The installed version of nginx is 1.0.x prior to 1.22.1 or 1.1.x prior to 1.23.2. It is, therefore, affected by a memory disclosure in the ngx_http_mp4_module that allows an attacker to cause a worker process crash or worker process memory disclosure. The issues only affect nginx if it is built with the ngx_http_mp4_module (the module is not built by default) and the mp4 directive is used in the configuration file. Further, the attack is only possible if an attacker is able to trigger processing of a specially crafted mp4 file with the ngx_http_mp4_module.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Junos OS installed on the remote host is affected by multiple vulnerabilities as referenced in the JSA88135 advisory.

  - NGINX before 1.13.6 has a buffer overflow for years that exceed four digits, as demonstrated by a file     with a modification date in 1969 that causes an integer overflow (or a false modification date far in the     future), when encountered by the autoindex module. (CVE-2017-20005)

  - The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of     service (invalid pointer dereference and worker process crash) via a crafted UDP DNS response.
    (CVE-2016-0742)

  - Use-after-free vulnerability in the resolver in nginx 0.6.18 through 1.8.0 and 1.9.x before 1.9.10 allows     remote attackers to cause a denial of service (worker process crash) or possibly have unspecified other     impact via a crafted DNS response related to CNAME response processing. (CVE-2016-0746)

  - The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 does not properly limit CNAME resolution, which     allows remote attackers to cause a denial of service (worker process resource consumption) via vectors     related to arbitrary name resolution. (CVE-2016-0747)

  - The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on     Ubuntu 14.04 LTS, before 1.10.0-0ubuntu0.16.04.3 on Ubuntu 16.04 LTS, and before 1.10.1-0ubuntu1.1 on     Ubuntu 16.10, and the nginx ebuild before 1.10.2-r3 on Gentoo allow local users with access to the web     server user account to gain root privileges via a symlink attack on the error log. (CVE-2016-1247)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the openresty package has been released.

An update of the nginx package has been released.

According to its self-reported version number, Zimbra Collaboration Server is affected by multiple vulnerabilities including:

  -	NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1     and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module     ngx_http_mp4_module that might allow a local attacker to corrupt NGINX worker memory, resulting in its     termination or potential other impact using a specially crafted audio or video file. The issue affects     only NGINX products that are built with the ngx_http_mp4_module, when the mp4 directive is used in the     configuration file. Further, the attack is possible only if an attacker can trigger processing of a     specially crafted audio or video file with the module ngx_http_mp4_module. (CVE-2022-41741)

  - NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1     and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module     ngx_http_mp4_module that might allow a local attacker to cause a worker process crash, or might result in     worker process memory disclosure by using a specially crafted audio or video file. The issue affects only     NGINX products that are built with the module ngx_http_mp4_module, when the mp4 directive is used in the     configuration file. Further, the attack is possible only if an attacker can trigger processing of a     specially crafted audio or video file with the module ngx_http_mp4_module. (CVE-2022-41742)

  - An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. The zmmailboxdmgr binary, a component     of ZCS, is intended to be executed by the zimbra user with root privileges for specific mailbox     operations. However, an attacker can escalate privileges from the zimbra user to root, because of improper     handling of input arguments. An attacker can execute arbitrary commands with elevated privileges, leading     to local privilege escalation. (CVE-2024-27442)

  - An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS)     vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface, because     of improper input validation in the handling of the calendar header. An attacker can exploit this via an     email message containing a crafted calendar header with an embedded XSS payload. When a victim views this     message in the Zimbra webmail classic interface, the payload is executed in the context of the victim's     session, potentially leading to execution of arbitrary JavaScript code. (CVE-2024-27443)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:7546 advisory.

    nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency,     performance, and low memory usage.

    Security Fix(es):

    * nginx: Memory corruption in the ngx_http_mp4_module (CVE-2022-41741)

    * nginx: Memory disclosure in the ngx_http_mp4_module (CVE-2022-41742)

    * nginx: specially crafted MP4 file may cause denial of service (CVE-2024-7347)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
166545	nginx 1.1.x < 1.23.2 / 1.0.x < 1.22.1 Memory Disclosure	Nessus	Web Servers	10/26/2022	7/17/2026	high
310760	Juniper Junos OS Multiple Vulnerabilities (JSA88135)	Nessus	Junos Local Security Checks	4/28/2026	4/30/2026	medium
332695	Photon OS 5.0: Openresty PHSA-2023-5.0-91-0056	Nessus	PhotonOS Local Security Checks	8/5/2026	8/5/2026	high
333946	Photon OS 5.0: Nginx PHSA-2023-5.0-91-0078	Nessus	PhotonOS Local Security Checks	8/10/2026	8/10/2026	high
237012	Zimbra Collaboration Server 9.x < 9.0.0 Patch 39, 10.0.x < 10.0.7 Multiple Vulnerabilities	Nessus	CGI abuses	5/21/2025	5/21/2025	high
235919	RHEL 9 : nginx (RHSA-2025:7546)	Nessus	Red Hat Local Security Checks	5/14/2025	6/5/2025	medium

Detections

Analytics

Plugins Search

high

medium

high

high

high

medium