The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:5168 advisory.

    Eclipse is an integrated development environment (IDE).

    The rh-eclipse packages have been upgraded to version 4.17, which is based on the Eclipse Foundation's     2020-09 release train.

    For instructions on how to use rh-eclipse, see Using Eclipse linked from the References section.

    Security Fix(es):

    * jetty: local temporary directory hijacking vulnerability (CVE-2020-27216)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Changes chapter in the Using Eclipse guide     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Red Hat Enterprise Linux CoreOS 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2517 advisory.

  - jetty: local temporary directory hijacking vulnerability (CVE-2020-27216)

  - jetty: buffer not correctly recycled in Gzip Request inflation (CVE-2020-27218)

  - jetty: request containing multiple Accept headers with a large number of quality parameters may lead to     DoS (CVE-2020-27223)

  - jenkins-2-plugins/config-file-provider: Does not configure its XML parser to prevent XML external entity     (XXE) attacks. (CVE-2021-21642)

  - jenkins-2-plugins/config-file-provider: Does not correctly perform permission checks in several HTTP     endpoints. (CVE-2021-21643)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of IBM Cognos Analytics installed on the remote host is prior to 11.2.4 FP4 or 12.0.4. It is, therefore, affected by multiple vulnerabilities as referenced in the 7173592 advisory.

  - An arbitrary file upload vulnerability in formidable v3.1.4 allows attackers to execute arbitrary code via     a crafted filename. NOTE: some third parties dispute this issue because the product has common use cases     in which uploading arbitrary files is the desired behavior. Also, there are configuration options in all     versions that can change the default behavior of how files are handled. Strapi does not consider this to     be a valid vulnerability. (CVE-2022-29622)

  - Node.js IP package could allow a remote attacker to execute arbitrary code on the system, caused by a     server-side request forgery flaw in the ip.isPublic() function. By sending a specially crafted request     using a hexadecimal representation of a private IP address, an attacker could exploit this vulnerability     to execute arbitrary code on the system and obtain sensitive information. (CVE-2023-42282)   
  - Multiple vendors are vulnerable to a denial of service, caused by a flaw in handling multiplexed streams     in the HTTP/2 protocol. By sending numerous HTTP/2 requests and RST_STREAM frames over multiple streams, a     remote attacker could exploit this vulnerability to cause a denial of service due to server resource     consumption. (CVE-2023-44487)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Oracle Siebel CRM installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2021 CPU advisory.

  - Vulnerability in the Siebel Core - Server Framework product of Oracle Siebel CRM (component: Services     (jackson-databind)). Supported versions that are affected are 21.5 and Prior. Difficult to exploit     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Core -     Server Framework. Successful attacks of this vulnerability can result in takeover of Siebel Core - Server     Framework. (CVE-2020-24750)

  - Vulnerability in the Siebel Core - Automation product of Oracle Siebel CRM (component: Test Automation     (Eclipse Jetty)). Supported versions that are affected are 21.5 and Prior. Easily exploitable     vulnerability allows low privileged attacker with logon to the infrastructure where Siebel Core -     Automation executes to compromise Siebel Core - Automation. Successful attacks of this vulnerability can     result in takeover of Siebel Core - Automation. (CVE-2020-27216)

  - Vulnerability in the Siebel Core - Server Framework product of Oracle Siebel CRM (component: Cloud Gateway     (Zookeeper)). Supported versions that are affected are 21.5 and Prior. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Siebel Core - Server Framework.
    Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of Siebel Core - Server Framework. (CVE-2017-5637)

  - Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Email Marketing     Stand-Alone). Supported versions that are affected are 21.5 and Prior. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Marketing.
    Successful attacks require human interaction from a person other than the attacker and while the     vulnerability is in Siebel Apps - Marketing, attacks may significantly impact additional products.
    Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to     some of Siebel Apps - Marketing accessible data as well as unauthorized read access to a subset of Siebel     Apps - Marketing accessible data. (CVE-2021-2338)

  - Vulnerability in the Siebel CRM product of Oracle Siebel CRM (component: Siebel Core - Server     Infrastructure). Supported versions that are affected are 21.5 and Prior. Difficult to exploit     vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Siebel CRM.
    Successful attacks of this vulnerability can result in unauthorized access to critical data or complete     access to all Siebel CRM accessible data. (CVE-2021-2368)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2517 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution     designed for on-premise or private cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container Platform 3.11.462. See the     following advisory for the container images for this release:

    https://access.redhat.com/errata/RHBA-2021:2516

    Space precludes documenting all of the bug fixes and enhancements in this advisory. See the following     Release Notes documentation, which will be updated shortly for this release, for details about these     changes:

    https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

    All OpenShift Container Platform 3.11 users are advised to upgrade to these updated packages and images.

    Security Fix(es):

    * jenkins-2-plugins/config-file-provider: Does not configure its XML parser to prevent XML external entity     (XXE) attacks. (CVE-2021-21642)

    * jetty: local temporary directory hijacking vulnerability (CVE-2020-27216)

    * jetty: buffer not correctly recycled in Gzip Request inflation (CVE-2020-27218)

    * jetty: request containing multiple Accept headers with a large number of quality parameters may lead     to DoS (CVE-2020-27223)

    * jenkins-2-plugins/config-file-provider: Does not correctly perform permission checks in several HTTP     endpoints. (CVE-2021-21643)

    * jenkins-2-plugins/config-file-provider: does not require POST requests for an HTTP endpoint, resulting     in a cross-site request forgery (CSRF) vulnerability. (CVE-2021-21644)

    * jenkins-2-plugins/config-file-provider: Does not perform permission checks in several HTTP endpoints.
    (CVE-2021-21645)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1     thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on     that system. A collocated user can observe the process of creating a temporary sub directory in the shared     temporary directory and race to complete the creation of the temporary subdirectory. If the attacker wins     the race then they will have read and write permission to the subdirectory used to unpack web     applications, including their WEB-INF/lib jar files and JSP files. If any code is ever executed out of     this temporary directory, this can lead to a local privilege escalation vulnerability. (CVE-2020-27216)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名稱	產品	系列	已發布	已更新	嚴重性
143213	RHEL 7 : rh-eclipse (RHSA-2020:5168)	Nessus	Red Hat Local Security Checks	2020/11/24	2024/11/7	high
312499	RHCOS 3 : OpenShift Container Platform 3.11.462 (RHSA-2021:2517)	Nessus	Red Hat Local Security Checks	2026/5/6	2026/5/7	high
213274	IBM Cognos Analytics 11.2.x < 11.2.4 FP4 / 12.0.x < 12.0.4 Multiple Vulnerabilities (7173592)	Nessus	CGI abuses	2024/12/20	2025/4/3	critical
212428	Oracle Siebel Server (July 2021 CPU)	Nessus	Misc.	2024/12/11	2024/12/12	high
151276	RHEL 7 : OpenShift Container Platform 3.11.462 (RHSA-2021:2517)	Nessus	Red Hat Local Security Checks	2021/7/1	2024/11/7	high
223564	Linux Distros Unpatched Vulnerability : CVE-2020-27216	Nessus	Misc.	2025/3/4	2026/11/6	high

偵測

搜尋 Plugin

high

high

critical

high

high

high