The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has cyrus-sasl packages installed that are affected by a vulnerability:

  - In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL     INSERT or UPDATE statement. (CVE-2022-24407)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0013 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2019-19906:
    cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-     service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an off-by-one     error in _sasl_add_string in common.c in cyrus-sasl.

    CVE-2022-24407:
    In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL     INSERT or UPDATE statement.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-5301-2 advisory.

    USN-5301-1 fixed a vulnerability in Cyrus. This update provides the corresponding update for Ubuntu 14.04     ESM and Ubuntu 16.04 ESM.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:0653-1 advisory.

  - In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL     INSERT or UPDATE statement. (CVE-2022-24407)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of cyrus-sasl installed on the remote host is prior to 2.1.27-18. It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-234 advisory.

  - In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL     INSERT or UPDATE statement. (CVE-2022-24407)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2022-3085:02 advisory.

    cyrus-sasl: failure to properly escape SQL input allows an attacker to     execute arbitrary SQL commands (CVE-2022-24407)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-002280 advisory.

    In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL     INSERT or UPDATE statement.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 6.0.2.6. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-6.0.2.6 advisory.

  - CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw     V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists. (CVE-2022-23307)

  - By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the     values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be     included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or     headers of an application that are logged allowing unintended SQL queries to be executed. Note this issue     only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default.
    Beginning in version 2.0-beta8, the JDBCAppender was re-introduced with proper support for parameterized     SQL queries and further customization over the columns written to in logs. Apache Log4j 1.2 reached end of     life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the     previous versions. (CVE-2022-23305)

  - AIDE before 0.17.4 allows local users to obtain root privileges via crafted file metadata (such as XFS     extended attributes or tmpfs ACLs), because of a heap-based buffer overflow. (CVE-2021-45417)

  - Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data     which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when     listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.
    (CVE-2019-17571)

  - Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an     SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent     through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1 (CVE-2020-9488)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
167505	NewStart CGSL CORE 5.04 / MAIN 5.04 : cyrus-sasl Vulnerability (NS-SA-2022-0077)	Nessus	NewStart CGSL Local Security Checks	2022/11/15	2022/11/15	high
236479	Alibaba Cloud Linux 3 : 0013: cyrus-sasl (ALINUX3-SA-2022:0013)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	high
158271	Ubuntu 16.04 ESM : Cyrus SASL vulnerability (USN-5301-2)	Nessus	Ubuntu Local Security Checks	2022/2/23	2024/8/29	high
158506	SUSE SLES12 Security Update : cyrus-sasl (SUSE-SU-2022:0653-1)	Nessus	SuSE Local Security Checks	2022/3/2	2023/7/13	high
168595	Amazon Linux 2022 : cyrus-sasl (ALAS2022-2022-234)	Nessus	Amazon Linux Local Security Checks	2022/12/10	2024/12/11	high
293792	MiracleLinux 7 : cyrus-sasl-2.1.26-24.el7 (AXSA:2022-3085:02)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
341244	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: cyrus-sasl (UTSA-2025-002280)	Nessus	Unity Linux Local Security Checks	2026/8/28	2026/8/28	high
164607	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.0.2.6)	Nessus	Misc.	2022/9/1	2026/8/15	critical

検出

プラグインの検索

high

high

high

high

high

high

high

critical