The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:18149 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 8.0.121 and .NET Runtime 8.0.21.Security Fix(es):

    * dotnet: .NET Information Disclosure Vulnerability (CVE-2025-55248)

    * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2025-55315)

    * dotnet: .NET Denial of Service Vulnerability (CVE-2025-55247)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-18150 advisory.

    [9.0.111-1.0.1]
    - Add support for Oracle Linux

    [9.0.111-1]
    - Update to .NET SDK 9.0.111 and Runtime 9.0.10
    - Resolves: RHEL-116856

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-18153 advisory.

    [9.0.111-1.0.1]
    - Add support for Oracle Linux

    [9.0.111-1]
    - Update to .NET SDK 9.0.111 and Runtime 9.0.10
    - Resolves: RHEL-116860

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-18149 advisory.

    [8.0.121-1.0.1]
    - Add support for Oracle Linux

    [8.0.121-1]
    - Update to .NET SDK 8.0.121 and Runtime 8.0.21
    - Resolves: RHEL-116866

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:18148 advisory.

    * dotnet: .NET Information Disclosure Vulnerability (CVE-2025-55248)

    * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2025-55315)

    * dotnet: .NET Denial of Service Vulnerability (CVE-2025-55247)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:18150 advisory.

    * dotnet: .NET Information Disclosure Vulnerability (CVE-2025-55248)
      * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2025-55315)
      * dotnet: .NET Denial of Service Vulnerability (CVE-2025-55247)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2025-10996:21 advisory.

    * dotnet: .NET Information Disclosure Vulnerability (CVE-2025-55248)
      * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2025-55315)
      * dotnet: .NET Denial of Service Vulnerability (CVE-2025-55247)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tenable Identity Exposure running on the remote host is prior to 3.93.5. It is, therefore, affected by multiple vulnerabilities according to advisory TNS-2026-16:

  - Tenable Identity Exposure contains multiple unauthenticated API endpoints under /w/api/* that expose     sensitive application configuration data including cleartext LDAP credentials, SAML configuration, user     accounts, and directory settings to unauthenticated remote attackers. Affected responses are served with     Cache-Control: public headers and without Vary: Cookie, allowing reverse proxies and CDNs to cache and     serve sensitive data to unauthenticated users even after authentication is applied. (CVE-2026-13007)

  - Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows     an authorized attacker to bypass a security feature over a network. (CVE-2025-55315)

  - Converting an excessively large OCTET STRING value to a hexadecimal string leads to a heap buffer     overflow on 32 bit platforms. A heap buffer overflow may lead to a crash or possibly an attacker     controlled code execution or other undefined behavior. (CVE-2026-31789)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by information disclosure vulnerability as referenced in the vendor advisory.

  - Inadequate encryption strength in .NET, .NET Framework, Visual Studio allows an authorized attacker to     disclose information over a network. (CVE-2025-55248)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:18148 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 8.0.121 and .NET Runtime 8.0.21.Security Fix(es):

    * dotnet: .NET Information Disclosure Vulnerability (CVE-2025-55248)

    * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2025-55315)

    * dotnet: .NET Denial of Service Vulnerability (CVE-2025-55247)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:18256 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 8.0.121 and .NET Runtime 8.0.21.Security Fix(es):

    * dotnet: .NET Information Disclosure Vulnerability (CVE-2025-55248)

    * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2025-55315)

    * dotnet: .NET Denial of Service Vulnerability (CVE-2025-55247)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:18153 advisory.

    * dotnet: .NET Information Disclosure Vulnerability (CVE-2025-55248)

    * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2025-55315)

    * dotnet: .NET Denial of Service Vulnerability (CVE-2025-55247)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.04 / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7822-1 advisory.

    It was discovered that .NET did not properly handle the creation of temporary build time directories. An     attacker could possibly use this issue to cause a denial of service. (CVE-2025-55247)

    It was discovered that .NET did not properly establish TLS sessions for SMTP server connections. An     attacker could use this issue to cause .NET to use unencrypted connections. This issue only affects .NET     versions 8.0 and 9.0. (CVE-2025-55248)

    It was discovered that .NET inconsistently interpreted certain http requests. An attacker could possibly     use this to bypass a security feature over a network. (CVE-2025-55315)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:18149 advisory.

