVE-2019-8586, CVE-2019-8587, CVE-2019-8594, CVE-2019-8595, CVE-2019-8596,     CVE-2019-8597, CVE-2019-8608, CVE-2019-8609, CVE-2019-8610, CVE-2019-8611, CVE-2019-8615, CVE-2019-8619)

  - WebKitGTK and WPE WebKit prior to version 2.24.1 are vulnerable to address bar spoofing upon certain     JavaScript redirections. An attacker could cause malicious web content to be displayed as if for a trusted     URI. This is similar to the CVE-2018-8383 issue in Microsoft Edge. (CVE-2019-6251)

  - A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS     12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously     crafted web content may lead to arbitrary code execution. (CVE-2019-8506)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously     crafted web content may lead to arbitrary code execution. (CVE-2019-8524)

  - A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 12.2,     tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted     web content may lead to arbitrary code execution. (CVE-2019-8535)

  - A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 12.2,     tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing     maliciously crafted web content may lead to arbitrary code execution. (CVE-2019-8536, CVE-2019-8544)

  - A logic issue was addressed with improved validation. This issue is fixed in iOS 12.2, tvOS 12.2, Safari     12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may     lead to universal cross site scripting. (CVE-2019-8551)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing     maliciously crafted web content may lead to arbitrary code execution. (CVE-2019-8558, CVE-2019-8559,     CVE-2019-8563)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for     Windows 7.12. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2019-8583, CVE-2019-8601, CVE-2019-8622, CVE-2019-8623)

  - An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 12.3, macOS     Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows     7.12. Processing maliciously crafted web content may result in the disclosure of process memory.
    (CVE-2019-8607)

  - A logic issue was addressed with improved state management. This issue is fixed in tvOS 13, iTunes for     Windows 12.10.1, iCloud for Windows 10.7, iCloud for Windows 7.14. Processing maliciously crafted web     content may lead to universal cross site scripting. (CVE-2019-8625, CVE-2019-8719)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     12.4, macOS Mojave 10.14.6, tvOS 12.4, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13,     iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2019-8644, CVE-2019-8666, CVE-2019-8671, CVE-2019-8673, CVE-2019-8677, CVE-2019-8678, CVE-2019-8679,     CVE-2019-8680, CVE-2019-8681, CVE-2019-8686, CVE-2019-8687)

  - A logic issue existed in the handling of synchronous page loads. This issue was addressed with improved     state management. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, Safari 12.1.2, iTunes     for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web     content may lead to universal cross site scripting. (CVE-2019-8649)

  - A logic issue was addressed with improved state management. This issue is fixed in iOS 12.4, macOS Mojave     10.14.6, tvOS 12.4, watchOS 5.3, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud     for Windows 10.6. Processing maliciously crafted web content may lead to universal cross site scripting.
    (CVE-2019-8658)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for     Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary     code execution. (CVE-2019-8669, CVE-2019-8672, CVE-2019-8676, CVE-2019-8683, CVE-2019-8684, CVE-2019-8688,     CVE-2019-8689)

  - A logic issue was addressed with improved state management. This issue is fixed in iOS 13, Safari 13.
    Processing maliciously crafted web content may lead to universal cross site scripting. (CVE-2019-8674)

  - A logic issue existed in the handling of document loads. This issue was addressed with improved state     management. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, Safari 12.1.2, iTunes for     Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web     content may lead to universal cross site scripting. (CVE-2019-8690)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in     tvOS 13, iTunes for Windows 12.10.1, iCloud for Windows 10.7, iCloud for Windows 7.14. Processing     maliciously crafted web content may lead to arbitrary code execution. (CVE-2019-8707, CVE-2019-8726,     CVE-2019-8733, CVE-2019-8735)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in     iCloud for Windows 11.0. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2019-8710)

  - A vulnerability was found in WebKit. The flaw is triggered when processing maliciously crafted web content     that may lead to arbitrary code execution. Improved memory handling addresses the multiple memory     corruption issues. (CVE-2019-8720)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in     watchOS 6.1. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2019-8743, CVE-2019-8765)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     13.1 and iPadOS 13.1, tvOS 13, Safari 13.0.1, iTunes for Windows 12.10.1, iCloud for Windows 10.7, iCloud     for Windows 7.14. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2019-8763)

  - A logic issue was addressed with improved state management. This issue is fixed in watchOS 6.1. Processing     maliciously crafted web content may lead to universal cross site scripting. (CVE-2019-8764)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in     watchOS 6.1, iCloud for Windows 11.0. Processing maliciously crafted web content may lead to arbitrary     code execution. (CVE-2019-8766)

  - Clear History and Website Data did not clear the history. The issue was addressed with improved data     deletion. This issue is fixed in macOS Catalina 10.15. A user may be unable to delete browsing history     items. (CVE-2019-8768)

  - An issue existed in the drawing of web page elements. The issue was addressed with improved logic. This     issue is fixed in iOS 13.1 and iPadOS 13.1, macOS Catalina 10.15. Visiting a maliciously crafted website     may reveal browsing history. (CVE-2019-8769)

