The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the curl-7.76.1-12.el9 build changelog.

  - When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously     keep a pointer to an already freed memory area and both use that again in a subsequent call to send data     and also free it *again*. (CVE-2021-22945)

  - A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an     IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL`     or `CURLUSESSL_ALL` withlibcurl). This requirement could be bypassed if the server would return a properly     crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations
    **withoutTLS** contrary to the instructions and expectations, exposing possibly sensitive data in clear     text over the network. (CVE-2021-22946)

  - When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to     upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches.
    curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using     and trustingthe responses it got *before* the TLS handshake as if they were authenticated.Using this flaw,     it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS     traffic from the legitimate server and trick curl into sending data back to the user thinking the     attacker's injected data comes from the TLS-protected server. (CVE-2021-22947)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of curl installed on the remote host is prior to 7.79.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1724 advisory.

    A flaw was found in libcurl. When sending data to an MQTT server could in some situations lead to libcurl     using already freed memory and then try to free it again. The highest threat from this vulnerability is to     data confidentiality as well as system availability. (CVE-2021-22945)

    A flaw was found in curl. This flaw lies in the --ssl-reqd option or related settings in libcurl. Users     specify this flag to upgrade to TLS when communicating with either IMAP, POP3 or a FTP server. An attacker     controlling such servers could return a crafted response which could lead to curl client continue its     operation without TLS encryption leading to data being transmitted in clear text over the network. The     highest threat from this vulnerability is to data confidentiality. (CVE-2021-22946)

    A flaw was found in curl. The flaw lies in how curl handles cached or pipelined responses that it receives     from either a IMAP, POP3, SMTP or FTP server before the TLS upgrade using STARTTLS. In such a scenario     curl even after upgrading to TLS would trust these cached responses treating them as valid and     authenticated and use them. An attacker could potentially use this flaw to carry out a Man-In-The-Middle     attack. The highest threat from this vulnerability is to data confidentiality. (CVE-2021-22947)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2023-0808 advisory.

  - The go command may execute arbitrary code at build time when using cgo. This may occur when running go     get on a malicious module, or when running any other command which builds untrusted code. This is can by     triggered by linker flags, specified via a #cgo LDFLAGS directive. Flags containing embedded spaces are     mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in     the argument of another flag. This only affects usage of the gccgo compiler. (CVE-2023-29405)

  - When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by     finalizing the operation with a rename from a temporary name to the final target file name.In that rename     operation, it might accidentally *widen* the permissions for the target file, leaving the updated file     accessible to more users than intended. (CVE-2022-32207)

  - decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS. (CVE-2022-38900)

  - The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.
    (CVE-2022-33987)

  - Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the     name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3. (CVE-2022-37601)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is running a version of macOS / Mac OS X that is 12.x prior to 12.3 Monterey. It is, therefore, affected by multiple vulnerabilities, including the following:
  - A use after free issue was addressed with improved memory management. Successful exploitation could   result in arbitrary code execution with kernel privileges (CVE-2022-22614). 

  - A logic issue was addressed with improved state management. Successful exploitation could result in   privilege escalation (CVE-2022-22632).

  - A null pointer dereference was addressed with improved validation. Successful exploitation could   result in a denial of service condition. (CVE-2022-22638).

Note that Nessus has not tested for this issue but has instead relied only on the operating system's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
191350	CentOS 9 : curl-7.76.1-12.el9	Nessus	CentOS Local Security Checks	2024/2/29	2024/4/26	critical
155980	Amazon Linux 2 : curl (ALAS-2021-1724)	Nessus	Amazon Linux Local Security Checks	2021/12/10	2024/12/11	critical
194928	Splunk Enterprise 8.2.0 < 8.2.12, 9.0.0 < 9.0.6, 9.1.0 < 9.1.1 (SVD-2023-0808)	Nessus	CGI abuses	2024/5/2	2024/7/29	critical
194926	Universal Forwarder 8.2.0 < 8.2.12, 9.0.0 < 9.0.6, 9.1.0 < 9.1.1 (SVD-2023-0809)	Nessus	CGI abuses	2024/5/2	2024/5/30	critical
159106	macOS 12.x < 12.3 (HT213183)	Nessus	MacOS X Local Security Checks	2022/3/21	2024/5/28	critical

检测

插件搜索

critical

critical

critical

critical

critical