The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2019-3891:04 advisory.

    * A flaw was found in the implementation of the fill buffer, a mechanism used by modern CPUs when a     cache-miss is made on L1 CPU cache. If an attacker can generate a load operation that would create a page     fault, the execution will continue speculatively with incorrect data from the fill buffer while the data     is fetched from higher level caches. This response time can be measured to infer data in the fill buffer.
    (CVE-2018-12130)
      * Modern Intel microprocessors implement hardware-level micro-optimizations to improve the performance     of writing data back to CPU caches. The write operation is split into STA (STore Address) and STD (STore     Data) sub-operations. These sub-operations allow the processor to hand-off address generation logic into     these sub-operations for optimized writes. Both of these sub-operations write to a shared distributed     processor structure called the 'processor store buffer'. As a result, an unprivileged attacker could use     this flaw to read private data resident within the CPU's processor store buffer. (CVE-2018-12126)
      * Microprocessors use a load port subcomponent to perform load operations from memory or IO. During a     load operation, the load port receives data from the memory or IO subsystem and then provides the data to     the CPU registers and operations in the CPUs pipelines. Stale load operations results are stored in the     'load port' table until overwritten by newer operations. Certain load-port operations triggered by an     attacker can be used to reveal data about previous stale requests leaking data back to the attacker via a     timing side-channel. (CVE-2018-12127)
      * Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated     user to potentially enable information disclosure via a side channel with local access. (CVE-2019-11091)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003143 advisory.

    Microarchitectural Load Port Data Sampling (MLPDS): Load ports on some microprocessors utilizing     speculative execution may allow an authenticated user to potentially enable information disclosure via a     side channel with local access. A list of impacted products can be found here:
    https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-     update-guidance_05132019.pdf

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 4499165 or cumulative update 4499151. It is, therefore, affected by multiple vulnerabilities :

  - A new subclass of speculative execution side channel vulnerabilities,     known as Microarchitectural Data Sampling, exist in Windows.
    An attacker who successfully exploited these vulnerabilities     may be able to read privileged data across trust boundaries.     In shared resource environments (such as exists in some cloud     services configurations), these vulnerabilities could allow     one virtual machine to improperly access information from     another. In non-browsing scenarios on standalone systems, an     attacker would need prior access to the system or an ability     to run a specially crafted application on the target system     to leverage these vulnerabilities.
    (CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091)

  - A denial of service vulnerability exists when .NET     Framework and .NET Core improperly process RegEx     strings. An attacker who successfully exploited this     vulnerability could cause a denial of service against a     .NET application. A remote unauthenticated attacker     could exploit this vulnerability by issuing specially     crafted requests to a .NET Framework (or .NET core)     application. The update addresses the vulnerability by     correcting how .NET Framework and .NET Core applications     handle RegEx string processing. (CVE-2019-0820)

  - A remote code execution vulnerability exists in the way     that Microsoft browsers access objects in memory. The     vulnerability could corrupt memory in a way that could     allow an attacker to execute arbitrary code in the     context of the current user. An attacker who     successfully exploited the vulnerability could gain the     same user rights as the current user.  (CVE-2019-0940)

  - A remote code execution vulnerability exists when     Microsoft Windows OLE fails to properly validate user     input. An attacker could exploit the vulnerability to     execute malicious code.  (CVE-2019-0885)

  - An elevation of privilege vulnerability exists when the     Windows Kernel improperly handles key enumeration. An     attacker who successfully exploited the vulnerability     could gain elevated privileges on a targeted system. A     locally authenticated attacker could exploit this     vulnerability by running a specially crafted     application. The security update addresses the     vulnerability by helping to ensure that the Windows     Kernel properly handles key enumeration. (CVE-2019-0881)

  - An elevation of privilege vulnerability exists in     Microsoft Windows when Windows fails to properly handle     certain symbolic links. An attacker who successfully     exploited this vulnerability could potentially set     certain items to run at a higher level and thereby     elevate permissions.  (CVE-2019-0936)

  - An spoofing vulnerability exists when Internet Explorer     improperly handles URLs. An attacker who successfully     exploited this vulnerability could trick a user by     redirecting the user to a specially crafted website. The     specially crafted website could either spoof content or     serve as a pivot to chain an attack with other     vulnerabilities in web services.  (CVE-2019-0921)

