The version of AOS installed on the remote host is prior to 6.10.1. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-6.10.1 advisory.

  - An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer     overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX). (CVE-2024-45492)

  - BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many     selectors. (CVE-2019-12900)

  - RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any     valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-     prefix collision attack against MD5 Response Authenticator signature. (CVE-2024-3596)

  - A vulnerability was found in GNU Nano that allows a possible privilege escalation through an insecure     temporary file. If Nano is killed while editing, a file it saves to an emergency file with the permissions     of the running user provides a window of opportunity for attackers to escalate privileges through a     malicious symlink. (CVE-2024-5742)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u411,     8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle     GraalVM Enterprise Edition: 20.3.14 and 21.3.10. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. (CVE-2024-21131)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too     narrow and an invalid character/length combination could be passed to xsltNumberFormatDecimal, leading to     a read of uninitialized stack data. (CVE-2019-13118)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to its self-reported version, the Nessus Network Monitor running on the remote host is prior to 6.2.2. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2023-23 advisory. Several of the third-party components were found to contain vulnerabilities, and updated versions have been made available by the providers. Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues. Nessus Network Monitor 6.2.2 updates the following components:

  - c-ares from version 1.10.0 to version 1.19.1.
  - curl from version 7.79.1 to version 8.1.2.
  - libbzip2 from version 1.0.6 to version 1.0.8.
  - libpcre from version 8.42 to version 8.44.
  - libxml2 from version 2.7.7 to version 2.11.1.
  - libxslt from version 1.1.26 to version 1.1.37.
  - libxmlsec from version 1.2.18 to version 1.2.37.
  - sqlite from version 3.27.2 to version 3.40.1.
  - jQuery Cookie from version 1.3.1 to version 1.4.1.
  - jQuery UI from version 1.13.0 to version 1.13.2.
  - OpenSSL from version 3.0.8 to version 3.0.9.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
215141	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.10.1)	Nessus	Misc.	2025/2/7	2026/6/30	critical
260339	Linux Distros Unpatched Vulnerability : CVE-2019-13118	Nessus	Misc.	2025/9/2	2026/9/2	medium
177842	Nessus Network Monitor < 6.2.2 Multiple Vulnerabilities (TNS-2023-23)	Nessus	Misc.	2023/6/30	2023/7/6	critical

検出

プラグインの検索

critical

medium

critical