The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:8678 advisory.

    * golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)

    * dompurify: nesting-based mutation XSS vulnerability (CVE-2024-47875)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2024:7550 advisory.

    * golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:8847 advisory.

    The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries     and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.

    Security Fix(es):

    * golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2024:0231 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2024-47875:
    DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was     vulnerable to nesting-based mXSS. This vulnerability is fixed in 2.5.0 and 3.1.3.

    CVE-2024-9355:
    A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an     uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be     possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac     sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum. It     is also possible to force a derived key to be all zeros instead of an unpredictable value. This may have     follow-on implications for the Go TLS stack.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0734 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2024-9355:
    A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an     uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be     possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac     sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum. It     is also possible to force a derived key to be all zeros instead of an unpredictable value. This may have     follow-on implications for the Go TLS stack.

    CVE-2024-47875:
    DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was     vulnerable to nesting-based mXSS. This vulnerability is fixed in 2.5.0 and 3.1.3.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:8678 advisory.

    Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &     OpenTSDB.

    Security Fix(es):

    * golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)

    * dompurify: nesting-based mutation XSS vulnerability (CVE-2024-47875)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2024:8847 advisory.

    * golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-7118 advisory.

    osbuild     [141-1.0.1]
    - Add runner for ol8 and ol9 [Orabug: 36400619]

    [141-1]
    - New upstream release

    [140-1]
    - New upstream release

    [139-1]
    - New upstream release

    [138-1]
    - New upstream release

    [137-1]
    - New upstream release

    [136-1]
    - New upstream release

    [135-1]
    - New upstream release

    [132-1]
    - New upstream release

    [131-1]
    - New upstream release

    [130-1]
    - New upstream release

    osbuild-composer     [132-1.0.1]
    - Add support to create OpenScap images [JIRA: OLDIS-35301]
    - Simplify repository names [JIRA: OLDIS-35893]
    - Refactor patches to fix some naming and set a correct kernel for Oracle Linux [Orabug: 37253643]
    - Support using OCI variables inside built images [JIRA: OLDIS-35302]
    - Support using repository definitons with OCI variables [JIRA: OLDIS-38657]
    - Update repositories to contain OCI variables
    - Remove image types Minimal-raw and wsl [JIRA: OLDIS-38123]
    - Increase default /boot size to 1GB [Orabug: 36827079]
    - Add support for OCI hybrid images [JIRA: OLDIS-33593]
    - enable aarch64 OCI image builds [JIRA: OLDIS-33593]
    - support for building OL8/9 images on Oracle Linux 9 [Orabug: 36400619]

    [132-1]
    - New upstream release

    [131-1]
    - New upstream release

    [128-1]
    - New upstream release

    [127-1]
    - New upstream release

    [126-1]
    - New upstream release

    [125-1]
    - New upstream release

    [124-1]
    - New upstream release

    [123-1]
    - New upstream release

    [122-1]
    - New upstream release

    [121-1]
    - New upstream release

    [118-1]
    - New upstream release

    [117-1]
    - New upstream release

    [116-1]
    - New upstream release

    [115-1]
    - New upstream release

    [114-1]
    - New upstream release

    [113-1]
    - New upstream release

    [110-1]
    - New upstream release

    [109-1]
    - New upstream release

    [108-1]
    - New upstream release

    [104-1]
    - New upstream release

    [102-1]
    - New upstream release

    [101-1]
    - New upstream release

    [100-1]
    - New upstream release

    [99-1]
    - New upstream release

    [98-1]
    - New upstream release

    [96-1]
    - New upstream release

    [95-1]
    - New upstream release

    [94-1]
    - New upstream release

    [93-1]
    - New upstream release

    [92-1]
    - New upstream release

    [91-1]
    - New upstream release

    [89-1]
    - New upstream release

    [88-1]
    - New upstream release

    [87-1]
    - New upstream release

    [86-1]
    - New upstream release

    [85-1]
    - New upstream release

    [84-1]
    - New upstream release

    [82-1]
    - New upstream release

    [80-1]
    - New upstream release

    [79-1]
    - New upstream release

    [77-1]
    - New upstream release

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
210617	RockyLinux 9 : grafana (RLSA-2024:8678)	Nessus	Rocky Linux Local Security Checks	2024/11/8	2025/9/30	medium
209705	RockyLinux 9 : golang (RLSA-2024:7550)	Nessus	Rocky Linux Local Security Checks	2024/10/25	2024/10/25	medium
210351	RHEL 8 : grafana-pcp (RHSA-2024:8847)	Nessus	Red Hat Local Security Checks	2024/11/5	2025/3/6	medium
236146	Alibaba Cloud Linux 3 : 0231: grafana (ALINUX3-SA-2024:0231)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	high
276122	TencentOS Server 3: grafana (TSSA-2024:0734)	Nessus	Tencent Local Security Checks	2025/11/20	2025/11/20	high
209914	RHEL 9 : grafana (RHSA-2024:8678)	Nessus	Red Hat Local Security Checks	2024/10/30	2025/9/30	medium
210625	RockyLinux 8 : grafana-pcp (RLSA-2024:8847)	Nessus	Rocky Linux Local Security Checks	2024/11/8	2024/11/8	medium
237049	Oracle Linux 9 : osbuild / and / osbuild-composer (ELSA-2025-7118)	Nessus	Oracle Linux Local Security Checks	2025/5/22	2025/9/11	high

检测

插件搜索

medium

medium

medium

high

high

medium

medium

high