According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL     pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for     requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This     issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included). (CVE-2021-44224)

  - A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser     (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the     vulnerability though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and     earlier. (CVE-2021-44790)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202208-20 (Apache HTTPD: Multiple Vulnerabilities)

  - A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead     to request splitting or cache poisoning. This issue affects Apache HTTP Server 2.4.17 to 2.4.48.
    (CVE-2021-33193)

  - Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP     Server 2.4.48 and earlier. (CVE-2021-34798)

  - A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and     crash (DoS). This issue affects Apache HTTP Server versions 2.4.30 to 2.4.48 (inclusive). (CVE-2021-36160)

  - ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules     pass untrusted data to these functions, but third-party / external modules may. This issue affects Apache     HTTP Server 2.4.48 and earlier. (CVE-2021-39275)

  - A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the     remote user. This issue affects Apache HTTP Server 2.4.48 and earlier. (CVE-2021-40438)

  - While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request     processing, allowing an external source to DoS the server. This requires a specially crafted request. The     vulnerability was recently introduced in version 2.4.49. No exploit is known to the project.
    (CVE-2021-41524)

  - A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could     use a path traversal attack to map URLs to files outside the directories configured by Alias-like     directives. If files outside of these directories are not protected by the usual default configuration     require all denied, these requests can succeed. If CGI scripts are also enabled for these aliased     pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This     issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found     to be incomplete, see CVE-2021-42013. (CVE-2021-41773)

  - It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker     could use a path traversal attack to map URLs to files outside the directories configured by Alias-like     directives. If files outside of these directories are not protected by the usual default configuration     require all denied, these requests can succeed. If CGI scripts are also enabled for these aliased     pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache     2.4.50 and not earlier versions. (CVE-2021-42013)

  - A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL     pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for     requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This     issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included). (CVE-2021-44224)

  - A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser     (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the     vulnerability though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and     earlier. (CVE-2021-44790)

  - A carefully crafted request body can cause a read to a random memory area which could cause the process to     crash. This issue affects Apache HTTP Server 2.4.52 and earlier. (CVE-2022-22719)

  - Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered     discarding the request body, exposing the server to HTTP Request Smuggling (CVE-2022-22720)

  - If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems     an integer overflow happens which later causes out of bounds writes. This issue affects Apache HTTP Server     2.4.52 and earlier. (CVE-2022-22721)

  - Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to overwrite heap     memory with possibly attacker provided data. This issue affects Apache HTTP Server 2.4 version 2.4.52 and     prior versions. (CVE-2022-23943)

  - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of     Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This     issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions.
    (CVE-2022-26377)

  - The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an     attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with     mod_luas r:puts() function. Modules compiled and distributed separately from Apache HTTP Server that use     the 'ap_rputs' function and may pass it a very large (INT_MAX or larger) string must be compiled against     current headers to resolve the issue. (CVE-2022-28614)

  - Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in     ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the     server can be coerced into such a call, third-party modules or lua scripts that use ap_strcmp_match() may     hypothetically be affected. (CVE-2022-28615)

  - In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0)     may cause a denial of service due to no default limit on possible input size. (CVE-2022-29404)

  - If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input     to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort.
    (CVE-2022-30522)

  - Apache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point     past the end of the storage allocated for the buffer. (CVE-2022-30556)

  - Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on     client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on     the origin server/application. (CVE-2022-31813)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:0303 advisory.

    The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

    Security Fix(es):

    * httpd: mod_lua: Possible buffer overflow when parsing multipart content (CVE-2021-44790)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0119-1 advisory.

  - A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL     pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for     requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This     issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included). (CVE-2021-44224)

  - A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser     (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the     vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and     earlier. (CVE-2021-44790)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0091-1 advisory.

  - A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL     pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for     requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This     issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included). (CVE-2021-44224)

  - A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser     (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the     vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and     earlier. (CVE-2021-44790)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:0091-1 advisory.

  - A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL     pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for     requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This     issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included). (CVE-2021-44224)

  - A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser     (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the     vulnerability though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and     earlier. (CVE-2021-44790)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 / 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5035 advisory.

  - A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL     pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for     requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This     issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included). (CVE-2021-44224)

  - A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser     (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the     vulnerability though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and     earlier. (CVE-2021-44790)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:1136 advisory.

