The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:1512-1 advisory.

    - Add dac_read_search capability for unix_chkpwd to allow it to read the shadow       file even if it has 000 permissions. This is needed after the CVE-2024-10041       fix in PAM. (bsc#1241678)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of pam installed on the remote host is prior to 1.1.8-23. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2959 advisory.

    A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can     trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs,     the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result     in leaked passwords, such as those found in /etc/shadow while performing authentications. (CVE-2024-10041)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 7.02, has pam packages installed that are affected by multiple vulnerabilities:

  - A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as     hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname,     gaining unauthorized access. This issue poses a risk for systems that rely on this feature to control who     can access certain services or terminals. (CVE-2024-10963)

  - A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can     trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs,     the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result     in leaked passwords, such as those found in /etc/shadow while performing authentications. (CVE-2024-10041)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 7.02, has pam packages installed that are affected by multiple vulnerabilities:

  - linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login     process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY. (CVE-2024-22365)

  - A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can     trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs,     the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result     in leaked passwords, such as those found in /etc/shadow while performing authentications. (CVE-2024-10041)

  - A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as     hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname,     gaining unauthorized access. This issue poses a risk for systems that rely on this feature to control who     can access certain services or terminals. (CVE-2024-10963)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:10379 advisory.

    * pam: libpam: Libpam vulnerable to read hashed password (CVE-2024-10041)

    * pam: Improper Hostname Interpretation in pam_access Leads to Access Control Bypass (CVE-2024-10963)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the pam package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as     hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname,     gaining unauthorized access. This issue poses a risk for systems that rely on this feature to control who     can access certain services or terminals.(CVE-2024-10963)

    A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can     trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs,     the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result     in leaked passwords, such as those found in /etc/shadow while performing authentications.(CVE-2024-10041)

Tenable has extracted the preceding description block directly from the EulerOS pam security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2024:0264 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2024-10041:
    A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can     trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs,     the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result     in leaked passwords, such as those found in /etc/shadow while performing authentications.

    CVE-2024-10963:
    A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as     hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname,     gaining unauthorized access. This issue poses a risk for systems that rely on this feature to control who     can access certain services or terminals.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 6.10.1.5. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-6.10.1.5 advisory.

  - virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual     environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as     CVE-2024-9287. (CVE-2024-53899)

  - DHCP can add routes to a client's routing table via the classless static route option (121). VPN-based     security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical     interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic     that was expected to be protected by the VPN. (CVE-2024-3661)

  - A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can     trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs,     the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result     in leaked passwords, such as those found in /etc/shadow while performing authentications. (CVE-2024-10041)

  - A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as     hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname,     gaining unauthorized access. This issue poses a risk for systems that rely on this feature to control who     can access certain services or terminals. (CVE-2024-10963)

  - A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an     attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and     uninitialized memory and leak one byte of uninitialized stack data at a time. (CVE-2024-12085)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
235637	SUSE SLES15 Security Update : apparmor (SUSE-SU-2025:1512-1)	Nessus	SuSE Local Security Checks	2025/5/9	2025/5/9	medium
243423	Amazon Linux 2 : pam (ALAS-2025-2959)	Nessus	Amazon Linux Local Security Checks	2025/8/4	2025/8/4	medium
237997	NewStart CGSL MAIN 7.02 : pam Multiple Vulnerabilities (NS-SA-2025-0083)	Nessus	NewStart CGSL Local Security Checks	2025/6/9	2025/6/18	high
242731	NewStart CGSL MAIN 7.02 : pam Multiple Vulnerabilities (NS-SA-2025-0191)	Nessus	NewStart CGSL Local Security Checks	2025/7/25	2025/7/25	medium
213213	RockyLinux 8 : pam (RLSA-2024:10379)	Nessus	Rocky Linux Local Security Checks	2024/12/19	2024/12/19	high
216013	EulerOS 2.0 SP12 : pam (EulerOS-SA-2025-1178)	Nessus	Huawei Local Security Checks	2025/2/10	2025/2/10	high
216017	EulerOS 2.0 SP12 : pam (EulerOS-SA-2025-1194)	Nessus	Huawei Local Security Checks	2025/2/10	2025/2/10	high
235987	Alibaba Cloud Linux 3 : 0264: pam (ALINUX3-SA-2024:0264)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	high
233564	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.10.1.5)	Nessus	Misc.	2025/3/31	2025/3/31	low

检测

插件搜索

medium

medium

high

medium

high

high

high

high

low