According to its self-reported version, the Tenable Security Center running on the remote host is prior to 6.5.0. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2024-19 advisory.

  - Security Center leverages third-party software to help provide underlying functionality. Several of the     third-party components (OpenSSL, PHP, Apache Portable Runtime) were found to contain vulnerabilities, and     updated versions have been made available by the providers.Out of caution and in line with best practice,     Tenable has opted to upgrade these components to address the potential impact of the issues. Security     Center 6.5.0 updates OpenSSL to version 3.0.15, PHP to version 8.2.24 and Apache Portable Runtime to     version 1.7.5 to address the identified vulnerabilities.Additionally, one separate vulnerability was     discovered, reported and fixed:An Improper Certificate Validation vulnerability exists in Tenable Security     Center where an authenticated, privileged attacker could intercept email messages sent from Security     Center via a rogue SMTP server. - CVE-2024-12174 Tenable has released Security Center 6.5.0 to address     these issues. The installation files can be obtained from the Tenable Downloads Portal:
    https://www.tenable.com/downloads/security-center (CVE-2023-49582, CVE-2024-12174, CVE-2024-4603,     CVE-2024-4741, CVE-2024-5458, CVE-2024-5535, CVE-2024-5585, CVE-2024-6119)

  - An Improper Certificate Validation vulnerability exists in Tenable Security Center where an authenticated,     privileged attacker could intercept email messages sent from Security Center via a rogue SMTP server.
    (CVE-2024-12174)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Tenable Security Center running on the remote host is . It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2024-12 advisory.

  - Security Center leverages third-party software to help provide underlying functionality. One of the third-     party components (PHP) was found to contain vulnerabilities, and updated versions have been made available     by the providers.Out of caution and in line with best practice, Tenable has opted to upgrade these     components to address the potential impact of the issues. Security Center Patch SC-202407.1 updates PHP to     version 8.2.20 to address the identified vulnerabilities. Tenable has released Security Center Patch     SC-202407.1 to address these issues. The installation files can be obtained from the Tenable Downloads     Portal: https://www.tenable.com/downloads/security-center (CVE-2024-5458, CVE-2024-5585)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of php81 installed on the remote host is prior to 8.1.29 / 8.3.8. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2024-158-01 advisory.

    New php packages are available for Slackware 15.0 and -current to fix security issues.

Tenable has extracted the preceding description block directly from the php81 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-52c23ef1ec advisory.

    **PHP version 8.2.20** (06 Jun 2024)

    **CGI:**

    * Fixed buffer limit on Windows, replacing read call usage by _read. (David Carlier)
    * Fixed bug [GHSA-3qgc-jrrr-25jv](https://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jv)     (Bypass of CVE-2012-1823, Argument Injection in PHP-CGI). (CVE-2024-4577) (nielsdos)

    **CLI:**

    * Fixed bug [GH-14189](https://github.com/php/php-src/issues/14189) (PHP Interactive shell input state     incorrectly handles quoted heredoc literals.). (nielsdos)

    **Core:**

    * Fixed bug [GH-13970](https://github.com/php/php-src/issues/13970) (Incorrect validation of #[Attribute]     flags type for non-compile-time expressions). (ilutov)
    * Fixed bug [GH-14140](https://github.com/php/php-src/issues/14140) (Floating point bug in range operation     on Apple Silicon hardware). (Derick, Saki)

    **DOM:**

    * Fix crashes when entity declaration is removed while still having entity references. (nielsdos)
    * Fix references not handled correctly in C14N. (nielsdos)
    * Fix crash when calling childNodes next() when iterator is exhausted. (nielsdos)
    * Fix crash in ParentNode::append() when dealing with a fragment containing text nodes. (nielsdos)

    **FFI:**

    * Fixed bug [GH-14215](https://github.com/php/php-src/issues/14215) (Cannot use FFI::load on CRLF header     file with apache2handler). (nielsdos)

    **Filter:**

    * Fixed bug [GHSA-w8qr-v226-r27w](https://github.com/php/php-src/security/advisories/GHSA-w8qr-v226-r27w)     (Filter bypass in filter_var FILTER_VALIDATE_URL). (**CVE-2024-5458**) (nielsdos)

    **FPM:**

    * Fix bug [GH-14175](https://github.com/php/php-src/issues/14175) (Show decimal number instead of     scientific notation in systemd status). (Benjamin Cremer)

    **Hash:**

    * ext/hash: Swap the checking order of `__has_builtin` and `__GNUC__` (Saki Takamachi)

    **Intl:**

    * Fixed build regression on systems without C++17 compilers. (Calvin Buckley, Peter Kokot)

    **Ini:**

    * Fixed bug [GH-14100](https://github.com/php/php-src/issues/14100) (Corrected spelling mistake in php.ini     files). (Marcus Xavier)

    **MySQLnd:**

    * Fix bug [GH-14255](https://github.com/php/php-src/issues/14255) (mysqli_fetch_assoc reports error from     nested query). (Kamil Tekiela)

    **Opcache:**

    * Fixed bug [GH-14109](https://github.com/php/php-src/issues/14109) (Fix accidental persisting of internal     class constant in shm). (ilutov)

    **OpenSSL:**

    * The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is     the default), is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes     the changes from this pull request: https://github.com/openssl/openssl/pull/13817     (rsa_pkcs1_implicit_rejection). These changes are part of OpenSSL 3.2 and have also been backported to     stable versions of various Linux distributions, as well as to the PHP builds provided for Windows since     the previous release. All distributors and builders should ensure that this version is used to prevent PHP     from being vulnerable. (**CVE-2024-2408**)

    **Standard:**

    * Fixed bug [GHSA-9fcc-425m-g385](https://github.com/php/php-src/security/advisories/GHSA-9fcc-425m-g385)     (Bypass of CVE-2024-1874). (CVE-2024-5585) (nielsdos)

    **XML:**

    * Fixed bug [GH-14124](https://github.com/php/php-src/issues/14124) (Segmentation fault with XML extension     under certain memory limit). (nielsdos)

    **XMLReader:**

    * Fixed bug [GH-14183](https://github.com/php/php-src/issues/14183) (XMLReader::open() can't be     overridden). (nielsdos)



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
212128	Tenable Security Center < 6.5.0 Multiple Vulnerabilities (TNS-2024-19)	Nessus	Misc.	2024/12/6	2026/1/21	high
206716	Tenable Security Center Multiple Vulnerabilities (TNS-2024-12)	Nessus	Misc.	2024/9/6	2024/9/6	high
200177	Slackware Linux 15.0 / current php81 Multiple Vulnerabilities (SSA:2024-158-01)	Nessus	Slackware Local Security Checks	2024/6/6	2024/10/4	critical
200458	Fedora 39 : php (2024-52c23ef1ec)	Nessus	Fedora Local Security Checks	2024/6/13	2024/10/4	critical

偵測

搜尋 Plugin

high

high

critical

critical