  - This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in Safari 13.0.1,     iOS 13. Maliciously crafted web content may violate iframe sandboxing policy. (CVE-2019-8771)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0.
    Processing maliciously crafted web content may lead to arbitrary code execution. (CVE-2019-8782)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0,     iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2019-8783, CVE-2019-8814, CVE-2019-8815, CVE-2019-8819, CVE-2019-8821, CVE-2019-8822, CVE-2019-8823)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     13.2 and iPadOS 13.2, tvOS 13.2, watchOS 6.1, Safari 13.0.3, iTunes for Windows 12.10.2. Processing     maliciously crafted web content may lead to arbitrary code execution. (CVE-2019-8808, CVE-2019-8812)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     13.2 and iPadOS 13.2, tvOS 13.2, watchOS 6.1, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for     Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary     code execution. (CVE-2019-8811, CVE-2019-8816, CVE-2019-8820)

  - A logic issue was addressed with improved state management. This issue is fixed in iOS 13.2 and iPadOS     13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0. Processing     maliciously crafted web content may lead to universal cross site scripting. (CVE-2019-8813)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in     tvOS 13.3, iCloud for Windows 10.9, iOS 13.3 and iPadOS 13.3, Safari 13.0.4, iTunes 12.10.3 for Windows,     iCloud for Windows 7.16. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2019-8835)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in     tvOS 13.3, watchOS 6.1.1, iCloud for Windows 10.9, iOS 13.3 and iPadOS 13.3, Safari 13.0.4, iTunes 12.10.3     for Windows, iCloud for Windows 7.16. Processing maliciously crafted web content may lead to arbitrary     code execution. (CVE-2019-8844)

  - A use after free issue was addressed with improved memory management. This issue is fixed in tvOS 13.3,     iCloud for Windows 10.9, iOS 13.3 and iPadOS 13.3, Safari 13.0.4, iTunes 12.10.3 for Windows, iCloud for     Windows 7.16. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2019-8846)

  - WebKitGTK through 2.26.4 and WPE WebKit through 2.26.4 (which are the versions right before 2.28.0)     contains a memory corruption issue (use-after-free) that may lead to arbitrary code execution. This issue     has been fixed in 2.28.0 with improved memory handling. (CVE-2020-10018)

  - A use-after-free issue exists in WebKitGTK before 2.28.1 and WPE WebKit before 2.28.1 via crafted web     content that allows remote attackers to execute arbitrary code or cause a denial of service (memory     corruption and application crash). (CVE-2020-11793)

  - A denial of service issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1     and iPadOS 13.3.1, tvOS 13.3.1, Safari 13.0.5, iTunes for Windows 12.10.4, iCloud for Windows 11.0, iCloud     for Windows 7.17. A malicious website may be able to cause a denial of service. (CVE-2020-3862)

  - A logic issue was addressed with improved validation. This issue is fixed in iCloud for Windows 7.17,     iTunes 12.10.4 for Windows, iCloud for Windows 10.9.2, tvOS 13.3.1, Safari 13.0.5, iOS 13.3.1 and iPadOS     13.3.1. A DOM object context may not have had a unique security origin. (CVE-2020-3864)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     13.3.1 and iPadOS 13.3.1, tvOS 13.3.1, Safari 13.0.5, iTunes for Windows 12.10.4, iCloud for Windows 11.0,     iCloud for Windows 7.17. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2020-3865, CVE-2020-3868)

  - A logic issue was addressed with improved state management. This issue is fixed in iOS 13.3.1 and iPadOS     13.3.1, tvOS 13.3.1, Safari 13.0.5, iTunes for Windows 12.10.4, iCloud for Windows 11.0, iCloud for     Windows 7.17. Processing maliciously crafted web content may lead to universal cross site scripting.
    (CVE-2020-3867)

  - A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.4 and iPadOS 13.4,     tvOS 13.4, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for Windows 7.18. A     file URL may be incorrectly processed. (CVE-2020-3885)

  - A race condition was addressed with additional validation. This issue is fixed in iOS 13.4 and iPadOS     13.4, tvOS 13.4, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for Windows     7.18. An application may be able to read restricted memory. (CVE-2020-3894)

  - A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and     iPadOS 13.4, tvOS 13.4, watchOS 6.2, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3,     iCloud for Windows 7.18. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2020-3895, CVE-2020-3900)

  - A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and     iPadOS 13.4, tvOS 13.4, watchOS 6.2, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3,     iCloud for Windows 7.18. A remote attacker may be able to cause arbitrary code execution. (CVE-2020-3897)

  - A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.4     and iPadOS 13.4, tvOS 13.4, watchOS 6.2, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows     10.9.3, iCloud for Windows 7.18. A remote attacker may be able to cause arbitrary code execution.
    (CVE-2020-3899)

  - A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and     iPadOS 13.4, tvOS 13.4, watchOS 6.2, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3,     iCloud for Windows 7.18. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2020-3901)

  - An input validation issue was addressed with improved input validation. This issue is fixed in iOS 13.4     and iPadOS 13.4, tvOS 13.4, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for     Windows 7.18. Processing maliciously crafted web content may lead to a cross site scripting attack.
    (CVE-2020-3902)

  - A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 12.5.3.
    Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a     report that this issue may have been actively exploited.. (CVE-2021-30666)

  - A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 12.5.4.
    Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a     report that this issue may have been actively exploited.. (CVE-2021-30761)

  - A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.5.4.
    Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a     report that this issue may have been actively exploited.. (CVE-2021-30762)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4025 advisory.

