遠端主機上安裝的 Siemens SINEC NMS 版本比 2.0.1.0 舊。因此，它受到 SSA-943925 公告中提及的多個弱點影響。

  - 3.3.4 及之前的 coreruleset (即 OWASP ModSecurity Core Rule Set) 在某些平台上未偵測到多個 Content-Type 要求標頭。攻擊者可能藉此使用特製的承載繞過 WAF，即 WAF 和後端應用程式之間的 Content-Type 混淆。若 Web 應用程式僅依賴最後一個 Content-Type 標頭，則會發生此情況。其他平台可能會拒絕其他 Content-Type 標頭或合併衝突的標頭，進而導致偵測格式錯誤的標頭。
    (CVE-2023-38199)

  - Apache HTTP Server 2.4.0 至 2.4.55 版上的某些 mod_proxy 組態允許 HTTP 要求走私攻擊。當 mod_proxy 與某種形式的 RewriteRule 或 ProxyPassMatch 一起啟用時，組態會受到影響，其中非特定模式符合使用者提供的要求目標 (URL) 資料的某些部分，然後使用變量替換重新插入代理請求目標。示例如下：RewriteRule ^/here/(.*) http://example.com:8080/elsewhere?$1; 上的 RewriteEngine；[P] ProxyPassReverse /here/ http://example.com:8080/ 要求分割/走私可導致繞過 Proxy 伺服器中的存取控制、將非預定 URL 代理至現有的原始伺服器，以及快取毒害。建議使用者至少更新至 Apache HTTP Server 的 2.4.56 版。(CVE-2023-25690)

  - 使用「Module._load()」可繞過原則機制，並針對特定模組要求 policy.json 定義之外的模組。此弱點會影響在下列所有有效版本系列中使用實驗性原則機制的所有使用者：16.x、18.x 和 20.x。請注意，在此 CVE 發布時，此原則為 Node.js 的實驗性功能。(CVE-2023-32002)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3586 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * c-ares: 0-byte UDP payload Denial of Service (CVE-2023-32067)

    * c-ares: Buffer Underwrite in ares_inet_net_pton() (CVE-2023-31130)

    * c-ares: Insufficient randomness in generation of DNS query IDs (CVE-2023-31147)

    * c-ares: AutoTools does not set CARES_RANDOM_FILE during cross compilation (CVE-2023-31124)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3577 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * c-ares: 0-byte UDP payload Denial of Service (CVE-2023-32067)

    * c-ares: Buffer Underwrite in ares_inet_net_pton() (CVE-2023-31130)

    * c-ares: Insufficient randomness in generation of DNS query IDs (CVE-2023-31147)

    * c-ares: AutoTools does not set CARES_RANDOM_FILE during cross compilation (CVE-2023-31124)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4034 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * c-ares: 0-byte UDP payload Denial of Service (CVE-2023-32067)

    * c-ares: Buffer Underwrite in ares_inet_net_pton() (CVE-2023-31130)

    * c-ares: Insufficient randomness in generation of DNS query IDs (CVE-2023-31147)

    * c-ares: AutoTools does not set CARES_RANDOM_FILE during cross compilation (CVE-2023-31124)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the c-ares package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build     system, CARES_RANDOM_FILE will not be set, as seen when cross compiling aarch64 android. This will     downgrade to using rand() as a fallback which could allow an attacker to take advantage of the lack of     entropy by not using a CSPRNG. This issue was patched in version 1.19.1. (CVE-2023-31124)

  - c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for     certain ipv6 addresses, in particular '0::00:00:00/2' was found to cause an issue. C-ares only uses this     function internally for configuration purposes which would require an administrator to configure such an     address via ares_set_sortlist(). However, users may externally use ares_inet_net_pton() for other purposes     and thus be vulnerable to more severe issues. This issue has been fixed in 1.19.1. (CVE-2023-31130)

  - c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares     uses rand() to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not     seeded by srand() so will generate predictable output. Input from the random number generator is fed into     a non-compilant RC4 implementation and may not be as strong as the original RC4 implementation. No attempt     is made to look for modern OS-provided CSPRNGs like arc4random() that is widely available. This issue has     been fixed in version 1.19.1. (CVE-2023-31147)

  - c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target     resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to     the target resolver. The target resolver erroneously interprets the 0 length as a graceful shutdown of the     connection. This issue has been patched in version 1.19.1. (CVE-2023-32067)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the c-ares packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build     system, CARES_RANDOM_FILE will not be set, as seen when cross compiling aarch64 android. This will     downgrade to using rand() as a fallback which could allow an attacker to take advantage of the lack of     entropy by not using a CSPRNG. This issue was patched in version 1.19.1. (CVE-2023-31124)

