According to the versions of the pam packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login     process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.(CVE-2024-22365)

Tenable has extracted the preceding description block directly from the EulerOS pam security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the Linux package has been released.

According to the versions of the pam package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login     process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY. (CVE-2024-22365)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the pam-1.5.1-19.el9 build changelog.

  - linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login     process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY. (CVE-2024-22365)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2025:1749571728 advisory.

  - A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can     trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs,     the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result     in leaked passwords, such as those found in /etc/shadow while performing authentications. (CVE-2024-10041)

  - linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login     process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY. (CVE-2024-22365)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 7.02, has pam packages installed that are affected by multiple vulnerabilities:

  - linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login     process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY. (CVE-2024-22365)

  - A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can     trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs,     the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result     in leaked passwords, such as those found in /etc/shadow while performing authentications. (CVE-2024-10041)

  - A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as     hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname,     gaining unauthorized access. This issue poses a risk for systems that rely on this feature to control who     can access certain services or terminals. (CVE-2024-10963)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AHV installed on the remote host is prior to 20230302.102005. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-20230302.101026 advisory.

  - A crafted NTFS image can trigger a heap-based buffer overflow, caused by an unsanitized attribute in     ntfs_get_attribute_value, in NTFS-3G < 2021.8.22. (CVE-2021-39263)

  - EDK2's Network Package is susceptible to a buffer overflow vulnerability when processing DNS Servers     option from a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.
    (CVE-2023-45234)

  - Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote     attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the     KeyTrap issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the     protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG     records. (CVE-2023-50387)

  - The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped)     allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC     responses in a random subdomain attack, aka the NSEC3 issue. The RFC 5155 specification implies that an     algorithm must perform thousands of iterations of a hash function in certain situations. (CVE-2023-50868)

  - close_altfile in filename.c in less before 606 omits shell_quote calls for LESSCLOSE. (CVE-2022-48624)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
207609	EulerOS 2.0 SP8 : pam (EulerOS-SA-2024-2483)	Nessus	Huawei Local Security Checks	9/24/2024	9/24/2024	medium
203625	Photon OS 4.0: Linux PHSA-2024-4.0-0554	Nessus	PhotonOS Local Security Checks	7/23/2024	7/23/2024	medium
191801	EulerOS 2.0 SP11 : pam (EulerOS-SA-2024-1221)	Nessus	Huawei Local Security Checks	3/12/2024	3/12/2024	medium
332549	Photon OS 5.0: Linux PHSA-2024-5.0-91-0193	Nessus	PhotonOS Local Security Checks	8/5/2026	8/5/2026	medium
193930	CentOS 9 : pam-1.5.1-19.el9	Nessus	CentOS Local Security Checks	4/26/2024	4/26/2024	medium
361027	CentOS Linux 7 [TuxCare] Security Update: pam / pam-devel Multiple Vulnerabilities (CENTOS7:CLSA-2025:1749571728)	Nessus	CentOS Local Security Checks	10/1/2026	10/1/2026	medium
242731	NewStart CGSL MAIN 7.02 : pam Multiple Vulnerabilities (NS-SA-2025-0191)	Nessus	NewStart CGSL Local Security Checks	7/25/2025	7/25/2025	medium
204181	Photon OS 5.0: Linux PHSA-2024-5.0-0193	Nessus	PhotonOS Local Security Checks	7/24/2024	10/13/2026	medium
206824	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20230302.101026)	Nessus	Misc.	9/9/2024	10/6/2025	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

medium

medium

medium