  - Out of bounds write in Intel(R) PROSet/Wireless WiFi products on Windows 10 may allow an authenticated     user to potentially enable denial of service via local access. (CVE-2020-0569)

  - Uncontrolled search path in the QT Library before 5.14.0, 5.12.7 and 5.9.10 may allow an authenticated     user to potentially enable elevation of privilege via local access. (CVE-2020-0570)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:3911 advisory.

  - The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has     XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in     Lib/xmlrpc/server.py in Python 3.x. If set_server_title is called with untrusted input, arbitrary     JavaScript can be delivered to clients that visit the http URL for this server. (CVE-2019-16935)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:3878 advisory.

  - A vulnerability was found in dnsmasq before version 2.81, where the memory leak allows remote attackers to     cause a denial of service (memory consumption) via vectors involving DHCP response creation.
    (CVE-2019-14834)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:3971 advisory.

  - Hunspell 1.7.0 has an invalid read operation in SuggestMgr::leftcommonsubstring in suggestmgr.cxx.
    (CVE-2019-16707)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3869 advisory.

  - A Improper Control of Generation of Code vulnerability in the packaging of pcp of SUSE Linux Enterprise     High Performance Computing 15-ESPOS, SUSE Linux Enterprise High Performance Computing 15-LTSS, SUSE Linux     Enterprise Module for Development Tools 15, SUSE Linux Enterprise Module for Development Tools 15-SP1,     SUSE Linux Enterprise Module for Open Buildservice Development Tools 15, SUSE Linux Enterprise Server     15-LTSS, SUSE Linux Enterprise Server for SAP 15, SUSE Linux Enterprise Software Development Kit 12-SP4,     SUSE Linux Enterprise Software Development Kit 12-SP5; openSUSE Leap 15.1 allows the user pcp to run code     as root by placing it into /var/log/pcp/configs.sh This issue affects: SUSE Linux Enterprise High     Performance Computing 15-ESPOS pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise High Performance     Computing 15-LTSS pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Module for Development Tools     15 pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Module for Development Tools 15-SP1 pcp     versions prior to 4.3.1-3.5.3. SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 pcp     versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Server 15-LTSS pcp versions prior to 3.11.9-5.8.1.
    SUSE Linux Enterprise Server for SAP 15 pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Software     Development Kit 12-SP4 pcp versions prior to 3.11.9-6.14.1. SUSE Linux Enterprise Software Development Kit     12-SP5 pcp versions prior to 3.11.9-6.14.1. openSUSE Leap 15.1 pcp versions prior to 4.3.1-lp151.2.3.1.
    (CVE-2019-3695)

  - A Improper Limitation of a Pathname to a Restricted Directory vulnerability in the packaging of pcp of     SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterprise High Performance     Computing 15-LTSS, SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise Module for     Development Tools 15-SP1, SUSE Linux Enterprise Module for Open Buildservice Development Tools 15, SUSE     Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15, SUSE Linux Enterprise Software     Development Kit 12-SP4, SUSE Linux Enterprise Software Development Kit 12-SP5; openSUSE Leap 15.1 allows     local user pcp to overwrite arbitrary files with arbitrary content. This issue affects: SUSE Linux     Enterprise High Performance Computing 15-ESPOS pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise     High Performance Computing 15-LTSS pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Module for     Development Tools 15 pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Module for Development     Tools 15-SP1 pcp versions prior to 4.3.1-3.5.3. SUSE Linux Enterprise Module for Open Buildservice     Development Tools 15 pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Server 15-LTSS pcp versions     prior to 3.11.9-5.8.1. SUSE Linux Enterprise Server for SAP 15 pcp versions prior to 3.11.9-5.8.1. SUSE     Linux Enterprise Software Development Kit 12-SP4 pcp versions prior to 3.11.9-6.14.1. SUSE Linux     Enterprise Software Development Kit 12-SP5 pcp versions prior to 3.11.9-6.14.1. openSUSE Leap 15.1 pcp     versions prior to 4.3.1-lp151.2.3.1. (CVE-2019-3696)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:5003 advisory.

  - In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for     `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same     server. This vulnerability impacts software that uses httplib2 with uri constructed by string     concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0.
    (CVE-2020-11078)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:5099 advisory.

