The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2022:7519 advisory.

  - sanitize-url: XSS due to improper sanitization in sanitizeUrl function (CVE-2021-23648)

  - golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)

  - golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)

  - grafana: Forward OAuth Identity Token can allow users to access some data sources (CVE-2022-21673)

  - prometheus/client_golang: Denial of service using InstrumentHandlerCounter (CVE-2022-21698)

  - grafana: XSS vulnerability in data source handling (CVE-2022-21702)

  - grafana: CSRF vulnerability can lead to privilege escalation (CVE-2022-21703)

  - grafana: IDOR vulnerability can lead to information disclosure (CVE-2022-21713)

  - golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)

  - golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)

  - golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)

  - golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)

  - golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)

  - golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)

  - golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2022:7529 advisory.

  - golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)

  - cri-o: memory exhaustion on the node when access to the kube api (CVE-2022-1708)

  - golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)

  - prometheus/client_golang: Denial of service using InstrumentHandlerCounter (CVE-2022-21698)

  - golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)

  - golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)

  - golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)

  - golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)

  - golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)

  - golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2022-4363:06 advisory.

    * sanitize-url: XSS due to improper sanitization in sanitizeUrl function (CVE-2021-23648)
      * golang: net/[http:](http:) improper sanitization of Transfer-Encoding header (CVE-2022-1705)
      * golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)
      * grafana: Forward OAuth Identity Token can allow users to access some data sources (CVE-2022-21673)
      * prometheus/client_golang: Denial of service using InstrumentHandlerCounter (CVE-2022-21698)
      * grafana: XSS vulnerability in data source handling (CVE-2022-21702)
      * grafana: CSRF vulnerability can lead to privilege escalation (CVE-2022-21703)
      * grafana: IDOR vulnerability can lead to information disclosure (CVE-2022-21713)
      * golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)
      * golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)
      * golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)
      * golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)
      * golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)
      * golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)
      * golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working     (CVE-2022-32148)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2022_1762 advisory.

    * psgo: Privilege escalation in 'podman top' (CVE-2022-1227)

    * prometheus/client_golang: Denial of service using InstrumentHandlerCounter (CVE-2022-21698)

    * podman: Default inheritable capabilities for linux container should be empty (CVE-2022-27649)

    * crun: Default inheritable capabilities for linux container should be empty (CVE-2022-27650)

    * buildah: Default inheritable capabilities for linux container should be empty (CVE-2022-27651)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
167149	CentOS 8 : grafana (CESA-2022:7519)	Nessus	CentOS Local Security Checks	2022/11/9	2023/10/5	high
167185	CentOS 8 : container-tools:3.0 (CESA-2022:7529)	Nessus	CentOS Local Security Checks	2022/11/9	2023/10/5	medium
293531	MiracleLinux 8 : grafana-7.5.15-3.el8 (AXSA:2022-4363:06)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/2/24	high
358578	Rocky Linux 8 [CIQ] Security Update: aardvark-dns / buildah / buildah-debuginfo / buildah-debugsource / etc Multiple Vulnerabilities (crlsa-2022_1762)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high

检测

插件搜索

high

medium

high

high