The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0339 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2024-8986:
    A vulnerability was found in Grafana's data source proxy API, which allows authorization checks to be     bypassed by adding an extra slash character in the URL path. Users with minimal permissions could gain     unauthorized read access to GET endpoints in Alert manager and Prometheus data sources. The issue     primarily affects data sources that implement route-specific permissions, including Alert manager and     certain Prometheus-based data sources.

    CVE-2024-8118:
    The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character     (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked     as self-closing, and when using the Parse functions, this can result in content following such tags as     being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g.
    <math>, <svg>, etc contexts).

    CVE-2024-11741:
    The grafana plugin SDK bundles build metadata into the binaries it compiles; this metadata includes the     repository URI for the plugin being built, as retrieved by running `git remote get-url origin`.

    If credentials are included in the repository URI (for instance, to allow for fetching of private     dependencies), the final binary will contain the full URI, including said credentials.

    CVE-2025-22872:
    In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with     permission to write external alert instances to also write alert rules.

    CVE-2025-3454:
    Grafana is an open-source platform for monitoring and observability.
    The Grafana Alerting VictorOps integration was not properly protected and could be exposed to users with     Viewer permission.
    Fixed in versions 11.5.0, 11.4.1, 11.3.3, 11.2.6, 11.1.11, 11.0.11 and 10.4.15

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - grafana プラグイン SDK は、ビルドメタデータをコンパイルするバイナリにバンドルします。このメタデータには、「git remote get-url origin」を実行することで取得される、構築中のプラグインのリポジトリ URI が含まれます。リポジトリ URI に認証情報が含まれている場合 (プライベートな依存関係をフェッチできるようにするためなど)、最終的なバイナリには、当該認証情報を含む完全な URI が含まれます。 （CVE-2024-8986）

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - grafana 插件 SDK 将版本元数据捆绑到其编译的二进制文件中；此元数据包括正在构建的插件的存储库 URI，通过运行“git remote get-url origin”检索。如果存储库 URI 中包含凭据（例如，允许提取私有依存关系），最终的二进制文件将包含完整的 URI，其中包括所述凭据。 (CVE-2024-8986)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - grafana 外掛程式 SDK 將版本詮釋資料隨附於其編譯的二進位檔中；此詮釋資料包含正在構建之外掛程式的存放庫 URI，如同透過執行「git remote get-url 來源」所擷取的內容。如果存放庫 URI 中包含認證 (例如，允許擷取私密相依性)，則最終二進位檔將包含完整的 URI，包括所述認證。 (CVE-2024-8986)

請注意，Nessus 依賴供應商報告的套件存在。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The grafana plugin SDK bundles build metadata into the binaries it compiles; this metadata includes the     repository URI for the plugin being built, as retrieved by running `git remote get-url origin`. If     credentials are included in the repository URI (for instance, to allow for fetching of private     dependencies), the final binary will contain the full URI, including said credentials. (CVE-2024-8986)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0439 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2024-8986:
    The grafana plugin SDK bundles build metadata into the binaries it compiles; this metadata includes the     repository URI for the plugin being built, as retrieved by running `git remote get-url origin`.

    If credentials are included in the repository URI (for instance, to allow for fetching of private     dependencies), the final binary will contain the full URI, including said credentials.

    CVE-2022-41723:
    A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient     to cause a denial of service from a small number of small requests.

    CVE-2023-39325:
    A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive     server resource consumption. While the total number of requests is bounded by the     http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create     a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound     the number of simultaneously executing handler goroutines to the stream concurrency limit     (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client     has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows     too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2     for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per     HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the     Server.MaxConcurrentStreams setting and the ConfigureServer function.

    CVE-2023-44487:
    The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation     can reset many streams quickly, as exploited in the wild in August through October 2023.

    CVE-2023-45288:
    An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive     number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and     CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is     allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an     HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to     be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the     receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header     frames we will process before closing a connection.

    CVE-2025-22870:
    Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For     example, when the NO_PROXY environment variable is set to *.example.com, a request to     [::1%25.example.com]:80` will incorrectly match and not be proxied.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
276350	TencentOS Server 4: grafana (TSSA-2025:0339)	Nessus	Tencent Local Security Checks	11/20/2025	11/20/2025	critical
231875	Linux Distros のパッチ未適用の脆弱性: CVE-2024-8986	Nessus	Misc.	3/6/2025	9/4/2025	high
231875	Linux Distros 未修补的漏洞: CVE-2024-8986	Nessus	Misc.	3/6/2025	9/4/2025	high
231875	Linux Distros 未修補弱點：CVE-2024-8986	Nessus	Misc.	3/6/2025	9/4/2025	high
231875	Linux Distros Unpatched Vulnerability : CVE-2024-8986	Nessus	Misc.	3/6/2025	9/4/2025	high
276365	TencentOS Server 4: grafana-pcp (TSSA-2025:0439)	Nessus	Tencent Local Security Checks	11/20/2025	11/22/2025	critical

Detections

Analytics

Plugins Search

critical

high

high

high

high

critical