  - In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting in     an exploitable use-after-free condition. This vulnerability affects Firefox < 82.0.3, Firefox ESR <     78.4.1, and Thunderbird < 78.4.2. (CVE-2020-26950)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2020:5083 advisory.

  - hw: Information disclosure issue in Intel SGX via RAPL interface (CVE-2020-8695)

  - hw: Vector Register Leakage-Active (CVE-2020-8696)

  - hw: Fast forward store predictor (CVE-2020-8698)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:5002 advisory.

  - curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources     that can lead too overwriting a local file when the -J flag is used. (CVE-2020-8177)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:5020 advisory.

  - In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used     an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led     to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly     handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered     unlikely. (CVE-2020-1935)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:5040 advisory.

  - A double free memory issue was found to occur in the libvirt API, in versions before 6.8.0, responsible     for requesting information about network interfaces of a running QEMU domain. This flaw affects the polkit     access control driver. Specifically, clients connecting to the read-write socket with limited ACL     permissions could use this flaw to crash the libvirt daemon, resulting in a denial of service, or     potentially escalate their privileges on the system. The highest threat from this vulnerability is to data     confidentiality and integrity as well as system availability. (CVE-2020-25637)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:5004 advisory.

  - In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for     `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same     server. This vulnerability impacts software that uses httplib2 with uri constructed by string     concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0.
    (CVE-2020-11078)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:5021 advisory.

  - An issue was discovered in Qt through 5.12.9, and 5.13.x through 5.15.x before 5.15.1. read_xbm_body in     gui/image/qxbmhandler.cpp has a buffer over-read. (CVE-2020-17507)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5011 advisory.

  - In BIND 9.0.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.3-S1 -> 9.11.21-S1 of the     BIND 9 Supported Preview Edition, An attacker on the network path for a TSIG-signed request, or operating     the server receiving the TSIG-signed request, could send a truncated response to that request, triggering     an assertion failure, causing the server to exit. Alternately, an off-path attacker would have to     correctly guess when a TSIG-signed request was sent, along with other characteristics of the packet and     message, and spoof a truncated response to trigger an assertion failure, causing the server to exit.
    (CVE-2020-8622)

  - In BIND 9.10.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.10.5-S1 -> 9.11.21-S1 of the     BIND 9 Supported Preview Edition, An attacker that can reach a vulnerable system with a specially crafted     query packet can trigger a crash. To be vulnerable, the system must: * be running BIND that was built with
    --enable-native-pkcs11 * be signing one or more zones with an RSA key * be able to receive queries from     a possible attacker (CVE-2020-8623)

  - In BIND 9.9.12 -> 9.9.13, 9.10.7 -> 9.10.8, 9.11.3 -> 9.11.21, 9.12.1 -> 9.16.5, 9.17.0 -> 9.17.3, also     affects 9.9.12-S1 -> 9.9.13-S1, 9.11.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An     attacker who has been granted privileges to change a specific subset of the zone's content could abuse     these unintended additional privileges to update other contents of the zone. (CVE-2020-8624)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5023 advisory.

  - An issue was discovered in the Linux kernel before 5.0.6. In rx_queue_add_kobject() and     netdev_queue_add_kobject() in net/core/net-sysfs.c, a reference count is mishandled, aka CID-a3e23f719f5c.
    (CVE-2019-20811)

  - A flaw was found in the Linux kernel's implementation of the invert video code on VGA consoles when a     local attacker attempts to resize the console, calling an ioctl VT_RESIZE, which causes an out-of-bounds     write to occur. This flaw allows a local user with access to the VGA console to crash the system,     potentially escalating their privileges on the system. The highest threat from this vulnerability is to     data confidentiality and integrity as well as system availability. (CVE-2020-14331)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5010 advisory.

  - In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an     infinite loop when opened by tarfile.open, because _proc_pax lacks header validation. (CVE-2019-20907)

  - Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and     IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application     is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this     attacker can cause many dictionary entries to be created. This is fixed in: v3.5.10, v3.5.10rc1; v3.6.12;
    v3.7.9; v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1; v3.9.0, v3.9.0b4, v3.9.0b5, v3.9.0rc1, v3.9.0rc2.
    (CVE-2020-14422)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:5012 advisory.

  - A flaw was found in librepo in versions before 1.12.1. A directory traversal vulnerability was found where     it failed to sanitize paths in remote repository metadata. An attacker controlling a remote repository may     be able to copy files outside of the destination directory on the targeted system via path traversal. This     flaw could potentially result in system compromise via the overwriting of critical system files. The     highest threat from this flaw is to users that make use of untrusted third-party repositories.
    (CVE-2020-14352)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:5009 advisory.

  - In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an     infinite loop when opened by tarfile.open, because _proc_pax lacks header validation. (CVE-2019-20907)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:4182 advisory.

  - The Linux kernel before 5.1-rc5 allows page->_refcount reference count overflow, with resultant use-after-     free issues, if about 140 GiB of RAM exists. This is related to fs/fuse/dev.c, fs/pipe.c, fs/splice.c,     include/linux/mm.h, include/linux/pipe_fs_i.h, kernel/trace/trace.c, mm/gup.c, and mm/hugetlb.c. It can     occur with FUSE requests. (CVE-2019-11487)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:4183 advisory.

