The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2023:0069 advisory.

    Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:

      CVE-2023-25652:
      Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8,     2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to `git apply --reject`, a     path outside the working tree can be overwritten with partially controlled contents (corresponding to the     rejected hunk(s) from the given patch). A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8,     2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid using `git apply` with     `--reject` when applying patches from an untrusted source. Use `git apply --stat` to inspect a patch     before applying; avoid applying one that create a conflict where a link corresponding to the `*.rej` file     exists.
      CVE-2023-29007:
      Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8,     2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a specially crafted `.gitmodules` file with submodule URLs     that are longer than 1024 characters can used to exploit a bug in     `config.c::git_config_copy_or_rename_section_in_file()`. This bug can be used to inject arbitrary     configuration into a user's `$GIT_DIR/config` when attempting to remove the configuration section     associated with that submodule. When the attacker injects configuration values which specify executables     to run (such as `core.pager`, `core.editor`, `core.sshCommand`, etc.) this can lead to a remote code     execution. A fix A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6,     2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid running `git submodule deinit` on untrusted     repositories or without prior inspection of any submodule sections in `$GIT_DIR/config`.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-5963:09 advisory.

    * git: by feeding specially crafted input to `git apply --reject`, a path outside the working tree can be     overwritten with partially controlled contents (CVE-2023-25652)
      * git: arbitrary configuration injection when renaming or deleting a section from a configuration file     (CVE-2023-29007)
      * git: data exfiltration with maliciously crafted repository (CVE-2023-22490)
      * git: git apply: a path outside the working tree can be overwritten with crafted input (CVE-2023-23946)
      * git: malicious placement of crafted messages when git was compiled with runtime prefix     (CVE-2023-25815)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3248 advisory.

    Git is a distributed revision control system with a decentralized architecture. As opposed to centralized     version control systems with a client-server model, Git ensures that each working copy of a Git repository     is an exact copy with complete revision history. This not only allows the user to work on and contribute     to projects without the need to have permission to push the changes to their official repositories, but     also makes it possible for the user to work with no network connection.

    Security Fix(es):

    * git: by feeding specially crafted input to `git apply --reject`, a path outside the working tree can be     overwritten with partially controlled contents (CVE-2023-25652)

    * git: arbitrary configuration injection when renaming or deleting a section from a configuration file     (CVE-2023-29007)

    * git: malicious placement of crafted messages when git was compiled with runtime prefix (CVE-2023-25815)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3243 advisory.

    Git is a distributed revision control system with a decentralized architecture. As opposed to centralized     version control systems with a client-server model, Git ensures that each working copy of a Git repository     is an exact copy with complete revision history. This not only allows the user to work on and contribute     to projects without the need to have permission to push the changes to their official repositories, but     also makes it possible for the user to work with no network connection.

    Security Fix(es):

    * git: by feeding specially crafted input to `git apply --reject`, a path outside the working tree can be     overwritten with partially controlled contents (CVE-2023-25652)

    * git: arbitrary configuration injection when renaming or deleting a section from a configuration file     (CVE-2023-29007)

    * git: malicious placement of crafted messages when git was compiled with runtime prefix (CVE-2023-25815)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:3246 advisory.

  - Git is a revision control system. Using a specially-crafted repository, Git prior to versions 2.39.2,     2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8 can be tricked into using its     local clone optimization even when using a non-local transport. Though Git will abort local clones whose     source `$GIT_DIR/objects` directory contains symbolic links, the `objects` directory itself may still be a     symbolic link. These two may be combined to include arbitrary files based on known paths on the victim's     filesystem within the malicious repository's working copy, allowing for data exfiltration in a similar     manner as CVE-2022-39253. A fix has been prepared and will appear in v2.39.2 v2.38.4 v2.37.6 v2.36.5     v2.35.7 v2.34.7 v2.33.7 v2.32.6, v2.31.7 and v2.30.8. If upgrading is impractical, two short-term     workarounds are available. Avoid cloning repositories from untrusted sources with `--recurse-submodules`.
    Instead, consider cloning repositories without recursively cloning their submodules, and instead run `git     submodule update` at each layer. Before doing so, inspect each new `.gitmodules` file to ensure that it     does not contain suspicious module URLs. (CVE-2023-22490)