    * dotnet: .NET Information Disclosure Vulnerability (CVE-2025-55248)
      * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2025-55315)
      * dotnet: .NET Denial of Service Vulnerability (CVE-2025-55247)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tenable Identity Exposure (formerly Tenable.ad) installed on the remote host is prior to 3.77.14. It therefore contains vulnerable versions of third-party components (.NET, SQL Server, and curl). Tenable has upgraded these components to address the potential impact of the issues, including the following:

  - Inconsistent interpretation of HTTP requests ('HTTP request/response smuggling') in ASP.NET Core allows an     authorized attacker to bypass a security feature over a network. (CVE-2025-55315)

  - Use of uninitialized resource in SQL Server allows an unauthorized attacker to disclose information over a network.     (CVE-2025-49718)

  - A cookie is set using the `secure` keyword for `https://target`. Curl is redirected to or otherwise made to speak     with `http://target` (same hostname, but using clear text HTTP) using the same cookie set. The same cookie name is     set - but with just a slash as path (`path='/'`). Since this site is not secure, the cookie should just be     ignored. A bug in the path comparison logic makes curl read outside a heap buffer boundary. The bug either causes a     crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the     contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following     the single-byte allocation that holds the path. (CVE-2025-9086)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2025-10978:23 advisory.

    * dotnet: .NET Information Disclosure Vulnerability (CVE-2025-55248)
      * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2025-55315)
      * dotnet: .NET Denial of Service Vulnerability (CVE-2025-55247)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft .NET Framework installation on the remote host is missing a security update. It is, therefore, affected by the following vulnerability:

  - An information disclosure vulnerability. An attacker can     exploit this to disclose potentially sensitive     information. (CVE-2025-55248)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
270584	RHEL 9 : .NET 8.0 (RHSA-2025:18149)	Nessus	Red Hat Local Security Checks	2025/10/15	2026/2/24	critical
270661	Oracle Linux 8 : .NET / 9.0 (ELSA-2025-18150)	Nessus	Oracle Linux Local Security Checks	2025/10/16	2026/2/24	critical
270662	Oracle Linux 10 : .NET / 9.0 (ELSA-2025-18153)	Nessus	Oracle Linux Local Security Checks	2025/10/16	2026/2/24	critical
270664	Oracle Linux 9 : .NET / 8.0 (ELSA-2025-18149)	Nessus	Oracle Linux Local Security Checks	2025/10/16	2026/2/24	critical
270684	RockyLinux 8 : .NET 8.0 (RLSA-2025:18148)	Nessus	Rocky Linux Local Security Checks	2025/10/17	2026/2/24	critical
272196	AlmaLinux 8 : .NET 9.0 (ALSA-2025:18150)	Nessus	Alma Linux Local Security Checks	2025/11/3	2026/2/24	high
283179	MiracleLinux 8 : dotnet8.0-8.0.121-1.el8_10.ML.1 (AXSA:2025-10996:21)	Nessus	Miracle Linux Local Security Checks	2026/1/13	2026/2/13	high
322483	Tenable Identity Exposure < 3.93.5 Multiple Vulnerabilities (TNS-2026-16)	Nessus	Misc.	2026/6/24	2026/6/25	high
270711	Security Update for Microsoft .NET Core (October 2025)	Nessus	Misc.	2025/10/17	2026/5/19	medium
270589	RHEL 8 : .NET 8.0 (RHSA-2025:18148)	Nessus	Red Hat Local Security Checks	2025/10/15	2026/2/24	critical
270659	RHEL 9 : .NET 8.0 (RHSA-2025:18256)	Nessus	Red Hat Local Security Checks	2025/10/16	2026/2/24	critical
270758	RockyLinux 10 : .NET 9.0 (RLSA-2025:18153)	Nessus	Rocky Linux Local Security Checks	2025/10/18	2026/2/24	critical
270785	Ubuntu 22.04 LTS / 24.04 LTS / 25.04 / 25.10 : .NET vulnerabilities (USN-7822-1)	Nessus	Ubuntu Local Security Checks	2025/10/20	2025/10/20	critical
270820	AlmaLinux 9 : .NET 8.0 (ALSA-2025:18149)	Nessus	Alma Linux Local Security Checks	2025/10/21	2026/2/24	critical
272257	Tenable Identity Exposure < 3.77.14 Multiple Vulnerabilities (TNS-2025-23)	Nessus	Misc.	2025/11/4	2025/11/4	critical
282942	MiracleLinux 9 : dotnet9.0-9.0.111-1.el9_6.ML.1 (AXSA:2025-10978:23)	Nessus	Miracle Linux Local Security Checks	2026/1/13	2026/2/16	high
271264	Security Updates for Microsoft .NET Framework (October 2025)	Nessus	Windows : Microsoft Bulletins	2025/10/23	2026/7/20	medium

检测

插件搜索

critical

critical

critical

critical

critical

high

high

high

medium

critical

critical

critical

critical

critical

critical

high

medium