  - In BIND 9.0.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.3-S1 -> 9.11.21-S1 of the     BIND 9 Supported Preview Edition, An attacker on the network path for a TSIG-signed request, or operating     the server receiving the TSIG-signed request, could send a truncated response to that request, triggering     an assertion failure, causing the server to exit. Alternately, an off-path attacker would have to     correctly guess when a TSIG-signed request was sent, along with other characteristics of the packet and     message, and spoof a truncated response to trigger an assertion failure, causing the server to exit.
    (CVE-2020-8622)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:4330 advisory.

  - Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR     78.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some     of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.4,     Firefox < 82, and Thunderbird < 78.4. (CVE-2020-15683)

  - Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-15969)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:4946 advisory.

  - An integer overflow vulnerability leading to a double-free was found in libX11. This flaw allows a local     privileged attacker to cause an application compiled with libX11 to crash, or in some cases, result in     arbitrary code execution. The highest threat from this flaw is to confidentiality, integrity as well as     system availability. (CVE-2020-14363)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:4056 advisory.

  - An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before     5.2.0. This issue occurs while processing USB packets from a guest when USBDevice 'setup_len' exceeds its     'data_buf[4096]' in the do_token_in, do_token_out routines. This flaw allows a guest user to crash the     QEMU process, resulting in a denial of service, or the potential execution of arbitrary code with the     privileges of the QEMU process on the host. (CVE-2020-14364)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4348 advisory.

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization).
    Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
    Note: Applies to client and server deployment of Java. This vulnerability can be exploited through     sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying     data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed     Java applets, such as through a web service. (CVE-2020-14779)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JNDI). Supported     versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server     deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web     service. (CVE-2020-14781)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported     versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: Applies to     client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start     applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the     specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as     through a web service. (CVE-2020-14782, CVE-2020-14797)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Hotspot). Supported     versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other     than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or     delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to     a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of     Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java     applets. It can also be exploited by supplying data to APIs in the specified Component without using     sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.
    (CVE-2020-14792)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported     versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other     than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a     subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability does not apply to Java deployments, typically in servers, that load and run     only trusted code (e.g., code installed by an administrator). (CVE-2020-14796)

  - Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are     affected are Java SE: 11.0.8 and 15. Easily exploitable vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can     result in unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in     servers, that load and run only trusted code (e.g., code installed by an administrator). (CVE-2020-14803)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:4947 advisory.

  - Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR     78.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some     of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.4,     Firefox < 82, and Thunderbird < 78.4. (CVE-2020-15683)

  - Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-15969)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4953 advisory.

  - A flaw was found in X.Org Server before xorg-x11-server 1.20.9. An Out-Of-Bounds access in XkbSetNames     function may lead to a privilege escalation vulnerability. The highest threat from this vulnerability is     to data confidentiality and integrity as well as system availability. (CVE-2020-14345)

  - A flaw was found in xorg-x11-server before 1.20.9. An integer underflow in the X input extension protocol     decoding in the X server may lead to arbitrary access of memory contents. The highest threat from this     vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-14346)

  - A flaw was found in X.Org Server before xorg-x11-server 1.20.9. An Integer underflow leading to heap-     buffer overflow may lead to a privilege escalation vulnerability. The highest threat from this     vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-14361,     CVE-2020-14362)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:4072 advisory.

  - libcroco through 0.6.13 has excessive recursion in cr_parser_parse_any_core in cr-parser.c, leading to     stack consumption. (CVE-2020-12825)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4079 advisory.

  - An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before     5.2.0. This issue occurs while processing USB packets from a guest when USBDevice 'setup_len' exceeds its     'data_buf[4096]' in the do_token_in, do_token_out routines. This flaw allows a guest user to crash the     QEMU process, resulting in a denial of service, or the potential execution of arbitrary code with the     privileges of the QEMU process on the host. (CVE-2020-14364)

  - A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows     crafted packets to cause a denial of service. (CVE-2020-1983)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4910 advisory.

  - A flaw was found in X.Org Server before xorg-x11-server 1.20.9. An Out-Of-Bounds access in XkbSetNames     function may lead to a privilege escalation vulnerability. The highest threat from this vulnerability is     to data confidentiality and integrity as well as system availability. (CVE-2020-14345)

  - A flaw was found in xorg-x11-server before 1.20.9. An integer underflow in the X input extension protocol     decoding in the X server may lead to arbitrary access of memory contents. The highest threat from this     vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-14346)

  - A flaw was found in X.Org Server before xorg-x11-server 1.20.9. An Integer underflow leading to heap-     buffer overflow may lead to a privilege escalation vulnerability. The highest threat from this     vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-14361,     CVE-2020-14362)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:4909 advisory.

  - Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR     78.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some     of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.4,     Firefox < 82, and Thunderbird < 78.4. (CVE-2020-15683)

  - Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-15969)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4307 advisory.

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization).
    Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
    Note: Applies to client and server deployment of Java. This vulnerability can be exploited through     sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying     data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed     Java applets, such as through a web service. (CVE-2020-14779)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JNDI). Supported     versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server     deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web     service. (CVE-2020-14781)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported     versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: Applies to     client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start     applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the     specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as     through a web service. (CVE-2020-14782, CVE-2020-14797)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Hotspot). Supported     versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other     than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or     delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to     a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of     Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java     applets. It can also be exploited by supplying data to APIs in the specified Component without using     sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.
    (CVE-2020-14792)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported     versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other     than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a     subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability does not apply to Java deployments, typically in servers, that load and run     only trusted code (e.g., code installed by an administrator). (CVE-2020-14796)

  - Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are     affected are Java SE: 11.0.8 and 15. Easily exploitable vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can     result in unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in     servers, that load and run only trusted code (e.g., code installed by an administrator). (CVE-2020-14803)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:4187 advisory.

  - Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote     display system, before spice-0.14.2-1. Both the SPICE client (spice-gtk) and server are affected by these     flaws. These flaws allow a malicious client or server to send specially crafted messages that, when     processed by the QUIC image compression algorithm, result in a process crash or potential code execution.
    (CVE-2020-14355)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:4908 advisory.

  - An integer overflow vulnerability leading to a double-free was found in libX11. This flaw allows a local     privileged attacker to cause an application compiled with libX11 to crash, or in some cases, result in     arbitrary code execution. The highest threat from this flaw is to confidentiality, integrity as well as     system availability. (CVE-2020-14363)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:4310 advisory.

  - Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR     78.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some     of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.4,     Firefox < 82, and Thunderbird < 78.4. (CVE-2020-15683)

  - Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-15969)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4350 advisory.

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization).
    Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
    Note: Applies to client and server deployment of Java. This vulnerability can be exploited through     sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying     data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed     Java applets, such as through a web service. (CVE-2020-14779)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JNDI). Supported     versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server     deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web     service. (CVE-2020-14781)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported     versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: Applies to     client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start     applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the     specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as     through a web service. (CVE-2020-14782, CVE-2020-14797)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Hotspot). Supported     versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other     than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or     delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to     a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of     Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java     applets. It can also be exploited by supplying data to APIs in the specified Component without using     sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.
    (CVE-2020-14792)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported     versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other     than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a     subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability does not apply to Java deployments, typically in servers, that load and run     only trusted code (e.g., code installed by an administrator). (CVE-2020-14796)

  - Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are     affected are Java SE: 11.0.8 and 15. Easily exploitable vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can     result in unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in     servers, that load and run only trusted code (e.g., code installed by an administrator). (CVE-2020-14803)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4076 advisory.

  - When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger     an out-of-bounds read in the Network Security Services (NSS) library. This could lead to information     disclosure. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
    (CVE-2019-11719)

  - A vulnerability exists where it possible to force Network Security Services (NSS) to sign     CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in     CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This     vulnerability affects Firefox < 68. (CVE-2019-11727)

  - Improper refcounting of soft token session objects could cause a use-after-free and crash (likely limited     to a denial of service). This vulnerability affects Firefox < 71. (CVE-2019-11756)

  - In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length     checks. In cases where the application calling the library did not perform a sanity check on the inputs it     could result in a crash due to a buffer overflow. (CVE-2019-17006)

  - After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting     in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming     Application Data records will be ignored. This vulnerability affects Firefox < 72. (CVE-2019-17023)

  - When converting coordinates from projective to affine, the modular inversion was not performed in constant     time, resulting in a possible timing-based side channel attack. This vulnerability affects Firefox < 80     and Firefox for Android < 80. (CVE-2020-12400)

  - During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar     multiplication was removed, resulting in variable-time execution dependent on secret data. This     vulnerability affects Firefox < 80 and Firefox for Android < 80. (CVE-2020-12401)

  - During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean     Algorithm which entailed significantly input-dependent flow. This allowed an attacker able to perform     electromagnetic-based side channel attacks to record traces leading to the recovery of the secret primes.
    *Note:* An unmodified Firefox browser does not generate RSA keys in normal operation and is not affected,     but products built on top of it might. This vulnerability affects Firefox < 78. (CVE-2020-12402)

  - A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55. When using     multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling     multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest     threat from this vulnerability is to confidentiality and system availability. (CVE-2020-12403)

  - When performing EC scalar point multiplication, the wNAF point multiplication algorithm was used; which     leaked partial information about the nonce used during signature generation. Given an electro-magnetic     trace of a few signature generations, the private key could have been computed. This vulnerability affects     Firefox < 80 and Firefox for Android < 80. (CVE-2020-6829)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4082 advisory.

