According to its banner, the version of Apache running on the remote host is 2.4.x prior to 2.4.66. It is, therefore, affected by multiple vulnerabilities:

- Server-Side Request Forgery (SSRF) in Apache HTTP Server on Windows with AllowEncodedSlashes On and MergeSlashes Off allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content. (CVE-2025-59775)

- A security bypass vulnerability exists involving the interaction between mod_userdir and suexec. Users with access to use the RequestHeader directive in .htaccess via AllowOverride FileInfo can bypass restrictions and cause some CGI scripts to run under an unexpected userid. (CVE-2025-66200)

- An integer overflow in mod_md (ACME) in Apache HTTP Server allows for unintended retry intervals. In the case of failed ACME certificate renewal, the backoff timer can become 0, causing attempts to renew the certificate to repeat without delays (infinite loop) until success. (CVE-2025-55753)

- A vulnerability in mod_cgid allows for the injection of query strings into command executions. Apache HTTP Server with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd="..." directives. (CVE-2025-58098)

- Improper Neutralization of Escape, Meta, or Control Sequences in Apache HTTP Server allows environment variables set via the Apache configuration to unexpectedly supersede variables calculated by the server for CGI programs. (CVE-2025-65082) Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of httpd installed on the remote host is prior to 2.4.66. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2025-338-01 advisory.

    New httpd packages are available for Slackware 15.0 and -current to fix security issues.

Tenable has extracted the preceding description block directly from the httpd security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 6ebe4a30-d138-11f0-af8c-8447094a420f advisory.

    The Apache httpd project reports:
    See                 changelog or                 2.4 vulnerabilities for details.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through     environment variables set via the Apache configuration unexpectedly superseding variables calculated by     the server for CGI programs. This issue affects Apache HTTP Server from 2.4.0 through 2.4.65. Users are     recommended to upgrade to version 2.4.66 which fixes the issue. (CVE-2025-65082)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名稱	產品	系列	已發布	已更新	嚴重性
115071	Apache 2.4.x < 2.4.66 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	2025/12/8	2025/12/8	critical
277506	Slackware Linux 15.0 / current httpd Multiple Vulnerabilities (SSA:2025-338-01)	Nessus	Slackware Local Security Checks	2025/12/4	2025/12/4	high
277483	FreeBSD : Apache httpd -- Multiple vulnerabilities (6ebe4a30-d138-11f0-af8c-8447094a420f)	Nessus	FreeBSD Local Security Checks	2025/12/4	2025/12/4	high
277491	Linux Distros Unpatched Vulnerability : CVE-2025-65082	Nessus	Misc.	2025/12/4	2025/12/8	medium

偵測

搜尋 Plugin

critical

high

high

medium