  - c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for     certain ipv6 addresses, in particular '0::00:00:00/2' was found to cause an issue. C-ares only uses this     function internally for configuration purposes which would require an administrator to configure such an     address via ares_set_sortlist(). However, users may externally use ares_inet_net_pton() for other purposes     and thus be vulnerable to more severe issues. This issue has been fixed in 1.19.1. (CVE-2023-31130)

  - c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares     uses rand() to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not     seeded by srand() so will generate predictable output. Input from the random number generator is fed into     a non-compilant RC4 implementation and may not be as strong as the original RC4 implementation. No attempt     is made to look for modern OS-provided CSPRNGs like arc4random() that is widely available. This issue has     been fixed in version 1.19.1. (CVE-2023-31147)

  - c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target     resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to     the target resolver. The target resolver erroneously interprets the 0 length as a graceful shutdown of the     connection. This issue has been patched in version 1.19.1. (CVE-2023-32067)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the c-ares packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build     system, CARES_RANDOM_FILE will not be set, as seen when cross compiling aarch64 android. This will     downgrade to using rand() as a fallback which could allow an attacker to take advantage of the lack of     entropy by not using a CSPRNG. This issue was patched in version 1.19.1. (CVE-2023-31124)

  - c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for     certain ipv6 addresses, in particular '0::00:00:00/2' was found to cause an issue. C-ares only uses this     function internally for configuration purposes which would require an administrator to configure such an     address via ares_set_sortlist(). However, users may externally use ares_inet_net_pton() for other purposes     and thus be vulnerable to more severe issues. This issue has been fixed in 1.19.1. (CVE-2023-31130)

  - c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares     uses rand() to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not     seeded by srand() so will generate predictable output. Input from the random number generator is fed into     a non-compilant RC4 implementation and may not be as strong as the original RC4 implementation. No attempt     is made to look for modern OS-provided CSPRNGs like arc4random() that is widely available. This issue has     been fixed in version 1.19.1. (CVE-2023-31147)

  - c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target     resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to     the target resolver. The target resolver erroneously interprets the 0 length as a graceful shutdown of the     connection. This issue has been patched in version 1.19.1. (CVE-2023-32067)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the c-ares package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build     system, CARES_RANDOM_FILE will not be set, as seen when cross compiling aarch64 android. This will     downgrade to using rand() as a fallback which could allow an attacker to take advantage of the lack of     entropy by not using a CSPRNG. This issue was patched in version 1.19.1. (CVE-2023-31124)

  - c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for     certain ipv6 addresses, in particular '0::00:00:00/2' was found to cause an issue. C-ares only uses this     function internally for configuration purposes which would require an administrator to configure such an     address via ares_set_sortlist(). However, users may externally use ares_inet_net_pton() for other purposes     and thus be vulnerable to more severe issues. This issue has been fixed in 1.19.1. (CVE-2023-31130)

  - c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares     uses rand() to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not     seeded by srand() so will generate predictable output. Input from the random number generator is fed into     a non-compilant RC4 implementation and may not be as strong as the original RC4 implementation. No attempt     is made to look for modern OS-provided CSPRNGs like arc4random() that is widely available. This issue has     been fixed in version 1.19.1. (CVE-2023-31147)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the c-ares package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build     system, CARES_RANDOM_FILE will not be set, as seen when cross compiling aarch64 android. This will     downgrade to using rand() as a fallback which could allow an attacker to take advantage of the lack of     entropy by not using a CSPRNG. This issue was patched in version 1.19.1. (CVE-2023-31124)

  - c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for     certain ipv6 addresses, in particular '0::00:00:00/2' was found to cause an issue. C-ares only uses this     function internally for configuration purposes which would require an administrator to configure such an     address via ares_set_sortlist(). However, users may externally use ares_inet_net_pton() for other purposes     and thus be vulnerable to more severe issues. This issue has been fixed in 1.19.1. (CVE-2023-31130)

  - c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares     uses rand() to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not     seeded by srand() so will generate predictable output. Input from the random number generator is fed into     a non-compilant RC4 implementation and may not be as strong as the original RC4 implementation. No attempt     is made to look for modern OS-provided CSPRNGs like arc4random() that is widely available. This issue has     been fixed in version 1.19.1. (CVE-2023-31147)