  - Git, a revision control system, is vulnerable to path traversal prior to versions 2.39.2, 2.38.4, 2.37.6,     2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8. By feeding a crafted input to `git apply`, a     path outside the working tree can be overwritten as the user who is running `git apply`. A fix has been     prepared and will appear in v2.39.2, v2.38.4, v2.37.6, v2.36.5, v2.35.7, v2.34.7, v2.33.7, v2.32.6,     v2.31.7, and v2.30.8. As a workaround, use `git apply --stat` to inspect a patch before applying; avoid     applying one that creates a symbolic link and then creates a file beyond the symbolic link.
    (CVE-2023-23946)

  - Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8,     2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to `git apply --reject`, a     path outside the working tree can be overwritten with partially controlled contents (corresponding to the     rejected hunk(s) from the given patch). A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8,     2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid using `git apply` with     `--reject` when applying patches from an untrusted source. Use `git apply --stat` to inspect a patch     before applying; avoid applying one that create a conflict where a link corresponding to the `*.rej` file     exists. (CVE-2023-25652)

  - In Git for Windows, the Windows port of Git, no localized messages are shipped with the installer. As a     consequence, Git is expected not to localize messages at all, and skips the gettext initialization.
    However, due to a change in MINGW-packages, the `gettext()` function's implicit initialization no longer     uses the runtime prefix but uses the hard-coded path `C:\mingw64\share\locale` to look for localized     messages. And since any authenticated user has the permission to create folders in `C:\` (and since     `C:\mingw64` does not typically exist), it is possible for low-privilege users to place fake messages in     that location where `git.exe` will pick them up in version 2.40.1. This vulnerability is relatively hard     to exploit and requires social engineering. For example, a legitimate message at the end of a clone could     be maliciously modified to ask the user to direct their web browser to a malicious website, and the user     might think that the message comes from Git and is legitimate. It does require local write access by the     attacker, though, which makes this attack vector less likely. Version 2.40.1 contains a patch for this     issue. Some workarounds are available. Do not work on a Windows machine with shared accounts, or     alternatively create a `C:\mingw64` folder and leave it empty. Users who have administrative rights may     remove the permission to create folders in `C:\`. (CVE-2023-25815)

  - Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8,     2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a specially crafted `.gitmodules` file with submodule URLs     that are longer than 1024 characters can used to exploit a bug in     `config.c::git_config_copy_or_rename_section_in_file()`. This bug can be used to inject arbitrary     configuration into a user's `$GIT_DIR/config` when attempting to remove the configuration section     associated with that submodule. When the attacker injects configuration values which specify executables     to run (such as `core.pager`, `core.editor`, `core.sshCommand`, etc.) this can lead to a remote code     execution. A fix A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6,     2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid running `git submodule deinit` on untrusted     repositories or without prior inspection of any submodule sections in `$GIT_DIR/config`. (CVE-2023-29007)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-3246 advisory.

    [2.39.3-1]
    - Update to 2.39.3
    - Resolves: #2188364, #2188373, #2190157, #2190158

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the git packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8,     2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to `git apply --reject`, a     path outside the working tree can be overwritten with partially controlled contents (corresponding to the     rejected hunk(s) from the given patch). A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8,     2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid using `git apply` with     `--reject` when applying patches from an untrusted source. Use `git apply --stat` to inspect a patch     before applying; avoid applying one that create a conflict where a link corresponding to the `*.rej` file     exists. (CVE-2023-25652)

  - In Git for Windows, the Windows port of Git, no localized messages are shipped with the installer. As a     consequence, Git is expected not to localize messages at all, and skips the gettext initialization.
    However, due to a change in MINGW-packages, the `gettext()` function's implicit initialization no longer     uses the runtime prefix but uses the hard-coded path `C:\mingw64\share\locale` to look for localized     messages. And since any authenticated user has the permission to create folders in `C:\` (and since     `C:\mingw64` does not typically exist), it is possible for low-privilege users to place fake messages in     that location where `git.exe` will pick them up in version 2.40.1. This vulnerability is relatively hard     to exploit and requires social engineering. For example, a legitimate message at the end of a clone could     be maliciously modified to ask the user to direct their web browser to a malicious website, and the user     might think that the message comes from Git and is legitimate. It does require local write access by the     attacker, though, which makes this attack vector less likely. Version 2.40.1 contains a patch for this     issue. Some workarounds are available. Do not work on a Windows machine with shared accounts, or     alternatively create a `C:\mingw64` folder and leave it empty. Users who have administrative rights may     remove the permission to create folders in `C:\`. (CVE-2023-25815)

  - Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8,     2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a specially crafted `.gitmodules` file with submodule URLs     that are longer than 1024 characters can used to exploit a bug in     `config.c::git_config_copy_or_rename_section_in_file()`. This bug can be used to inject arbitrary     configuration into a user's `$GIT_DIR/config` when attempting to remove the configuration section     associated with that submodule. When the attacker injects configuration values which specify executables     to run (such as `core.pager`, `core.editor`, `core.sshCommand`, etc.) this can lead to a remote code     execution. A fix A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6,     2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid running `git submodule deinit` on untrusted     repositories or without prior inspection of any submodule sections in `$GIT_DIR/config`. (CVE-2023-29007)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2023:0047 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2023-22490:
    Git is a revision control system. Using a specially-crafted repository, Git prior to versions 2.39.2,     2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8 can be tricked into using its     local clone optimization even when using a non-local transport. Though Git will abort local clones whose     source `$GIT_DIR/objects` directory contains symbolic links, the `objects` directory itself may still be a     symbolic link. These two may be combined to include arbitrary files based on known paths on the victim's     filesystem within the malicious repository's working copy, allowing for data exfiltration in a similar     manner as CVE-2022-39253. A fix has been prepared and will appear in v2.39.2 v2.38.4 v2.37.6 v2.36.5     v2.35.7 v2.34.7 v2.33.7 v2.32.6, v2.31.7 and v2.30.8. If upgrading is impractical, two short-term     workarounds are available. Avoid cloning repositories from untrusted sources with `--recurse-submodules`.
    Instead, consider cloning repositories without recursively cloning their submodules, and instead run `git     submodule update` at each layer. Before doing so, inspect each new `.gitmodules` file to ensure that it     does not contain suspicious module URLs.

    CVE-2023-23946:
    Git, a revision control system, is vulnerable to path traversal prior to versions 2.39.2, 2.38.4, 2.37.6,     2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8. By feeding a crafted input to `git apply`, a     path outside the working tree can be overwritten as the user who is running `git apply`. A fix has been     prepared and will appear in v2.39.2, v2.38.4, v2.37.6, v2.36.5, v2.35.7, v2.34.7, v2.33.7, v2.32.6,     v2.31.7, and v2.30.8. As a workaround, use `git apply --stat` to inspect a patch before applying; avoid     applying one that creates a symbolic link and then creates a file beyond the symbolic link.

    CVE-2023-25652:
    Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8,     2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to `git apply --reject`, a     path outside the working tree can be overwritten with partially controlled contents (corresponding to the     rejected hunk(s) from the given patch). A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8,     2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid using `git apply` with     `--reject` when applying patches from an untrusted source. Use `git apply --stat` to inspect a patch     before applying; avoid applying one that create a conflict where a link corresponding to the `*.rej` file     exists.

    CVE-2023-25815:
    In Git for Windows, the Windows port of Git, no localized messages are shipped with the installer. As a     consequence, Git is expected not to localize messages at all, and skips the gettext initialization.
    However, due to a change in MINGW-packages, the `gettext()` function's implicit initialization no longer     uses the runtime prefix but uses the hard-coded path `C:\mingw64\share\locale` to look for localized     messages. And since any authenticated user has the permission to create folders in `C:\` (and since     `C:\mingw64` does not typically exist), it is possible for low-privilege users to place fake messages in     that location where `git.exe` will pick them up in version 2.40.1. This vulnerability is relatively hard     to exploit and requires social engineering. For example, a legitimate message at the end of a clone could     be maliciously modified to ask the user to direct their web browser to a malicious website, and the user     might think that the message comes from Git and is legitimate. It does require local write access by the     attacker, though, which makes this attack vector less likely. Version 2.40.1 contains a patch for this     issue. Some workarounds are available. Do not work on a Windows machine with shared accounts, or     alternatively create a `C:\mingw64` folder and leave it empty. Users who have administrative rights may     remove the permission to create folders in `C:\`.

