According to the versions of the ant package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of     memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt     builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected. (CVE-2021-36373)

  - When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to     allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be     used to disrupt builds using Apache Ant. Commonly used derived formats from ZIP archives are for instance     JAR files and many office files. Apache Ant prior to 1.9.16 and 1.10.11 were affected. (CVE-2021-36374)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of ant installed on the remote host is prior to 1.9.16-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1880 advisory.

    When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to     allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be     used to disrupt builds using Apache Ant. Commonly used derived formats from ZIP archives are for instance     JAR files and many office files. Apache Ant prior to 1.9.16 and 1.10.11 were affected. (CVE-2021-36374)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle WebLogic Server installed on the remote host is missing a security patch from the October 2023 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilities, including:

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core (Apache     Commons BCEL)). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic     Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server     (CVE-2022-42920)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized     Thirdparty Jars (Apache Maven Shared Utils)). The supported version that is affected is 14.1.1.0.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of     Oracle WebLogic Server. (CVE-2022-29599)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).
    Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability     allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server.
    Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.
    (CVE-2023-22069)

  Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of ant / javapackages-bootstrap installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2021-36374 advisory.

  - When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to     allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be     used to disrupt builds using Apache Ant. Commonly used derived formats from ZIP archives are for instance     JAR files and many office files. Apache Ant prior to 1.9.16 and 1.10.11 were affected. (CVE-2021-36374)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21891-1 advisory.

    - CVE-2021-36374: excessive memory allocation when reading a specially crafted ZIP archive or a derived     formats       (bsc#1188469).
    - CVE-2025-7962: jakarta: improper neutralization of \r and \n UTF-8 characters can lead to SMTP injection       (bsc#1246873).
    - CVE-2026-78254: path traversal in ftp and scp tasks allows for arbitrary file writes (bsc#1280015).

    Changes for ant:

    - Upgrade to version 1.10.18
     * Breaking changes:
     + the default value for <ftp>'s useSecureDataChannel has been      changed to true which means using ftps now also tries to use      an encrypted data channel by default.
     + the <ftp> and <scp> tasks have new allowFilesToEscapeDest      attributes. When set to false - which is the default - the      tasks will not download files or create directories outside      the designated destination directory when downloading from the      remote server. In the unlikely case you need the old bahaviour      of writing outside the destination directory you must set the      value to true explicitly.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4677-1 advisory.

    This update introduces new libraries and refines existing Java tools to     improve security, compatibility, stability, and formatting.

    ant (Updated to version 1.10.18):

    - Security issues fixed:

      - CVE-2021-36374: Fixed excessive memory allocation when reading specially crafted ZIP archives or     derived formats         (bsc#1188469)
      - CVE-2025-7962: Fixed improper neutralization of line breaks to prevent SMTP injection (bsc#1246873)
      - CVE-2026-78254: Fixed path traversal in FTP and SCP tasks that could allow arbitrary file writes     (bsc#1280015)


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to     allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be     used to disrupt builds using Apache Ant. Commonly used derived formats from ZIP archives are for instance     JAR files and many office files. Apache Ant prior to 1.9.16 and 1.10.11 were affected. (CVE-2021-36374)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Primavera Unifier installed on the remote host is affected by multiple vulnerabilities as referenced in the October 2021 CPU advisory, including the following:

  - An easily exploitable vulnerability in the File Management component of Primavera Unifier that allows an     unauthenticated, remote attacker to compromise availability. (CVE-2021-36090)

  - An easily exploitable vulnerability in the Platform, UI (Lodash) component of Primavera Unifier that     allows a remote, high privileged attacker to compromise confidentiality, integrity, and availability.
    (CVE-2021-23337)

  - An easily exploitable vulnerability in the Platform (Apache Tika) component of Primavera unifier that     allows an unauthenticated attacker to compromise availability. (CVE-2021-28657)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
155281	EulerOS 2.0 SP5 : ant (EulerOS-SA-2021-2651)	Nessus	Huawei Local Security Checks	2021/11/11	2023/11/23	medium
168454	Amazon Linux 2 : ant (ALAS-2022-1880)	Nessus	Amazon Linux Local Security Checks	2022/12/7	2024/12/11	medium
183311	Oracle WebLogic Server (October 2023 CPU)	Nessus	Misc.	2023/10/18	2026/2/24	critical
161561	EulerOS 2.0 SP3 : ant (EulerOS-SA-2022-1703)	Nessus	Huawei Local Security Checks	2022/5/26	2023/10/26	medium
217097	CBL Mariner 2.0 Security Update: ant / javapackages-bootstrap (CVE-2021-36374)	Nessus	MarinerOS Local Security Checks	2025/3/3	2025/3/3	medium
350151	openSUSE 16: ant / ant-antlr / ant-apache-bcel / ant-apache-bsf / etc (openSUSE-SU-2026:21891-1)	Nessus	SuSE Local Security Checks	2026/9/25	2026/9/25	medium
366400	SUSE SLED15: ant / ant-antlr / ant-apache-bcel / ant-apache-bsf / etc (SUSE-SU-2026:4677-1)	Nessus	SuSE Local Security Checks	2026/10/16	2026/10/16	medium
223940	Linux Distros Unpatched Vulnerability : CVE-2021-36374	Nessus	Misc.	2025/3/5	2026/11/7	medium
154262	Oracle Primavera Unifier (Oct 2021 CPU)	Nessus	CGI abuses	2021/10/20	2023/11/28	high

偵測

搜尋 Plugin

medium

medium

critical

medium

medium

medium

medium

medium

high