There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Authentication Bypass by Alternate Name vulnerability in Apache Shiro. This issue affects Apache Shiro:
    before 2.0.7. Users are recommended to upgrade to version 2.0.7, which fixes the issue. The issue only
    effects static files. If static files are served from a case-insensitive filesystem, such as default macOS
    setup, static files may be accessed by varying the case of the filename in the request. If only lower-case
    (common default) filters are present in Shiro, they may be bypassed this way. Shiro 2.0.7 and later has a
    new parameters to remediate this issue shiro.ini: filterChainResolver.caseInsensitive = true
    application.propertie: shiro.caseInsensitive=true Shiro 3.0.0 and later (upcoming) makes this the default.
    (CVE-2026-23903)

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - Apache Shiro 中別名的驗證繞過弱點。此問題會影響 Apache Shiro
    在 2.0.7之前。建議使用者升級至 2.0.7 版，即可修正此問題。問題只會影響靜態檔案。如果靜態檔案是從不區分大小寫的檔案系統提供服務 (例如預設的 macOS 設定)則可透過改變要求中檔案名稱的大小寫來存取靜態檔案。若 Shiro 中只有小寫字母 (一般預設) 篩選器可能會以這種方式繞過。Shiro 2.0.7 和更新版本具有修復此問題的新參數 shiro.inifilterChainResolver.caseInsensitive = true application.propertieshiro.caseInsensitive=true Shiro 3.0.0 和更新版本 (即將推出) 將此設為預設值。
    (CVE-2026-23903)

請注意，Nessus 依賴供應商報告的套件存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - Apache Shiro 中的备用名称漏洞造成身份验证绕过。此问题影响 Apache Shiro
    2.0.7 之前的 libeconf:。建议用户升级到修复了此问题的版本 2.0.7。此问题仅影响静态文件。如果从不区分大小写的文件系统提供静态文件例如默认的 macOS 设置则可能会通过改变请求中文件名的大小写来访问静态文件。如果 Shiro 中仅存在小写常见默认过滤器则可能会以这种方式绕过它们。Shiro 2.0.7 和更新版本具有用于修复此问题的新参数 shiro.ini: filterChainResolver.caseInsensitive = true application.propertie: shiro.caseInsensitive=true Shiro 3.0.0 和更高版本即将推出将此设为默认设置。
    (CVE-2026-23903)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - Apache Shiro での代替名による認証バイパスの脆弱性。この問題は Apache Shiro に影響を与えます
    2.0.7 より前。ユーザーには、この問題を修正したバージョンであるバージョン 2.0.7 へのアップグレードをお勧めします。の問題は静的ファイルにのみ影響します。静的ファイルがデフォルトのmacOSセットアップなど、大文字と小文字を区別しないファイルシステムから提供される場合、リクエストの大文字と小文字を区別することで静的ファイルにアクセスできる可能性があります。Shiro に小文字共通デフォルトのフィルターのみが存在する場合、これらのフィルターはこの方法でバイパスされる可能性があります。Shiro 2.0.7 以降には、この問題を修正するための新しいパラメーターがあります shiro.inifilterChainResolver.caseIndentity = true application.propertie shiro.caseIndependent=true Shiro 3.0.0 以降では、これをデフォルトにしています。
    (CVE-2026-23903)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Authentication Bypass by Alternate Name vulnerability in Apache Shiro. This issue affects Apache Shiro:
    before 2.0.7. Users are recommended to upgrade to version 2.0.7, which fixes the issue. The issue only     effects static files. If static files are served from a case-insensitive filesystem, such as default macOS     setup, static files may be accessed by varying the case of the filename in the request. If only lower-case     (common default) filters are present in Shiro, they may be bypassed this way. Shiro 2.0.7 and later has a     new parameters to remediate this issue shiro.ini: filterChainResolver.caseInsensitive = true     application.propertie: shiro.caseInsensitive=true Shiro 3.0.0 and later (upcoming) makes this the default.
    (CVE-2026-23903)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of IBM Engineering Requirements Management DOORS (formerly IBM Rational DOORS) installed on the remote host is 9.6.1.1 prior or equal to 9.6.1.13 or 9.7.2.1 prior or equal to 9.7.2.11. It is, therefore, affected by multiple vulnerabilities as referenced in the 7279145 advisory.

  - IBM DOORS Web Access do not limit the length of a connection which could allow for a Slowloris HTTP denial     of service attack to take place. This can cause the web server to become unresponsive. (CVE-2024-25039)

  - IBM DOORS Web Access is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated     attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality     potentially leading to credentials disclosure within a trusted session. (CVE-2025-0152)

  - IBM DOORS Web Access could allow a remote attacker to obtain sensitive information when a detailed     technical error message is returned in the browser. This information could be used in further attacks     against the system. (CVE-2020-4984)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
437700	SCA: security update for org.apache.shiro:shiro-spring (GHSA-c244-p6m5-vqj6)	Tenable Cloud Security	SCA Checks	2/12/2026	7/2/2026	medium
437700	SCA: security update for org.apache.shiro:shiro-spring (GHSA-c244-p6m5-vqj6)	Tenable Self-Hosted Container Security	SCA Checks	2/12/2026	7/2/2026	medium
298461	Linux Distros 未修補的弱點：CVE-2026-23903	Nessus	Misc.	2/10/2026	7/13/2026	medium
298461	Linux Distros 未修补的漏洞：CVE-2026-23903	Nessus	Misc.	2/10/2026	7/13/2026	medium
298461	Linux Distros のパッチ未適用の脆弱性: CVE-2026-23903	Nessus	Misc.	2/10/2026	7/13/2026	medium
298461	Linux Distros Unpatched Vulnerability : CVE-2026-23903	Nessus	Misc.	2/10/2026	7/13/2026	medium
333335	IBM Engineering Requirements Management DOORS 9.6.1.1 <= 9.6.1.13 / 9.7.2.1 < 9.7.2.11 Multiple Vulnerabilities (7279145)	Nessus	Windows	8/7/2026	8/8/2026	high

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

high