    CVE-2022-24765     Git for Windows is a fork of Git containing Windows-specific patches. This vulnerability affects users     working on multi-user machines, where untrusted parties have write access to the same hard disk. Those     untrusted parties could create the folder `C:\.git`, which would be picked up by Git operations run     supposedly outside a repository while searching for a Git directory. Git would then respect any config in     said Git directory. Git Bash users who set `GIT_PS1_SHOWDIRTYSTATE` are vulnerable as well. Users who     installed posh-gitare vulnerable simply by starting a PowerShell. Users of IDEs such as Visual Studio are     vulnerable: simply creating a new project would already read and respect the config specified in     `C:\.git\config`. Users of the Microsoft fork of Git are vulnerable simply by starting a Git Bash. The     problem has been patched in Git for Windows v2.35.2. Users unable to upgrade may create the folder `.git`     on all drives where Git commands are run, and remove read/write access from those folders as a workaround.
    Alternatively, define or extend `GIT_CEILING_DIRECTORIES` to cover the _parent_ directory of the user     profile, e.g. `C:\Users` if the user profile is located in `C:\Users\my-user-name`.

    CVE-2023-29007:
    Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8,     2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a specially crafted `.gitmodules` file with submodule URLs     that are longer than 1024 characters can used to exploit a bug in     `config.c::git_config_copy_or_rename_section_in_file()`. This bug can be used to inject arbitrary     configuration into a user's `$GIT_DIR/config` when attempting to remove the configuration section     associated with that submodule. When the attacker injects configuration values which specify executables     to run (such as `core.pager`, `core.editor`, `core.sshCommand`, etc.) this can lead to a remote code     execution. A fix A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6,     2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid running `git submodule deinit` on untrusted     repositories or without prior inspection of any submodule sections in `$GIT_DIR/config`.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-5487:04 advisory.

    * git: by feeding specially crafted input to `git apply --reject`, a path outside the working tree can be     overwritten with partially controlled contents (CVE-2023-25652)
      * git: arbitrary configuration injection when renaming or deleting a section from a configuration file     (CVE-2023-29007)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-6144:10 advisory.

    * git: by feeding specially crafted input to `git apply --reject`, a path outside the working tree can be     overwritten with partially controlled contents (CVE-2023-25652)
      * git: arbitrary configuration injection when renaming or deleting a section from a configuration file     (CVE-2023-29007)
      * git: data exfiltration with maliciously crafted repository (CVE-2023-22490)
      * git: git apply: a path outside the working tree can be overwritten with crafted input (CVE-2023-23946)
      * git: malicious placement of crafted messages when git was compiled with runtime prefix     (CVE-2023-25815)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the git package has been released.

This Solaris system is missing necessary patches to address critical security updates :

  - Vulnerability in the MySQL Enterprise Monitor product of     Oracle MySQL (component: Monitoring: General (Apache     Tomcat)). Supported versions that are affected are     8.0.34 and prior. Easily exploitable vulnerability     allows unauthenticated attacker with network access via     multiple protocols to compromise MySQL Enterprise     Monitor. Successful attacks of this vulnerability can     result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of MySQL     Enterprise Monitor. CVSS 3.1 Base Score 7.5     (Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2023-28709)

  - Vulnerability in the MySQL Server product of Oracle     MySQL (component: Client programs). Supported versions     that are affected are 5.7.41 and prior and 8.0.32 and     prior. Difficult to exploit vulnerability allows low     privileged attacker with network access via multiple     protocols to compromise MySQL Server. Successful attacks     require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in takeover of MySQL Server. CVSS 3.1 Base Score     7.1 (Confidentiality, Integrity and Availability     impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H).
    (CVE-2023-21980)

  - Vulnerability in the MySQL Server product of Oracle     MySQL (component: Server: Optimizer). Supported versions     that are affected are 8.0.32 and prior. Easily     exploitable vulnerability allows low privileged attacker     with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of MySQL     Server. CVSS 3.1 Base Score 6.5 (Availability impacts).
    CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2023-21946)