  - An issue was discovered in Squid before 4.10. It allows a crafted FTP server to trigger disclosure of     sensitive information from heap memory, such as information associated with other users' sessions or non-     Squid processes. (CVE-2019-12528)

  - An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. A     Request Smuggling and Poisoning attack can succeed against the HTTP cache. The client sends an HTTP     request with a Content-Length header containing +\ - or an uncommon shell whitespace character prefix     to the length field-value. (CVE-2020-15049)

  - An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP     Request Smuggling attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This     allows any client, including browser scripts, to bypass local security and poison the proxy cache and any     downstream caches with content from an arbitrary source. When configured for relaxed header parsing (the     default), Squid relays headers containing whitespace characters to upstream servers. When this occurs as a     prefix to a Content-Length header, the frame length specified will be ignored by Squid (allowing for a     conflicting length to be used from another Content-Length header) but relayed upstream. (CVE-2020-15810)

  - An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP     Request Splitting attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This     allows any client, including browser scripts, to bypass local security and poison the browser cache and     any downstream caches with content from an arbitrary source. Squid uses a string search instead of parsing     the Transfer-Encoding header to find chunked encoding. This allows an attacker to hide a second request     inside Transfer-Encoding: it is interpreted by Squid as chunked and split out into a second request     delivered upstream. Squid will then deliver two distinct responses to the client, corrupting any     downstream caches. (CVE-2020-15811)

  - Squid before 4.13 and 5.x before 5.0.4 allows a trusted peer to perform Denial of Service by consuming all     available CPU cycles during handling of a crafted Cache Digest response message. This only occurs when     cache_peer is used with the cache digests feature. The problem exists because peerDigestHandleReply()     livelocking in peer_digest.cc mishandles EOF. (CVE-2020-24606)

  - An issue was discovered in Squid before 4.10. Due to incorrect input validation, it can interpret crafted     HTTP requests in unexpected ways to access server resources prohibited by earlier security filters.
    (CVE-2020-8449)

  - An issue was discovered in Squid before 4.10. Due to incorrect buffer management, a remote client can     cause a buffer overflow in a Squid instance acting as a reverse proxy. (CVE-2020-8450)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:4907 advisory.

  - Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-15999)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:4041 advisory.

  - In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can     result in denial of service (daemon crash). (CVE-2020-12243)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:3898 advisory.

  - The default cloud-init configuration, in cloud-init 0.6.2 and newer, included ssh_deletekeys: 0,     disabling cloud-init's deletion of ssh host keys. In some environments, this could lead to instances     created by cloning a golden master or template system, sharing ssh host keys, and being able to     impersonate one another or conduct man-in-the-middle attacks. (CVE-2018-10896)

  - cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for     attackers to predict passwords, because rand_str in cloudinit/util.py calls the random.choice function.
    (CVE-2020-8631)

  - In cloud-init through 19.4, rand_user_password in cloudinit/config/cc_set_passwords.py has a small default     pwlen value, which makes it easier for attackers to guess passwords. (CVE-2020-8632)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:3916 advisory.

  - Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. (CVE-2019-5482)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:3970 advisory.

  - A flaw was found in mod_auth_openidc before version 2.4.0.1. An open redirect issue exists in URLs with     trailing slashes similar to CVE-2019-3877 in mod_auth_mellon. (CVE-2019-14857)

  - A flaw was found in mod_auth_openidc before version 2.4.1. An open redirect issue exists in URLs with a     slash and backslash at the beginning. (CVE-2019-20479)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4000 advisory.

  - qemu/qemu_driver.c in libvirt before 6.0.0 mishandles the holding of a monitor job during a query to a     guest agent, which allows attackers to cause a denial of service (API blockage). (CVE-2019-20485)

  - A NULL pointer dereference was found in the libvirt API responsible introduced in upstream version 3.10.0,     and fixed in libvirt 6.0.0, for fetching a storage pool based on its target path. In more detail, this     flaw affects storage pools created without a target path such as network-based pools like gluster and RBD.
    Unprivileged users with a read-only connection could abuse this flaw to crash the libvirt daemon,     resulting in a potential denial of service. (CVE-2020-10703)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3888 advisory.

  - The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has     XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in     Lib/xmlrpc/server.py in Python 3.x. If set_server_title is called with untrusted input, arbitrary     JavaScript can be delivered to clients that visit the http URL for this server. (CVE-2019-16935)

  - Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1     allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client     because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking. (CVE-2020-8492)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3873 advisory.

  - Buffer overflow in srtp.c in libsrtp in srtp 1.4.5 and earlier allows remote attackers to cause a denial     of service (crash) via vectors related to a length inconsistency in the     crypto_policy_set_from_profile_for_rtp and srtp_protect functions. (CVE-2013-2139)

  - The encryption-processing feature in Cisco libSRTP before 1.5.3 allows remote attackers to cause a denial     of service via crafted fields in SRTP packets, aka Bug ID CSCux00686. (CVE-2015-6360)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:3981 advisory.