    The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

    Security Fix(es):

    * httpd: mod_lua: Possible buffer overflow when parsing multipart content (CVE-2021-44790)

    * httpd: Errors encountered during the discarding of request body lead to HTTP request smuggling     (CVE-2022-22720)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is running a version of macOS / Mac OS X that is 11.x prior to 11.6.6. It is, therefore, affected by multiple vulnerabilities:

  - zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many     distant matches. (CVE-2018-25032)

  - A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.1,     watchOS 8.3, iOS 15.2 and iPadOS 15.2, macOS Big Sur 11.6.2. A malicious application may be able to bypass     certain Privacy preferences. (CVE-2021-30946)

  - vim is vulnerable to Heap-based Buffer Overflow (CVE-2021-4136)

  - vim is vulnerable to Out-of-bounds Read (CVE-2021-4166, CVE-2021-4193, CVE-2022-0128)

  - vim is vulnerable to Use After Free (CVE-2021-4173, CVE-2021-4187, CVE-2021-4192)

  - A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL     pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for     requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This     issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included). (CVE-2021-44224)

  - A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser     (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the     vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and     earlier. (CVE-2021-44790)

  - In zsh before 5.8.1, an attacker can achieve code execution if they control a command output inside the     prompt, as demonstrated by a %F argument. This occurs because of recursive PROMPT_SUBST expansion.
    (CVE-2021-45444)

  - Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn     by its CNA. Further investigation showed that it was not a security issue. Notes: none (CVE-2021-46059)

  - A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local     string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially     crafted zip file, leading to a crash or code execution. (CVE-2022-0530)

  - The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop     forever for non-prime moduli. Internally this function is used when parsing certificates that contain     elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point     encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has     invalid explicit curve parameters. Since certificate parsing happens prior to verification of the     certificate signature, any process that parses an externally supplied certificate may thus be subject to a     denial of service attack. The infinite loop can also be reached when parsing crafted private keys as they     can contain explicit elliptic curve parameters. Thus vulnerable situations include: - TLS clients     consuming server certificates - TLS servers consuming client certificates - Hosting providers taking     certificates or private keys from customers - Certificate authorities parsing certification requests from     subscribers - Anything else which parses ASN.1 elliptic curve parameters Also any other applications that     use the BN_mod_sqrt() where the attacker can control the parameter values are vulnerable to this DoS     issue. In the OpenSSL 1.0.2 version the public key is not parsed during initial parsing of the certificate     which makes it slightly harder to trigger the infinite loop. However any operation which requires the     public key from the certificate will trigger the infinite loop. In particular the attacker can use a self-     signed certificate to trigger the loop during verification of the certificate signature. This issue     affects OpenSSL versions 1.0.2, 1.1.1 and 3.0. It was addressed in the releases of 1.1.1n and 3.0.2 on the     15th March 2022. Fixed in OpenSSL 3.0.2 (Affected 3.0.0,3.0.1). Fixed in OpenSSL 1.1.1n (Affected     1.1.1-1.1.1m). Fixed in OpenSSL 1.0.2zd (Affected 1.0.2-1.0.2zc). (CVE-2022-0778)

  - A validation issue was addressed with improved input sanitization. This issue is fixed in iOS 15.3 and     iPadOS 15.3, watchOS 8.4, tvOS 15.3, Safari 15.3, macOS Monterey 12.2. Processing a maliciously crafted     mail message may lead to running arbitrary javascript. (CVE-2022-22589)

  - A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur     11.6.6, macOS Monterey 12.3, Security Update 2022-004 Catalina. A remote user may cause an unexpected app     termination or arbitrary code execution (CVE-2022-22630)

  - This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in iOS     15.4 and iPadOS 15.4, Security Update 2022-004 Catalina, macOS Monterey 12.3, macOS Big Sur 11.6.6. A     malicious application may bypass Gatekeeper checks. (CVE-2022-22663)

  - A logic issue was addressed with improved validation. This issue is fixed in macOS Monterey 12.3. A     malicious application may be able to gain root privileges. (CVE-2022-22665)

  - An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with     improved input validation. This issue is fixed in macOS Monterey 12.3.1, Security Update 2022-004     Catalina, macOS Big Sur 11.6.6. A local user may be able to read kernel memory. (CVE-2022-22674)

  - An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in tvOS     15.5, watchOS 8.6, macOS Big Sur 11.6.6, macOS Monterey 12.3.1, iOS 15.4.1 and iPadOS 15.4.1. An     application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that     this issue may have been actively exploited.. (CVE-2022-22675)

  - A carefully crafted request body can cause a read to a random memory area which could cause the process to     crash. This issue affects Apache HTTP Server 2.4.52 and earlier. (CVE-2022-22719)

  - Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered     discarding the request body, exposing the server to HTTP Request Smuggling (CVE-2022-22720)

  - If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems     an integer overflow happens which later causes out of bounds writes. This issue affects Apache HTTP Server     2.4.52 and earlier. (CVE-2022-22721)

  - valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes. (CVE-2022-23308)

  - An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in Security     Update 2022-004 Catalina, macOS Monterey 12.4, macOS Big Sur 11.6.6. Processing a maliciously crafted     AppleScript binary may result in unexpected application termination or disclosure of process memory.
    (CVE-2022-26697)

  - An out-of-bounds read issue was addressed with improved bounds checking. This issue is fixed in Security     Update 2022-004 Catalina, macOS Monterey 12.4, macOS Big Sur 11.6.6. Processing a maliciously crafted     AppleScript binary may result in unexpected application termination or disclosure of process memory.
    (CVE-2022-26698)