  - Vulnerability in the MySQL Server product of Oracle     MySQL (component: Server: DDL). Supported versions that     are affected are 8.0.32 and prior. Easily exploitable     vulnerability allows high privileged attacker with     network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of MySQL     Server as well as unauthorized update, insert or delete     access to some of MySQL Server accessible data. CVSS 3.1     Base Score 5.5 (Integrity and Availability impacts).
    CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H).
    (CVE-2023-21929)

  - Vulnerability in the MySQL Server product of Oracle     MySQL (component: InnoDB). Supported versions that are     affected are 8.0.32 and prior. Easily exploitable     vulnerability allows high privileged attacker with     network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of MySQL     Server. CVSS 3.1 Base Score 4.9 (Availability impacts).
    CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2023-21911)

  - Vulnerability in the MySQL Server product of Oracle     MySQL (component: Server: Components Services).
    Supported versions that are affected are 8.0.32 and     prior. Easily exploitable vulnerability allows high     privileged attacker with network access via multiple     protocols to compromise MySQL Server. Successful attacks     of this vulnerability can result in unauthorized ability     to cause a hang or frequently repeatable crash (complete     DOS) of MySQL Server. CVSS 3.1 Base Score 4.9     (Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2023-21962)

  - Vulnerability in the MySQL Server product of Oracle     MySQL (component: Server: DDL). Supported versions that     are affected are 8.0.32 and prior. Easily exploitable     vulnerability allows high privileged attacker with     network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of MySQL     Server. CVSS 3.1 Base Score 4.9 (Availability impacts).
    CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2023-21919)

  - Vulnerability in the MySQL Server product of Oracle     MySQL (component: Server: DDL). Supported versions that     are affected are 8.0.32 and prior. Easily exploitable     vulnerability allows high privileged attacker with     network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of MySQL     Server. CVSS 3.1 Base Score 4.9 (Availability impacts).
    CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2023-21933)

  - Vulnerability in the MySQL Server product of Oracle     MySQL (component: Server: DML). Supported versions that     are affected are 8.0.32 and prior. Easily exploitable     vulnerability allows high privileged attacker with     network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of MySQL     Server. CVSS 3.1 Base Score 4.9 (Availability impacts).
    CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2023-21972)

  - Vulnerability in the MySQL Server product of Oracle     MySQL (component: Server: JSON). Supported versions that     are affected are 8.0.32 and prior. Easily exploitable     vulnerability allows high privileged attacker with     network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of MySQL     Server. CVSS 3.1 Base Score 4.9 (Availability impacts).
    CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2023-21966)

  - Vulnerability in the MySQL Server product of Oracle     MySQL (component: Server: Optimizer). Supported versions     that are affected are 8.0.32 and prior. Easily     exploitable vulnerability allows high privileged     attacker with network access via multiple protocols to     compromise MySQL Server. Successful attacks of this     vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete     DOS) of MySQL Server. CVSS 3.1 Base Score 4.9     (Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2023-21920)

  - Vulnerability in the MySQL Server product of Oracle     MySQL (component: Server: Optimizer). Supported versions     that are affected are 8.0.32 and prior. Easily     exploitable vulnerability allows high privileged     attacker with network access via multiple protocols to     compromise MySQL Server. Successful attacks of this     vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete     DOS) of MySQL Server. CVSS 3.1 Base Score 4.9     (Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2023-21935)

  - Vulnerability in the MySQL Server product of Oracle     MySQL (component: Server: Optimizer). Supported versions     that are affected are 8.0.32 and prior. Easily     exploitable vulnerability allows high privileged     attacker with network access via multiple protocols to     compromise MySQL Server. Successful attacks of this     vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete     DOS) of MySQL Server. CVSS 3.1 Base Score 4.9     (Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2023-21945)

  - Vulnerability in the MySQL Server product of Oracle     MySQL (component: Server: Optimizer). Supported versions     that are affected are 8.0.32 and prior. Easily     exploitable vulnerability allows high privileged     attacker with network access via multiple protocols to     compromise MySQL Server. Successful attacks of this     vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete     DOS) of MySQL Server. CVSS 3.1 Base Score 4.9     (Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2023-21976)

  - Vulnerability in the MySQL Server product of Oracle     MySQL (component: Server: Optimizer). Supported versions     that are affected are 8.0.32 and prior. Easily     exploitable vulnerability allows high privileged     attacker with network access via multiple protocols to     compromise MySQL Server. Successful attacks of this     vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete     DOS) of MySQL Server. CVSS 3.1 Base Score 4.9     (Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2023-21977)

