The version of AOS installed on the remote host is prior to 5.10.9. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.10.9 advisory.

  - Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow     can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels,     assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass     invalid utf-8 strings to functions like pango_itemize. (CVE-2019-1010238)

  - curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal     function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how     large temporary storage area to allocate from the heap. The length value is then subsequently used to     iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit     size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31     bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the     intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is     almost identical to CVE-2017-8816.) (CVE-2018-14618)

  - An issue was discovered in XListExtensions in ListExt.c in libX11 through 1.6.5. A malicious server can     send a reply in which the first string overflows, causing a variable to be set to NULL that will be freed     later on, leading to DoS (segmentation fault). (CVE-2018-14598)

  - An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c is vulnerable     to an off-by-one error caused by malicious server responses, leading to DoS or possibly unspecified other     impact. (CVE-2018-14599)

  - An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c interprets a     variable as signed instead of unsigned, resulting in an out-of-bounds write (of up to 128 bytes), leading     to DoS or remote code execution. (CVE-2018-14600)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-2143 advisory.

    - Fix for CVE-2018-15473 (#1619079)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-0711 advisory.

    [5.3p1-124]
    - Fix for CVE-2018-15473: User enumeration via malformed packets in authentication requests

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 4.06, has openssh packages installed that are affected by a vulnerability:

  - OpenSSH through 7.7 is prone to a user enumeration     vulnerability due to not delaying bailout for an invalid     authenticating user until after the packet containing     the request has been fully parsed, related to     auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.
    (CVE-2018-15473)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Dariusz Tytko, Michal Sajdak and Qualys Security discovered that OpenSSH, an implementation of the SSH protocol suite, was prone to a user enumeration vulnerability. This would allow a remote attacker to check whether a specific user account existed on the target server.

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2019-4118:02 advisory.

    * openssh: User enumeration via malformed packets in authentication requests (CVE-2018-15473)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
164581	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.10.9)	Nessus	Misc.	2022/9/1	2025/7/22	critical
180795	Oracle Linux 7 : openssh (ELSA-2019-2143)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2024/10/23	medium
123986	Oracle Linux 6 : openssh (ELSA-2019-0711)	Nessus	Oracle Linux Local Security Checks	2019/4/11	2024/10/22	medium
127310	NewStart CGSL MAIN 4.06 : openssh Vulnerability (NS-SA-2019-0091)	Nessus	NewStart CGSL Local Security Checks	2019/8/12	2024/5/7	medium
112066	Debian DSA-4280-1 : openssh - security update	Nessus	Debian Local Security Checks	2018/8/23	2024/8/15	medium
289807	MiracleLinux 7 : openssh-7.4p1-21.el7 (AXSA:2019-4118:02)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/2/9	medium

检测

插件搜索

critical

medium

medium

medium

medium

medium