  - An elevation of privilege vulnerability exists in the     Network Driver Interface Specification (NDIS) when     ndis.sys fails to check the length of a buffer prior to     copying memory to it.  (CVE-2019-0707)

  - A remote code execution vulnerability exists in the way     the scripting engine handles objects in memory in     Microsoft browsers. The vulnerability could corrupt     memory in such a way that an attacker could execute     arbitrary code in the context of the current user. An     attacker who successfully exploited the vulnerability     could gain the same user rights as the current user.
    (CVE-2019-0884, CVE-2019-0911, CVE-2019-0918)

  - A remote code execution vulnerability exists when the     Windows Jet Database Engine improperly handles objects     in memory. An attacker who successfully exploited this     vulnerability could execute arbitrary code on a victim     system. An attacker could exploit this vulnerability by     enticing a victim to open a specially crafted file. The     update addresses the vulnerability by correcting the way     the Windows Jet Database Engine handles objects in     memory. (CVE-2019-0889, CVE-2019-0890, CVE-2019-0891,     CVE-2019-0893, CVE-2019-0894, CVE-2019-0895,     CVE-2019-0896, CVE-2019-0897, CVE-2019-0898,     CVE-2019-0899, CVE-2019-0900, CVE-2019-0901,     CVE-2019-0902)

  - A memory corruption vulnerability exists in the Windows     Server DHCP service when processing specially crafted     packets. An attacker who successfully exploited the     vulnerability could run arbitrary code on the DHCP     server.  (CVE-2019-0725)

  - A denial of service vulnerability exists when .NET     Framework improperly handles objects in heap memory. An     attacker who successfully exploited this vulnerability     could cause a denial of service against a .NET     application.  (CVE-2019-0864)

  - An information disclosure vulnerability exists when the     Windows GDI component improperly discloses the contents     of its memory. An attacker who successfully exploited     the vulnerability could obtain information to further     compromise the users system. There are multiple ways an     attacker could exploit the vulnerability, such as by     convincing a user to open a specially crafted document,     or by convincing a user to visit an untrusted webpage.
    The security update addresses the vulnerability by     correcting how the Windows GDI component handles objects     in memory. (CVE-2019-0758, CVE-2019-0882, CVE-2019-0961)

  - An information disclosure vulnerability exists when     Internet Explorer improperly handles objects in memory.
    An attacker who successfully exploited the vulnerability     could obtain information to further compromise the users     system.  (CVE-2019-0930)

  - An elevation of privilege vulnerability exists in     Microsoft Windows when a man-in-the-middle attacker is     able to successfully decode and replace authentication     request using Kerberos, allowing an attacker to be     validated as an Administrator. The update addresses this     vulnerability by changing how these requests are     validated. (CVE-2019-0734)

  - An elevation of privilege vulnerability exists in the     way Windows Error Reporting (WER) handles files. An     attacker who successfully exploited this vulnerability     could run arbitrary code in kernel mode. An attacker     could then install programs; view, change, or delete     data; or create new accounts with administrator     privileges.  (CVE-2019-0863)

  - A denial of service vulnerability exists when .NET     Framework or .NET Core improperly handle web requests.
    An attacker who successfully exploited this     vulnerability could cause a denial of service against a     .NET Framework or .NET Core web application. The     vulnerability can be exploited remotely, without     authentication. A remote unauthenticated attacker could     exploit this vulnerability by issuing specially crafted     requests to the .NET Framework or .NET Core application.
    The update addresses the vulnerability by correcting how     .NET Framework or .NET Core web applications handles web     requests. (CVE-2019-0980, CVE-2019-0981)

  - A remote code execution vulnerability exists in the way     that the Windows Graphics Device Interface (GDI) handles     objects in the memory. An attacker who successfully     exploited this vulnerability could take control of the     affected system. An attacker could then install     programs; view, change, or delete data; or create new     accounts with full user rights.  (CVE-2019-0903)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
289870	MiracleLinux 7 : kernel-3.10.0-957.12.2.el7 (AXSA:2019-3891:04)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/19	medium
287713	Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003143)	Nessus	Unity Linux Local Security Checks	2026/1/15	2026/1/16	medium
125061	KB4499165: Windows 8.1 and Windows Server 2012 R2 May 2019 Security Update (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)	Nessus	Windows : Microsoft Bulletins	2019/5/14	2024/6/17	critical

检测

插件搜索

medium

medium

critical