The remote host is running a version of macOS that is 10.12.x prior to 10.12.4. It is, therefore, affected by multiple vulnerabilities in multiple components, some of which are remote code execution vulnerabilities. An unauthenticated, remote attacker can exploit these remote code execution vulnerabilities by convincing a user to visit a specially crafted website, resulting in the execution of arbitrary code in the context of the current user. The affected components are as follows :

  - apache
  - apache_mod_php
  - AppleGraphicsPowerManagement
  - AppleRAID
  - Audio
  - Bluetooth
  - Carbon
  - CoreGraphics
  - CoreMedia
  - CoreText
  - curl
  - EFI
  - FinderKit
  - FontParser
  - HTTPProtocol
  - Hypervisor
  - iBooks
  - ImageIO
  - Intel Graphics Driver
  - IOATAFamily
  - IOFireWireAVC
  - IOFireWireFamily
  - Kernel
  - Keyboards
  - libarchive
  - libc++abi
  - LibreSSL
  - MCX Client
  - Menus
  - Multi-Touch
  - OpenSSH
  - OpenSSL
  - Printing
  - python
  - QuickTime
  - Security
  - SecurityFoundation
  - sudo
  - System Integrity Protection
  - tcpdump
  - tiffutil
  - WebKit

The version of Junos OS installed on the remote host is prior to 12.3X48-D55, 12.3R12-S13, 15.1X49-D100, 15.1F6-S12, 16.1R3-S4, 16.2R1-S4, 17.1R1-S2, or 17.2R1. It is, therefore, affected by a vulnerability as referenced in the JSA10940 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Junos OS installed on the remote host is affected by multiple vulnerabilities as referenced in the JSA11169 advisory.

  - Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote     attackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent-socket.
    (CVE-2016-10009)

  - sshd in OpenSSH before 7.4, when privilege separation is not used, creates forwarded Unix-domain sockets     as root, which might allow local users to gain privileges via unspecified vectors, related to     serverloop.c. (CVE-2016-10010)

  - authfile.c in sshd in OpenSSH before 7.4 does not properly consider the effects of realloc on buffer     contents, which might allow local users to obtain sensitive private-key information by leveraging access     to a privilege-separated child process. (CVE-2016-10011)

  - The shared memory manager (associated with pre-authentication compression) in sshd in OpenSSH before 7.4     does not ensure that a bounds check is enforced by all compilers, which might allows local users to gain     privileges by leveraging access to a sandboxed privilege-separation process, related to the m_zback and     m_zlib data structures. (CVE-2016-10012)

  - sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL pointer dereference     and daemon crash) via an out-of-sequence NEWKEYS message, as demonstrated by Honggfuzz, related to kex.c     and packet.c. (CVE-2016-10708)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the remote pfSense install is affected by multiple vulnerabilities as stated in the referenced vendor advisories.

The version of F5 Networks BIG-IP installed on the remote host is prior to 14.1.0-14.1.2. It is, therefore, affected by a vulnerability as referenced in the K64292204 advisory.

  - sshd in OpenSSH before 7.4, when privilege separation is not used, creates forwarded Unix-domain sockets     as root, which might allow local users to gain privileges via unspecified vectors, related to     serverloop.c. (CVE-2016-10010)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The OpenSSH project reports :

- ssh-agent(1): Will now refuse to load PKCS#11 modules from paths outside a trusted whitelist (run-time configurable). Requests to load modules could be passed via agent forwarding and an attacker could attempt to load a hostile PKCS#11 module across the forwarded agent channel: PKCS#11 modules are shared libraries, so this would result in code execution on the system running the ssh-agent if the attacker has control of the forwarded agent-socket (on the host running the sshd server) and the ability to write to the filesystem of the host running ssh-agent (usually the host running the ssh client). (CVE-2016-10009)

- sshd(8): When privilege separation is disabled, forwarded Unix-domain sockets would be created by sshd(8) with the privileges of 'root' instead of the authenticated user. This release refuses Unix-domain socket forwarding when privilege separation is disabled (Privilege separation has been enabled by default for 14 years).
CVE-2016-10010)

According to its banner, the version of OpenSSH running on the remote host is prior to 7.4. It is, therefore, affected by multiple vulnerabilities :

  - A flaw exists in ssh-agent due to loading PKCS#11     modules from paths that are outside a trusted whitelist.
    A local attacker can exploit this, by using a crafted     request to load hostile modules via agent forwarding, to     execute arbitrary code. To exploit this vulnerability,     the attacker would need to control the forwarded     agent-socket (on the host running the sshd server) and     the ability to write to the file system of the host     running ssh-agent. (CVE-2016-10009)

  - A flaw exists in sshd due to creating forwarded     Unix-domain sockets with 'root' privileges whenever     privilege separation is disabled. A local attacker can     exploit this to gain elevated privileges.
    (CVE-2016-10010)

  - An information disclosure vulnerability exists in sshd     within the realloc() function due leakage of key     material to privilege-separated child processes when     reading keys. A local attacker can possibly exploit this     to disclose sensitive key material. Note that no such     leak has been observed in practice for normal-sized     keys, nor does a leak to the child processes directly     expose key material to unprivileged users.
    (CVE-2016-10011)

  - A flaw exists in sshd within the shared memory manager     used by pre-authenticating compression support due to a     bounds check being elided by some optimizing compilers     and due to the memory manager being incorrectly     accessible when pre-authenticating compression is     disabled. A local attacker can exploit this to gain     elevated privileges. (CVE-2016-10012)

  - A denial of service vulnerability exists in sshd when     handling KEXINIT messages. An unauthenticated, remote     attacker can exploit this, by sending multiple KEXINIT     messages, to consume up to 128MB per connection.

  - A flaw exists in sshd due to improper validation of     address ranges by the AllowUser and DenyUsers     directives at configuration load time. A local attacker     can exploit this, via an invalid CIDR address range, to     gain access to restricted areas.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
99134	macOS 10.12.x < 10.12.4 Multiple Vulnerabilities (httpoxy)	Nessus	MacOS X Local Security Checks	2017/3/31	2025/12/26	critical
130514	Juniper JSA10940	Nessus	Junos Local Security Checks	2019/11/6	2023/7/20	high
148681	Juniper Junos OS Multiple Vulnerabilities (JSA11169)	Nessus	Junos Local Security Checks	2021/4/15	2023/7/20	high
106503	pfSense < 2.3.3 Multiple Vulnerabilities (SA-17_01 - SA-17_03)	Nessus	Firewalls	2018/1/31	2019/11/8	critical
133774	F5 Networks BIG-IP : OpenSSH vulnerability (K64292204)	Nessus	F5 Networks Local Security Checks	2020/2/19	2025/2/21	high
96116	FreeBSD : openssh -- multiple vulnerabilities (2aedd15f-ca8b-11e6-a9a5-b499baebfeaf)	Nessus	FreeBSD Local Security Checks	2016/12/27	2026/1/7	high
96151	OpenSSH < 7.4 Multiple Vulnerabilities	Nessus	Misc.	2016/12/27	2026/1/7	high

検出

プラグインの検索

critical

high

high

critical

high

high

high