According to the versions of the libxml2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-     based buffer under-read. To exploit this, a crafted XML document must be validated against an XML schema     with certain identity constraints, or a crafted XML schema must be used.(CVE-2025-32415)

    In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API     (Python bindings) because of an incorrect return value. This occurs in xmlPythonFileRead and     xmlPythonFileReadRaw because of a difference between bytes and characters.(CVE-2025-32414)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization libxml2 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libxml2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in     pattern.c.(CVE-2025-27113)

    libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and     xmlSchemaBubbleIDCNodeTables in xmlschemas.c. To exploit this, a crafted XML document must be validated     against an XML schema with certain identity constraints, or a crafted XML schema must be     used.(CVE-2024-56171)

    libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements     in valid.c. To exploit this, DTD validation must occur for an untrusted document or untrusted DTD. NOTE:
    this is similar to CVE-2017-9047.(CVE-2025-24928)

    In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-     based buffer under-read. To exploit this, a crafted XML document must be validated against an XML schema     with certain identity constraints, or a crafted XML schema must be used.(CVE-2025-32415)

Tenable has extracted the preceding description block directly from the EulerOS libxml2 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-13429 advisory.

    - Fix CVE-2025-32415 (RHEL-100174)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Nessus Network Monitor running on the remote host is prior to 6.5.1. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2025-10 advisory.

  - In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a     heap-based buffer under-read. To exploit this, a crafted XML document must be validated against an XML     schema with certain identity constraints, or a crafted XML schema must be used. (CVE-2025-32415)

  - When installing Tenable Network Monitor to a non-default location on a Windows host, Tenable Network     Monitor versions prior to 6.5.1 did not enforce secure permissions for sub-directories. This could allow     for local privilege escalation if users had not secured the directories in the non-default installation     location. (CVE-2025-24916)

  - In Tenable Network Monitor versions prior to 6.5.1 on a Windows host, it was found that a     non-administrative user could stage files in a local directory to run arbitrary code with SYSTEM     privileges, potentially leading to local privilege escalation. (CVE-2025-24917)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of HTTP Server installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2025 CPU advisory.

  - In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-     based buffer under-read. To exploit this, a crafted XML document must be validated against an XML schema     with certain identity constraints, or a crafted XML schema must be used. (CVE-2025-32415)

  - Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where     Oracle HTTP Server executes to compromise Oracle HTTP Server. While the vulnerability is in Oracle HTTP     Server, attacks may significantly impact additional products (scope change). Successful attacks of this     vulnerability can result in unauthorized creation, deletion or modification access to critical data or     all Oracle HTTP Server accessible data as well as unauthorized access to critical data or complete access     to all Oracle HTTP Server accessible data. (CVE-2024-56171)

  - Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise     Oracle HTTP Server. Successful attacks of this vulnerability can result in unauthorized update, insert or     delete access to some of Oracle HTTP Server accessible data as well as unauthorized read access to a subset     of Oracle HTTP Server accessible data and unauthorized ability to cause a partial denial of service (partial     DOS) of Oracle HTTP Server. (CVE-2025-0725)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AHV installed on the remote host is prior to 20230302.103072. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-20230302.103072 advisory.

  - There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could     exceed the number of columns available. This could lead to a memory corruption issue. We recommend     upgrading to version 3.50.2 or above. (CVE-2025-6965)

  - LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize),     affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data     corruption.) NOTE: the vendor states only a few specific / uncommon usages of the API are at risk.
    (CVE-2019-17543)

  - A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under     certain circumstances when the XML schematron has the <sch:name path=.../> schema elements. This flaw     allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the     program's crash using libxml or other possible undefined behaviors. (CVE-2025-49794)

  - A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can     trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that     can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to     sensitive data being corrupted in memory. (CVE-2025-49796)

  - A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations     can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of     service when processing crafted input. (CVE-2025-6021)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
265100	EulerOS Virtualization 2.13.0 : libxml2 (EulerOS-SA-2025-2175)	Nessus	Huawei Local Security Checks	9/16/2025	9/16/2025	high
238402	EulerOS 2.0 SP11 : libxml2 (EulerOS-SA-2025-1670)	Nessus	Huawei Local Security Checks	6/12/2025	6/12/2025	high
246421	Oracle Linux 10 : libxml2 (ELSA-2025-13429)	Nessus	Oracle Linux Local Security Checks	8/8/2025	10/29/2025	high
237289	Nessus Network Monitor < 6.5.1 Multiple Vulnerabilities (TNS-2025-10)	Nessus	Misc.	5/27/2025	5/30/2025	high
242271	Oracle HTTP Server (July 2025 CPU)	Nessus	Web Servers	7/17/2025	10/30/2025	critical
269976	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20230302.103072)	Nessus	Misc.	10/10/2025	10/10/2025	high

Detections

Analytics

Plugins Search

high

high

high

high

critical

high