The Microsoft SQL Server installation on the remote host is missing a security update. It is, therefore, affected by the following vulnerabilities:

  - Improper Handling of Exceptional Conditions in Newtonsoft.Json (CVE-2024-21907)

  - An information disclosure vulnerability (CVE-2025-47997)

  - A privilege escalation vulnerability (CVE-2025-55227)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

リモートホストにインストールされている Microsoft SQL Server にセキュリティ更新プログラムがありません。このため、以下の脆弱性の影響を受けます。

  * Newtonsoft.Json での例外的な状態の不適切な処理 (CVE-2024-21907)

  - 情報漏洩の脆弱性 (CVE-2025-47997)

  - 権限昇格の脆弱性 (CVE-2025-55227)

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

远程主机上的 Microsoft SQL Server 安装缺少安全更新。因此，该应用程序受到以下漏洞的影响：

  - 在 Newtonsoft.Json 中不当处理 Exceptional Conditions (CVE-2024-21907)

  - 信息泄露漏洞 (CVE-2025-47997)

  - 特权提升漏洞 (CVE-2025-55227)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

遠端主機上的 Microsoft SQL Server 安裝缺少安全性更新。因此，該應用程式受到以下弱點影響：

  Newtonsoft.Json 中的例外狀況處理不當 (CVE-2024-21907)

  - 一個資訊洩漏弱點 (CVE-2025-47997)

  - 特權提升弱點 (CVE-2025-55227)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

The version of Tenable Identity Exposure (formerly Tenable.ad) installed on the remote host is prior to 3.77.14. It therefore contains vulnerable versions of third-party components (.NET, SQL Server, and curl). Tenable has upgraded these components to address the potential impact of the issues, including the following:

  - Inconsistent interpretation of HTTP requests ('HTTP request/response smuggling') in ASP.NET Core allows an     authorized attacker to bypass a security feature over a network. (CVE-2025-55315)

  - Use of uninitialized resource in SQL Server allows an unauthorized attacker to disclose information over a network.     (CVE-2025-49718)

  - A cookie is set using the `secure` keyword for `https://target`. Curl is redirected to or otherwise made to speak     with `http://target` (same hostname, but using clear text HTTP) using the same cookie set. The same cookie name is     set - but with just a slash as path (`path='/'`). Since this site is not secure, the cookie should just be     ignored. A bug in the path comparison logic makes curl read outside a heap buffer boundary. The bug either causes a     crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the     contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following     the single-byte allocation that holds the path. (CVE-2025-9086)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
261809	Security Updates for Microsoft SQL Server (September 2025)	Nessus	Windows : Microsoft Bulletins	2025/9/9	2025/9/17	high
261809	Microsoft SQL Server のセキュリティ更新プログラム (2025 年 9 月)	Nessus	Windows : Microsoft Bulletins	2025/9/9	2025/9/17	high
261809	Microsoft SQL Server 的安全更新（2025 年 9 月）	Nessus	Windows : Microsoft Bulletins	2025/9/9	2025/9/17	high
261809	Microsoft SQL Server 的安全性更新 (2025 年 9 月)	Nessus	Windows : Microsoft Bulletins	2025/9/9	2025/9/17	high
272257	Tenable Identity Exposure < 3.77.14 Multiple Vulnerabilities (TNS-2025-23)	Nessus	Misc.	2025/11/4	2025/11/4	critical

检测

插件搜索

high

high

high

high

critical