遠端 Oracle Linux 9 主機上安裝的套件受到 ELSA-2022-5050 公告中提及的一個弱點影響。

  - .NET 和 Visual Studio 的資訊洩漏弱點。(CVE-2022-30184)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0133 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2020-13950:
    Apache HTTP Server versions 2.4.41 to 2.4.46 mod_proxy_http can be made to crash (NULL pointer     dereference) with specially crafted requests using both Content-Length and Transfer-Encoding headers,     leading to a Denial of Service

    CVE-2020-35452:
    Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in     mod_auth_digest. There is no report of this overflow being exploitable, nor the Apache HTTP Server team     could create one, though some particular compiler and/or compilation option might make it possible, with     limited consequences anyway due to the size (a single byte) and the value (zero byte) of the overflow

    CVE-2021-33193:
    A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead     to request splitting or cache poisoning. This issue affects Apache HTTP Server 2.4.17 to 2.4.48.

    CVE-2021-36160:
    A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and     crash (DoS). This issue affects Apache HTTP Server versions 2.4.30 to 2.4.48 (inclusive).

    CVE-2022-30184:
    .NET and Visual Studio Information Disclosure Vulnerability.

    CVE-2021-44224:
    A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL     pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for     requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This     issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:5062 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 3.1.420 and .NET Runtime 3.1.26.

    Security Fix(es):

    * dotnet: NuGet Credential leak due to loss of control of third party symbol server domain     (CVE-2022-30184)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:5046 advisory.

  - .NET and Visual Studio Information Disclosure Vulnerability. (CVE-2022-30184)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the dotnet package has been released.

遠端 Redhat Enterprise Linux 7 主機上安裝的多個套件受到 RHSA-2022: 5047 公告中提及的多個弱點影響。

  - dotnet：由於失去第三方符號伺服器網域的控制權而導致 NuGet 憑證洩漏 (CVE-2022-30184)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 Redhat Enterprise Linux 8 主機上安裝的多個套件受到 RHSA-2022: 5046 公告中提及的多個弱點影響。

  - dotnet：由於失去第三方符號伺服器網域的控制權而導致 NuGet 憑證洩漏 (CVE-2022-30184)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

.NET core 6.0 < 6.0.6 和 .NET Core 3.1 < 3.1.26 中存在資訊洩漏弱點。未經驗證的本機攻擊者可利用此弱點洩漏潛在的敏感資訊。

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

Microsoft Visual Studio 產品缺少安全性更新。因此，它會受到多個弱點影響：

  - 一個權限提升弱點。攻擊者可利用此弱點取得提升的權限。(CVE-2022-24513)

  - Visual Studio 中存在一個資訊洩漏弱點。未經驗證的遠端攻擊者可利用此弱點洩露潛在敏感資訊。(CVE-2022-30184)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
162792	Oracle Linux 9：.NET / 6.0 (ELSA-2022-5050)	Nessus	Oracle Linux Local Security Checks	2022/7/7	2024/11/1	medium
236430	Alibaba Cloud Linux 3 : 0133: httpd:2.4 (ALINUX3-SA-2022:0133)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	high
162302	RHEL 7 : .NET Core 3.1 on RHEL 7 (RHSA-2022:5062)	Nessus	Red Hat Local Security Checks	2022/6/16	2024/11/7	medium
162848	Rocky Linux 8 : .NET 6.0 (RLSA-2022:5046)	Nessus	Rocky Linux Local Security Checks	2022/7/8	2023/11/6	medium
234310	Photon OS 5.0: Dotnet PHSA-2025-5.0-0499	Nessus	PhotonOS Local Security Checks	2025/4/13	2025/4/14	critical
162229	RHEL 7：RHEL 7 上的 .NET 6.0 (RHSA-2022: 5047)	Nessus	Red Hat Local Security Checks	2022/6/15	2024/11/7	medium
162231	RHEL 8：.NET 6.0 (RHSA-2022: 5046)	Nessus	Red Hat Local Security Checks	2022/6/15	2024/11/7	medium
162314	Microsoft .NET Core 安全性更新 (2022 年 6 月)	Nessus	Windows	2022/6/16	2024/1/16	medium
162317	Microsoft Visual Studio 產品的安全性更新 (2022 年 6 月)	Nessus	Windows : Microsoft Bulletins	2022/6/16	2025/1/6	high

检测

插件搜索

medium

high

medium

medium

critical

medium

medium

medium

high