  - c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target     resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to     the target resolver. The target resolver erroneously interprets the 0 length as a graceful shutdown of the     connection. This issue has been patched in version 1.19.1. (CVE-2023-32067)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the c-ares package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build     system, CARES_RANDOM_FILE will not be set, as seen when cross compiling aarch64 android. This will     downgrade to using rand() as a fallback which could allow an attacker to take advantage of the lack of     entropy by not using a CSPRNG. This issue was patched in version 1.19.1. (CVE-2023-31124)

  - c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for     certain ipv6 addresses, in particular '0::00:00:00/2' was found to cause an issue. C-ares only uses this     function internally for configuration purposes which would require an administrator to configure such an     address via ares_set_sortlist(). However, users may externally use ares_inet_net_pton() for other purposes     and thus be vulnerable to more severe issues. This issue has been fixed in 1.19.1. (CVE-2023-31130)

  - c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares     uses rand() to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not     seeded by srand() so will generate predictable output. Input from the random number generator is fed into     a non-compilant RC4 implementation and may not be as strong as the original RC4 implementation. No attempt     is made to look for modern OS-provided CSPRNGs like arc4random() that is widely available. This issue has     been fixed in version 1.19.1. (CVE-2023-31147)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the c-ares package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build     system, CARES_RANDOM_FILE will not be set, as seen when cross compiling aarch64 android. This will     downgrade to using rand() as a fallback which could allow an attacker to take advantage of the lack of     entropy by not using a CSPRNG. This issue was patched in version 1.19.1. (CVE-2023-31124)

  - c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares     uses rand() to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not     seeded by srand() so will generate predictable output. Input from the random number generator is fed into     a non-compilant RC4 implementation and may not be as strong as the original RC4 implementation. No attempt     is made to look for modern OS-provided CSPRNGs like arc4random() that is widely available. This issue has     been fixed in version 1.19.1. (CVE-2023-31147)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the nodejs-16.20.1-1.el9 build changelog.

  - The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require     modules outside of the policy.json definition. This vulnerability affects all users using the experimental     policy mechanism in all active release lines: v16, v18 and, v20. Please note that at the time this CVE was     issued, the policy is an experimental feature of Node.js (CVE-2023-30581)

  - When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a     non-expect termination occurs making it susceptible to DoS attacks when the attacker could force     interruptions of application processing, as the process terminates when accessing public key info of     provided certificates from user code. The current context of the users will be gone, and that will cause a     DoS scenario. This vulnerability affects all active Node.js versions v16, v18, and, v20. (CVE-2023-30588)

  - The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit     HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient     to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence     should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20     (CVE-2023-30589)

  - The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or     outdated) keys, that is, it only generates a private key if none has been set yet, but the function is     also needed to compute the corresponding public key after calling setPrivateKey(). However, the     documentation says this API call: Generates private and public Diffie-Hellman key values. The documented     behavior is very different from the actual behavior, and this difference could easily lead to security     issues in applications that use these APIs as the DiffieHellman may be used as the basis for application-     level security, implications are consequently broad. (CVE-2023-30590)

  - c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build     system, CARES_RANDOM_FILE will not be set, as seen when cross compiling aarch64 android. This will     downgrade to using rand() as a fallback which could allow an attacker to take advantage of the lack of     entropy by not using a CSPRNG. This issue was patched in version 1.19.1. (CVE-2023-31124)

  - c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for     certain ipv6 addresses, in particular 0::00:00:00/2 was found to cause an issue. C-ares only uses this     function internally for configuration purposes which would require an administrator to configure such an     address via ares_set_sortlist(). However, users may externally use ares_inet_net_pton() for other purposes     and thus be vulnerable to more severe issues. This issue has been fixed in 1.19.1. (CVE-2023-31130)

  - c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares     uses rand() to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not     seeded by srand() so will generate predictable output. Input from the random number generator is fed into     a non-compilant RC4 implementation and may not be as strong as the original RC4 implementation. No attempt     is made to look for modern OS-provided CSPRNGs like arc4random() that is widely available. This issue has     been fixed in version 1.19.1. (CVE-2023-31147)

  - c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target     resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to     the target resolver. The target resolver erroneously interprets the 0 length as a graceful shutdown of the     connection. This issue has been patched in version 1.19.1. (CVE-2023-32067)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2023:4034 advisory.