  - All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where     if it is set with log level = 3 (or above) then the string obtained from the client, after a failed     character conversion, is printed. Such strings can be provided during the NTLMSSP authentication exchange.
    In the Samba AD DC in particular, this may cause a long-lived process(such as the RPC server) to     terminate. (In the file server case, the most likely target, smbd, operates as process-per-client and so a     crash there is harmless). (CVE-2019-14907)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:4030 advisory.

  - Exiv2 0.27.2 allows attackers to trigger a crash in Exiv2::getULong in types.cpp when called from     Exiv2::Internal::CiffDirectory::readDirectory in crwimage_int.cpp, because there is no validation of the     relationship of the total size to the offset and size. (CVE-2019-17402)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Severity
144004	CentOS 7 : firefox (RHSA-2020:5239)	high
143910	CentOS 7 : thunderbird (RHSA-2020:5235)	high
143288	CentOS 7 : webkitgtk4 (RHSA-2020:4035)	critical
143287	CentOS 7 : qt5-qtbase (RHSA-2020:4025)	high
143286	CentOS 7 : python (RHSA-2020:3911)	medium
143285	CentOS 7 : dnsmasq (RHSA-2020:3878)	low
143284	CentOS 7 : hunspell (RHSA-2020:3971)	medium
143283	CentOS 7 : pcp (RHSA-2020:3869)	high
143122	CentOS 7 : fence-agents (RHSA-2020:5003)	medium
143114	CentOS 7 : firefox (RHSA-2020:5099)	high
143113	CentOS 7 : microcode_ctl (CESA-2020:5083)	medium
143057	CentOS 7 : curl (RHSA-2020:5002)	high
143056	CentOS 7 : tomcat (RHSA-2020:5020)	medium
143055	CentOS 7 : libvirt (RHSA-2020:5040)	medium
143052	CentOS 7 : resource-agents (RHSA-2020:5004)	medium
143051	CentOS 7 : qt and qt5-qtbase (RHSA-2020:5021)	medium
143050	CentOS 7 : bind (RHSA-2020:5011)	medium
143049	CentOS 7 : kernel (RHSA-2020:5023)	medium
143048	CentOS 7 : python3 (RHSA-2020:5010)	high
143047	CentOS 7 : librepo (RHSA-2020:5012)	high
143046	CentOS 7 : python (RHSA-2020:5009)	high
142651	CentOS 6 : kernel (RHSA-2020:4182)	high
142650	CentOS 6 : bind (RHSA-2020:4183)	medium
142649	CentOS 6 : firefox (RHSA-2020:4330)	critical
142648	CentOS 6 : libX11 (RHSA-2020:4946)	high
142647	CentOS 6 : qemu-kvm (RHSA-2020:4056)	medium
142646	CentOS 6 : java-1.8.0-openjdk (RHSA-2020:4348)	medium
142645	CentOS 6 : thunderbird (RHSA-2020:4947)	critical
142644	CentOS 6 : xorg-x11-server (RHSA-2020:4953)	high
142609	CentOS 7 : libcroco (RHSA-2020:4072)	high
142608	CentOS 7 : qemu-kvm (RHSA-2020:4079)	medium
142607	CentOS 7 : xorg-x11-server (RHSA-2020:4910)	high
142606	CentOS 7 : thunderbird (RHSA-2020:4909)	critical
142605	CentOS 7 : java-11-openjdk (RHSA-2020:4307)	medium
142604	CentOS 7 : spice and spice-gtk (RHSA-2020:4187)	medium
142603	CentOS 7 : libX11 (RHSA-2020:4908)	high
142602	CentOS 7 : firefox (RHSA-2020:4310)	critical
142601	CentOS 7 : java-1.8.0-openjdk (RHSA-2020:4350)	medium
142600	CentOS 7 : nss and nspr (RHSA-2020:4076)	critical
142599	CentOS 7 : squid (RHSA-2020:4082)	high
142598	CentOS 7 : freetype (RHSA-2020:4907)	medium
141636	CentOS 7 : openldap (RHSA-2020:4041)	high
141635	CentOS 7 : cloud-init (RHSA-2020:3898)	high
141634	CentOS 7 : curl (RHSA-2020:3916)	critical
141633	CentOS 7 : mod_auth_openidc (RHSA-2020:3970)	medium
141632	CentOS 7 : libvirt (RHSA-2020:4000)	medium
141631	CentOS 7 : python3 (RHSA-2020:3888)	medium
141630	CentOS 7 : libsrtp (RHSA-2020:3873)	high
141629	CentOS 7 : samba (RHSA-2020:3981)	medium
141626	CentOS 7 : exiv2 (RHSA-2020:4030)	medium

Detections

Analytics

CentOS Local Security Checks Family for Nessus

high

high

critical

high

medium

low

medium

high

medium

high

medium

high

medium

medium

medium

medium

medium

medium

high

high

high

high

medium

critical

high

medium

medium

critical

high

high

medium

high

critical

medium

medium

high

critical

medium

critical

high

medium

high

high

critical

medium

medium

medium

high

medium

medium