The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0007 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-15284:
    Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: <     6.14.1.


    SummaryThe arrayLimitoption in qs does not enforce limits for bracket notation (a[]=1&a[]=2), allowing     attackers to cause denial-of-service via memory exhaustion. Applications using arrayLimitfor DoS     protection are vulnerable.

    DetailsThe arrayLimitoption only checks limits for indexed notation (a[0]=1&a[1]=2) but completely     bypasses it for bracket notation (a[]=1&a[]=2).

    Vulnerable code(lib/parse.js:159-162):

    if (root === '[]' && options.parseArrays) {       obj = utils.combine([], leaf);  // No arrayLimit check     }





    Working code(lib/parse.js:175):

    else if (index <= options.arrayLimit) {  // Limit checked here       obj = [];
      obj[index] = leaf;
    }





    The bracket notation handler at line 159 uses utils.combine([], leaf)without validating against     options.arrayLimit, while indexed notation at line 175 checks index <= options.arrayLimitbefore creating     arrays.

    PoCTest 1 - Basic bypass:

    npm install qs





    const qs = require('qs');
    const result = qs.parse('a[]=1&a[]=2&a[]=3&a[]=4&a[]=5&a[]=6', { arrayLimit: 5 });
    console.log(result.a.length);  // Output: 6 (should be max 5)





    Test 2 - DoS demonstration:

    const qs = require('qs');
    const attack = 'a[]=' + Array(10000).fill('x').join('&a[]=');
    const result = qs.parse(attack, { arrayLimit: 100 });
    console.log(result.a.length);  // Output: 10000 (should be max 100)





    Configuration:

    *  arrayLimit: 5(test 1) or arrayLimit: 100(test 2)
    *  Use bracket notation: a[]=value(not indexed a[0]=value)


    ImpactDenial of Service via memory exhaustion. Affects applications using qs.parse()with user-controlled     input and arrayLimitfor protection.

    Attack scenario:

    *  Attacker sends HTTP request: GET /api/search?filters[]=x&filters[]=x&...&filters[]=x(100,000+ times)
    *  Application parses with qs.parse(query, { arrayLimit: 100 })
    *  qs ignores limit, parses all 100,000 elements into array
    *  Server memory exhausted  application crashes or becomes unresponsive
    *  Service unavailable for all users     Real-world impact:

    *  Single malicious request can crash server
    *  No authentication required
    *  Easy to automate and scale
    *  Affects any endpoint parsing query strings with bracket notation

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Atlassian Jira Service Management Data Center and Server (Jira Service Desk) running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16491 advisory.

  - Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: <     6.14.1. SummaryThe arrayLimit option in qs does not enforce limits for bracket notation (a[]=1&a[]=2),     allowing attackers to cause denial-of-service via memory exhaustion. Applications using arrayLimit for DoS     protection are vulnerable. DetailsThe arrayLimit option only checks limits for indexed notation     (a[0]=1&a[1]=2) but completely bypasses it for bracket notation (a[]=1&a[]=2). Vulnerable code     (lib/parse.js:159-162): if (root === '[]' && options.parseArrays) { obj = utils.combine([], leaf); // No     arrayLimit check } Working code (lib/parse.js:175): else if (index <= options.arrayLimit) { // Limit     checked here obj = []; obj[index] = leaf; } The bracket notation handler at line 159 uses     utils.combine([], leaf) without validating against options.arrayLimit, while indexed notation at line 175     checks index <= options.arrayLimit before creating arrays. PoCTest 1 - Basic bypass: npm install qs const     qs = require('qs'); const result = qs.parse('a[]=1&a[]=2&a[]=3&a[]=4&a[]=5&a[]=6', { arrayLimit: 5 });
    console.log(result.a.length); // Output: 6 (should be max 5) Test 2 - DoS demonstration: const qs =     require('qs'); const attack = 'a[]=' + Array(10000).fill('x').join('&a[]='); const result =     qs.parse(attack, { arrayLimit: 100 }); console.log(result.a.length); // Output: 10000 (should be max 100)     Configuration: * arrayLimit: 5 (test 1) or arrayLimit: 100 (test 2) * Use bracket notation: a[]=value (not     indexed a[0]=value) ImpactDenial of Service via memory exhaustion. Affects applications using qs.parse()     with user-controlled input and arrayLimit for protection. Attack scenario: * Attacker sends HTTP request:
    GET /api/search?filters[]=x&filters[]=x&...&filters[]=x (100,000+ times) * Application parses with     qs.parse(query, { arrayLimit: 100 }) * qs ignores limit, parses all 100,000 elements into array * Server     memory exhausted  application crashes or becomes unresponsive * Service unavailable for all users Real-     world impact: * Single malicious request can crash server * No authentication required * Easy to automate     and scale * Affects any endpoint parsing query strings with bracket notation (CVE-2025-15284)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:18480 advisory.

    The Intel SGX SDK is a collection of APIs, libraries, documentations and tools that allow software     developers to create and debug Intel SGX enabled applications in C/C++.

    Security Fix(es):

    * qs: qs: Denial of Service via improper input validation in array parsing (CVE-2025-15284)

    * node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in     archives (CVE-2026-23745)

    * node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition     (CVE-2026-23950)

    * lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465)

    * node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check     (CVE-2026-24842)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 10 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:18868 advisory.

    The Intel SGX SDK is a collection of APIs, libraries, documentations and tools that allow software     developers to create and debug Intel SGX enabled applications in C/C++.

    Security Fix(es):

    * qs: qs: Denial of Service via improper input validation in array parsing (CVE-2025-15284)

    * node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in     archives (CVE-2026-23745)

    * node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition     (CVE-2026-23950)

    * lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465)

    * node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check     (CVE-2026-24842)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:18868 advisory.

    * qs: qs: Denial of Service via improper input validation in array parsing (CVE-2025-15284)

    * node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in     archives (CVE-2026-23745)

    * node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition     (CVE-2026-23950)

    * lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465)

    * node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check     (CVE-2026-24842)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
282604	TencentOS Server 4: grafana (TSSA-2026:0007)	Nessus	Tencent Local Security Checks	2026/1/12	2026/3/6	medium
297642	Atlassian Jira Service Management Data Center and Server 10.3.x < 10.3.16 (JSDSERVER-16491)	Nessus	Misc.	2026/2/3	2026/3/4	medium
315307	RHEL 10 : linux-sgx (RHSA-2026:18480)	Nessus	Red Hat Local Security Checks	2026/5/19	2026/5/19	high
315374	RHEL 9 : linux-sgx (RHSA-2026:18868)	Nessus	Red Hat Local Security Checks	2026/5/19	2026/5/19	high
317439	RockyLinux 9 : linux-sgx (RLSA-2026:18868)	Nessus	Rocky Linux Local Security Checks	2026/5/28	2026/5/28	high

検出

プラグインの検索

medium

medium

high

high

high