  - Vulnerability in the MySQL Server product of Oracle     MySQL (component: Server: Optimizer). Supported versions     that are affected are 8.0.32 and prior. Easily     exploitable vulnerability allows high privileged     attacker with network access via multiple protocols to     compromise MySQL Server. Successful attacks of this     vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete     DOS) of MySQL Server. CVSS 3.1 Base Score 4.9     (Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2023-21982)

  - Vulnerability in the MySQL Server product of Oracle     MySQL (component: Server: Partition). Supported versions     that are affected are 8.0.32 and prior. Easily     exploitable vulnerability allows high privileged     attacker with network access via multiple protocols to     compromise MySQL Server. Successful attacks of this     vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete     DOS) of MySQL Server. CVSS 3.1 Base Score 4.9     (Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2023-21953)

  - Vulnerability in the MySQL Server product of Oracle     MySQL (component: Server: Partition). Supported versions     that are affected are 8.0.32 and prior. Easily     exploitable vulnerability allows high privileged     attacker with network access via multiple protocols to     compromise MySQL Server. Successful attacks of this     vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete     DOS) of MySQL Server. CVSS 3.1 Base Score 4.9     (Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2023-21955)

  - Vulnerability in the MySQL Server product of Oracle     MySQL (component: Server: Components Services).
    Supported versions that are affected are 8.0.32 and     prior. Difficult to exploit vulnerability allows high     privileged attacker with network access via multiple     protocols to compromise MySQL Server. Successful attacks     of this vulnerability can result in unauthorized ability     to cause a hang or frequently repeatable crash (complete     DOS) of MySQL Server. CVSS 3.1 Base Score 4.4     (Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2023-21940)

  - Vulnerability in the MySQL Server product of Oracle     MySQL (component: Server: Components Services).
    Supported versions that are affected are 8.0.32 and     prior. Difficult to exploit vulnerability allows high     privileged attacker with network access via multiple     protocols to compromise MySQL Server. Successful attacks     of this vulnerability can result in unauthorized ability     to cause a hang or frequently repeatable crash (complete     DOS) of MySQL Server. CVSS 3.1 Base Score 4.4     (Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2023-21947)

  - Vulnerability in the Oracle Communications Diameter     Signaling Router product of Oracle Communications     (component: Virtual Network Function Manager (git)). The     supported version that is affected is 8.6.0.0. Easily     exploitable vulnerability allows unauthenticated     attacker with logon to the infrastructure where Oracle     Communications Diameter Signaling Router executes to     compromise Oracle Communications Diameter Signaling     Router. Successful attacks require human interaction     from a person other than the attacker. Successful     attacks of this vulnerability can result in takeover of     Oracle Communications Diameter Signaling Router. CVSS     3.1 Base Score 7.8 (Confidentiality, Integrity and     Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
    (CVE-2023-29007)

  - Vulnerability in the MySQL Workbench product of Oracle     MySQL (component: Workbench (libxml2)). Supported     versions that are affected are 8.0.33 and prior. Easily     exploitable vulnerability allows unauthenticated     attacker with network access via MySQL Workbench to     compromise MySQL Workbench. Successful attacks require     human interaction from a person other than the attacker.
    Successful attacks of this vulnerability can result in     unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of MySQL Workbench. CVSS     3.1 Base Score 6.5 (Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H).
    (CVE-2023-28484)

  - Vulnerability in the Oracle Retail Advanced Inventory     Planning product of Oracle Retail Applications     (component: Operations & Maintenance (zlib)). Supported     versions that are affected are 15.0 and 16.0. Easily     exploitable vulnerability allows unauthenticated     attacker with network access via HTTP to compromise     Oracle Retail Advanced Inventory Planning. Successful     attacks of this vulnerability can result in takeover of     Oracle Retail Advanced Inventory Planning. CVSS 3.1 Base     Score 9.8 (Confidentiality, Integrity and Availability     impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
    (CVE-2022-37434)