  - c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build     system, CARES_RANDOM_FILE will not be set, as seen when cross compiling aarch64 android. This will     downgrade to using rand() as a fallback which could allow an attacker to take advantage of the lack of     entropy by not using a CSPRNG. This issue was patched in version 1.19.1. (CVE-2023-31124)

  - c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for     certain ipv6 addresses, in particular 0::00:00:00/2 was found to cause an issue. C-ares only uses this     function internally for configuration purposes which would require an administrator to configure such an     address via ares_set_sortlist(). However, users may externally use ares_inet_net_pton() for other purposes     and thus be vulnerable to more severe issues. This issue has been fixed in 1.19.1. (CVE-2023-31130)

  - c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares     uses rand() to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not     seeded by srand() so will generate predictable output. Input from the random number generator is fed into     a non-compilant RC4 implementation and may not be as strong as the original RC4 implementation. No attempt     is made to look for modern OS-provided CSPRNGs like arc4random() that is widely available. This issue has     been fixed in version 1.19.1. (CVE-2023-31147)

  - c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target     resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to     the target resolver. The target resolver erroneously interprets the 0 length as a graceful shutdown of the     connection. This issue has been patched in version 1.19.1. (CVE-2023-32067)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:4034 advisory.

  - c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build     system, CARES_RANDOM_FILE will not be set, as seen when cross compiling aarch64 android. This will     downgrade to using rand() as a fallback which could allow an attacker to take advantage of the lack of     entropy by not using a CSPRNG. This issue was patched in version 1.19.1. (CVE-2023-31124)

  - c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for     certain ipv6 addresses, in particular 0::00:00:00/2 was found to cause an issue. C-ares only uses this     function internally for configuration purposes which would require an administrator to configure such an     address via ares_set_sortlist(). However, users may externally use ares_inet_net_pton() for other purposes     and thus be vulnerable to more severe issues. This issue has been fixed in 1.19.1. (CVE-2023-31130)

  - c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares     uses rand() to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not     seeded by srand() so will generate predictable output. Input from the random number generator is fed into     a non-compilant RC4 implementation and may not be as strong as the original RC4 implementation. No attempt     is made to look for modern OS-provided CSPRNGs like arc4random() that is widely available. This issue has     been fixed in version 1.19.1. (CVE-2023-31147)

  - c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target     resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to     the target resolver. The target resolver erroneously interprets the 0 length as a graceful shutdown of the     connection. This issue has been patched in version 1.19.1. (CVE-2023-32067)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:4035 advisory.

  - A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the     input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of     service or a limited impact on confidentiality and integrity. (CVE-2022-4904)

  - c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build     system, CARES_RANDOM_FILE will not be set, as seen when cross compiling aarch64 android. This will     downgrade to using rand() as a fallback which could allow an attacker to take advantage of the lack of     entropy by not using a CSPRNG. This issue was patched in version 1.19.1. (CVE-2023-31124)

  - c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for     certain ipv6 addresses, in particular 0::00:00:00/2 was found to cause an issue. C-ares only uses this     function internally for configuration purposes which would require an administrator to configure such an     address via ares_set_sortlist(). However, users may externally use ares_inet_net_pton() for other purposes     and thus be vulnerable to more severe issues. This issue has been fixed in 1.19.1. (CVE-2023-31130)

  - c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares     uses rand() to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not     seeded by srand() so will generate predictable output. Input from the random number generator is fed into     a non-compilant RC4 implementation and may not be as strong as the original RC4 implementation. No attempt     is made to look for modern OS-provided CSPRNGs like arc4random() that is widely available. This issue has     been fixed in version 1.19.1. (CVE-2023-31147)

  - c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target     resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to     the target resolver. The target resolver erroneously interprets the 0 length as a graceful shutdown of the     connection. This issue has been patched in version 1.19.1. (CVE-2023-32067)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:3577 advisory.

    * c-ares: 0-byte UDP payload Denial of Service (CVE-2023-32067)
    * c-ares: Buffer Underwrite in ares_inet_net_pton() (CVE-2023-31130)
    * c-ares: Insufficient randomness in generation of DNS query IDs (CVE-2023-31147)
    * c-ares: AutoTools does not set CARES_RANDOM_FILE during cross compilation (CVE-2023-31124)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares     uses rand() to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not     seeded by srand() so will generate predictable output. Input from the random number generator is fed into     a non-compilant RC4 implementation and may not be as strong as the original RC4 implementation. No attempt     is made to look for modern OS-provided CSPRNGs like arc4random() that is widely available. This issue has     been fixed in version 1.19.1. (CVE-2023-31147)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Siemens SINEC NMS installed on the remote host is prior to 2.0.1.0. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA-943925 advisory.

