According to the versions of the rsync package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many     distant matches. (CVE-2018-25032)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2022:0182 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2018-25032:
    zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many     distant matches.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:7813 advisory.

    * zlib: A flaw found in zlib when compressing (not decompressing) certain inputs (CVE-2018-25032)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 6.1.1.5. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-6.1.1.5 advisory.

  - If a web application sends a WebSocket message concurrently with the WebSocket connection closing when     running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the     application will continue to use the socket after it has been closed. The error handling triggered in this     case could cause the a pooled object to be placed in the pool twice. This could result in subsequent     connections using the same object concurrently which could result in data being returned to the wrong use     and/or other errors. (CVE-2022-25762)

  - An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the     attacker's chosen file name (for example, a crafted file name), this can overwrite an attacker's content     to an arbitrary attacker-selected file. This flaw occurs due to insufficient validation when processing     filenames with two or more newlines where selected content and the target file names are embedded in     crafted multi-line file names. This flaw allows a remote, low privileged attacker to force zgrep to write     arbitrary files on the system. (CVE-2022-1271)

  - The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and     8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an     untrusted network. This was not correct. While the EncryptInterceptor does provide confidentiality and     integrity protection, it does not protect against all risks associated with running over any untrusted     network, particularly DoS risks. (CVE-2022-29885)

  - zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many     distant matches. (CVE-2018-25032)

  - A vulnerability was found in the Linux kernel's cgroup_release_agent_write in the     kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups     v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.
    (CVE-2022-0492)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Amazon Corretto installed on the remote host is prior to 18 < 18.0.1.10.1. It is, therefore, affected by multiple vulnerabilities as referenced in the corretto-18-2022-Apr-19 advisory.

  - zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many     distant matches. (CVE-2018-25032)

  - xml/jaxp (CVE-2022-21426)

  - core-libs/java.lang (CVE-2022-21434)

  - security-libs/java.security (CVE-2022-21443, CVE-2022-21449)

  - core-libs/javax.naming (CVE-2022-21496)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Amazon Corretto installed on the remote host is prior to 17 < 17.0.3.6.1. It is, therefore, affected by multiple vulnerabilities as referenced in the corretto-17-2022-Apr-17 advisory.

  - zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many     distant matches. (CVE-2018-25032)

  - xml/jaxp (CVE-2022-21426)

  - core-libs/java.lang (CVE-2022-21434)

  - security-libs/java.security (CVE-2022-21443, CVE-2022-21449)

  - core-libs/javax.naming (CVE-2022-21496)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of IBM Engineering Requirements Management DOORS (formerly IBM Rational DOORS) installed on the remote host is 9.6.1.1 prior or equal to 9.6.1.13 or 9.7.2.1 prior or equal to 9.7.2.11. It is, therefore, affected by multiple vulnerabilities as referenced in the 7279145 advisory.

  - IBM DOORS Web Access do not limit the length of a connection which could allow for a Slowloris HTTP denial     of service attack to take place. This can cause the web server to become unresponsive. (CVE-2024-25039)

  - IBM DOORS Web Access is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated     attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality     potentially leading to credentials disclosure within a trusted session. (CVE-2025-0152)

  - IBM DOORS Web Access could allow a remote attacker to obtain sensitive information when a detailed     technical error message is returned in the browser. This information could be used in further attacks     against the system. (CVE-2020-4984)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
176784	EulerOS Virtualization 2.11.0 : rsync (EulerOS-SA-2023-2099)	Nessus	Huawei Local Security Checks	2023/6/7	2023/6/7	high
236438	Alibaba Cloud Linux 3 : 0182: mingw-zlib (ALINUX3-SA-2022:0182)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	high
280093	RockyLinux 8 : mingw-zlib (RLSA-2022:7813)	Nessus	Rocky Linux Local Security Checks	2025/12/27	2025/12/27	high
164600	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.1.1.5)	Nessus	Misc.	2022/9/1	2026/6/3	high
167224	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.20.5)	Nessus	Misc.	2022/11/9	2026/6/3	critical
159896	Amazon Corretto Java 18.x < 18.0.1.10.1 Multiple Vulnerabilities	Nessus	Misc.	2022/4/19	2024/11/27	medium
159900	Amazon Corretto Java 17.x < 17.0.3.6.1 Multiple Vulnerabilities	Nessus	Misc.	2022/4/19	2024/11/27	medium
333335	IBM Engineering Requirements Management DOORS 9.6.1.1 <= 9.6.1.13 / 9.7.2.1 < 9.7.2.11 Multiple Vulnerabilities (7279145)	Nessus	Windows	2026/8/7	2026/8/8	high

检测

插件搜索

high

high

high

high

critical

medium

medium

high