  - Vulnerability in the Oracle Enterprise Operations     Monitor product of Oracle Communications (component:
    Mediation Engine (OpenSSL)). Supported versions that are     affected are 5.0 and 5.1. Easily exploitable     vulnerability allows unauthenticated attacker with     network access via TLS to compromise Oracle Enterprise     Operations Monitor. Successful attacks of this     vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete     DOS) of Oracle Enterprise Operations Monitor. CVSS 3.1     Base Score 7.5 (Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2023-0215)

  - Vulnerability in the MySQL Server product of Oracle     MySQL (component: Server: Packaging (cURL)). Supported     versions that are affected are 5.7.41 and prior and     8.0.32 and prior. Easily exploitable vulnerability     allows unauthenticated attacker with network access via     multiple protocols to compromise MySQL Server.
    Successful attacks of this vulnerability can result in     unauthorized access to critical data or complete access     to all MySQL Server accessible data. CVSS 3.1 Base Score     7.5 (Confidentiality impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
    (CVE-2022-43551)

  - Vulnerability in the MySQL Server product of Oracle     MySQL (component: Server: Security: Privileges).
    Supported versions that are affected are 5.7.41 and     prior and 8.0.30 and prior. Easily exploitable     vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of MySQL     Server. CVSS 3.1 Base Score 7.5 (Availability impacts).
    CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2023-21912)

  - Vulnerability in the MySQL Server product of Oracle     MySQL (component: Client programs). Supported versions     that are affected are 5.7.41 and prior and 8.0.32 and     prior. Difficult to exploit vulnerability allows low     privileged attacker with network access via multiple     protocols to compromise MySQL Server. Successful attacks     require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in takeover of MySQL Server. CVSS 3.1 Base Score     7.1 (Confidentiality, Integrity and Availability     impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H).
    (CVE-2023-21980)

  - Vulnerability in the Oracle Communications Diameter     Signaling Router product of Oracle Communications     (component: Virtual Network Function Manager (Libwebp)).
    The supported version that is affected is 8.6.0.0.
    Easily exploitable vulnerability allows unauthenticated     attacker with network access via HTTP to compromise     Oracle Communications Diameter Signaling Router.
    Successful attacks of this vulnerability can result in     unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of Oracle Communications     Diameter Signaling Router. CVSS 3.1 Base Score 7.5     (Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2023-1999)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
239494	TencentOS Server 2: git (TSSA-2023:0069)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	high
292379	MiracleLinux 9 : git-2.39.3-1.el9 (AXSA:2023-5963:09)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
176203	RHEL 9 : git (RHSA-2023:3248)	Nessus	Red Hat Local Security Checks	2023/5/22	2024/11/8	high
176205	RHEL 8 : git (RHSA-2023:3243)	Nessus	Red Hat Local Security Checks	2023/5/22	2024/11/7	high
176231	AlmaLinux 8 : git (ALSA-2023:3246)	Nessus	Alma Linux Local Security Checks	2023/5/23	2023/5/23	high
176337	Oracle Linux 8 : git (ELSA-2023-3246)	Nessus	Oracle Linux Local Security Checks	2023/5/24	2024/10/24	high
178062	EulerOS 2.0 SP9 : git (EulerOS-SA-2023-2312)	Nessus	Huawei Local Security Checks	2023/7/9	2023/7/9	high
178347	EulerOS 2.0 SP10 : git (EulerOS-SA-2023-2354)	Nessus	Huawei Local Security Checks	2023/7/18	2023/7/18	high
188788	EulerOS 2.0 SP11 : git (EulerOS-SA-2023-2641)	Nessus	Huawei Local Security Checks	2024/1/16	2024/1/16	high
236072	Alibaba Cloud Linux 3 : 0047: git (ALINUX3-SA-2023:0047)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	high
291998	MiracleLinux 7 : git-1.8.3.1-25.el7 (AXSA:2023-5487:04)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
292869	MiracleLinux 8 : git-2.39.3-1.el8 (AXSA:2023-6144:10)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
252274	Photon OS 5.0: Git PHSA-2025-5.0-0590	Nessus	PhotonOS Local Security Checks	2025/8/19	2025/8/23	critical
178628	Oracle Solaris Critical Patch Update : jul2023_SRU11_4_59_144_2	Nessus	Solaris Local Security Checks	2023/7/20	2025/10/21	critical

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high

critical

critical