  - coreruleset (aka OWASP ModSecurity Core Rule Set) through 3.3.4 does not detect multiple Content-Type     request headers on some platforms. This might allow attackers to bypass a WAF with a crafted payload,     aka Content-Type confusion between the WAF and the backend application. This occurs when the web     application relies on only the last Content-Type header. Other platforms may reject the additional     Content-Type header or merge conflicting headers, leading to detection as a malformed header.
    (CVE-2023-38199)

  - Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request     Smuggling attack. Configurations are affected when mod_proxy is enabled along with some form of     RewriteRule or ProxyPassMatch in which a non-specific pattern matches some portion of the user-supplied     request-target (URL) data and is then re-inserted into the proxied request-target using variable     substitution. For example, something like: RewriteEngine on RewriteRule ^/here/(.*)     http://example.com:8080/elsewhere?$1; [P] ProxyPassReverse /here/ http://example.com:8080/ Request     splitting/smuggling could result in bypass of access controls in the proxy server, proxying unintended     URLs to existing origin servers, and cache poisoning. Users are recommended to update to at least version     2.4.56 of Apache HTTP Server. (CVE-2023-25690)

  - The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json     definition for a given module. This vulnerability affects all users using the experimental policy     mechanism in all active release lines: 16.x, 18.x and, 20.x. Please note that at the time this CVE was     issued, the policy is an experimental feature of Node.js. (CVE-2023-32002)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
191429	Siemens SINEC NMS < V2.0 SP1 多個弱點	Nessus	Windows	2024/2/29	2024/10/7	critical
177303	RHEL 9 : nodejs (RHSA-2023:3586)	Nessus	Red Hat Local Security Checks	2023/6/14	2025/3/11	medium
177308	RHEL 9 : nodejs:18 (RHSA-2023:3577)	Nessus	Red Hat Local Security Checks	2023/6/14	2025/3/11	medium
178235	RHEL 8 : nodejs:16 (RHSA-2023:4034)	Nessus	Red Hat Local Security Checks	2023/7/13	2025/3/11	medium
179546	EulerOS 2.0 SP9 : c-ares (EulerOS-SA-2023-2605)	Nessus	Huawei Local Security Checks	2023/8/8	2023/8/8	medium
188985	EulerOS Virtualization 3.0.6.0 : c-ares (EulerOS-SA-2023-3421)	Nessus	Huawei Local Security Checks	2024/1/16	2024/1/16	medium
189049	EulerOS 2.0 SP8 : c-ares (EulerOS-SA-2023-3115)	Nessus	Huawei Local Security Checks	2024/1/16	2024/1/16	medium
188699	EulerOS 2.0 SP10 : c-ares (EulerOS-SA-2023-2804)	Nessus	Huawei Local Security Checks	2024/1/16	2024/1/16	medium
188749	EulerOS Virtualization 2.9.1 : c-ares (EulerOS-SA-2023-2951)	Nessus	Huawei Local Security Checks	2024/1/16	2024/1/16	medium
188824	EulerOS Virtualization 2.10.0 : c-ares (EulerOS-SA-2023-2932)	Nessus	Huawei Local Security Checks	2024/1/16	2024/1/16	medium
188854	EulerOS Virtualization 2.11.1 : c-ares (EulerOS-SA-2023-3049)	Nessus	Huawei Local Security Checks	2024/1/16	2024/1/16	medium
191426	CentOS 9 : nodejs-16.20.1-1.el9	Nessus	CentOS Local Security Checks	2024/2/29	2024/4/26	high
178196	CentOS 8 : nodejs:16 (CESA-2023:4034)	Nessus	CentOS Local Security Checks	2023/7/12	2024/2/8	medium
184518	Rocky Linux 8 : nodejs:16 (RLSA-2023:4034)	Nessus	Rocky Linux Local Security Checks	2023/11/6	2023/11/6	medium
180394	Rocky Linux 8 : nodejs:18 (RLSA-2023:4035)	Nessus	Rocky Linux Local Security Checks	2023/8/31	2023/11/6	high
177350	AlmaLinux 9 : nodejs:18 (ALSA-2023:3577)	Nessus	Alma Linux Local Security Checks	2023/6/15	2025/1/13	medium
227147	Linux Distros Unpatched Vulnerability : CVE-2023-31147	Nessus	Misc.	2025/3/5	2025/8/20	medium
191429	Siemens SINEC NMS < V2.0 SP1 Multiple Vulnerabilities	Nessus	Windows	2024/2/29	2024/10/7	critical

偵測

搜尋 Plugin

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

medium

medium

high

medium

medium

critical