  - An access issue was addressed with additional sandbox restrictions on third-party applications. This issue     is fixed in tvOS 15.5, iOS 15.5 and iPadOS 15.5, watchOS 8.6, macOS Big Sur 11.6.6, macOS Monterey 12.4. A     sandboxed process may be able to circumvent sandbox restrictions. (CVE-2022-26706)

  - This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Monterey 12.4,     macOS Big Sur 11.6.6. A malicious application may be able to modify protected parts of the file system.
    (CVE-2022-26712)

  - A memory corruption issue was addressed with improved validation. This issue is fixed in tvOS 15.5, iOS     15.5 and iPadOS 15.5, Security Update 2022-004 Catalina, watchOS 8.6, macOS Big Sur 11.6.6, macOS Monterey     12.4. An application may be able to execute arbitrary code with kernel privileges. (CVE-2022-26714)

  - An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in Security     Update 2022-004 Catalina, macOS Monterey 12.4, macOS Big Sur 11.6.6. An application may be able to gain     elevated privileges. (CVE-2022-26715)

  - An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in macOS     Monterey 12.4, macOS Big Sur 11.6.6. An application may be able to gain elevated privileges.
    (CVE-2022-26718)

  - An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in Security     Update 2022-004 Catalina, macOS Monterey 12.4, macOS Big Sur 11.6.6. A malicious application may be able     to execute arbitrary code with kernel privileges. (CVE-2022-26720)

  - A memory initialization issue was addressed. This issue is fixed in Security Update 2022-004 Catalina,     macOS Monterey 12.4, macOS Big Sur 11.6.6. A malicious application may be able to gain root privileges.
    (CVE-2022-26721, CVE-2022-26722)

  - A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS     Monterey 12.4, macOS Big Sur 11.6.6. Mounting a maliciously crafted Samba network share may lead to     arbitrary code execution. (CVE-2022-26723)

  - This issue was addressed with improved checks. This issue is fixed in Security Update 2022-004 Catalina,     watchOS 8.6, macOS Monterey 12.4, macOS Big Sur 11.6.6. An app may be able to capture a user's screen.
    (CVE-2022-26726)

  - This issue was addressed with improved entitlements. This issue is fixed in Security Update 2022-004     Catalina, macOS Monterey 12.4, macOS Big Sur 11.6.6. A malicious application may be able to access     restricted files. (CVE-2022-26728)

  - A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.4,     iOS 15.5 and iPadOS 15.5. A malicious website may be able to track users in Safari private browsing mode.
    (CVE-2022-26731)

  - A memory corruption issue was addressed with improved validation. This issue is fixed in macOS Big Sur     11.6.6. A malicious application may disclose restricted memory. (CVE-2022-26745)

  - This issue was addressed by removing the vulnerable code. This issue is fixed in Security Update 2022-004     Catalina, macOS Monterey 12.4, macOS Big Sur 11.6.6. A malicious application may be able to bypass Privacy     preferences. (CVE-2022-26746)

  - An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in Security     Update 2022-004 Catalina, macOS Monterey 12.4, macOS Big Sur 11.6.6. Processing maliciously crafted web     content may lead to arbitrary code execution. (CVE-2022-26748)

  - A memory corruption issue was addressed with improved input validation. This issue is fixed in iTunes     12.12.4 for Windows, iOS 15.5 and iPadOS 15.5, Security Update 2022-004 Catalina, macOS Big Sur 11.6.6,     macOS Monterey 12.4. Processing a maliciously crafted image may lead to arbitrary code execution.
    (CVE-2022-26751)

  - This issue was addressed with improved environment sanitization. This issue is fixed in Security Update     2022-004 Catalina, macOS Monterey 12.4, macOS Big Sur 11.6.6. A malicious application may be able to break     out of its sandbox. (CVE-2022-26755)

  - An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in Security     Update 2022-004 Catalina, macOS Monterey 12.4, macOS Big Sur 11.6.6. An application may be able to execute     arbitrary code with kernel privileges. (CVE-2022-26756)

  - A use after free issue was addressed with improved memory management. This issue is fixed in tvOS 15.5,     iOS 15.5 and iPadOS 15.5, Security Update 2022-004 Catalina, watchOS 8.6, macOS Big Sur 11.6.6, macOS     Monterey 12.4. An application may be able to execute arbitrary code with kernel privileges.
    (CVE-2022-26757)

  - A memory corruption issue was addressed with improved memory handling. This issue is fixed in Security     Update 2022-004 Catalina, macOS Big Sur 11.6.6. An application may be able to execute arbitrary code with     kernel privileges. (CVE-2022-26761)

  - An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in tvOS     15.5, iOS 15.5 and iPadOS 15.5, Security Update 2022-004 Catalina, watchOS 8.6, macOS Big Sur 11.6.6,     macOS Monterey 12.4. A malicious application may be able to execute arbitrary code with system privileges.
    (CVE-2022-26763)

  - A certificate parsing issue was addressed with improved checks. This issue is fixed in tvOS 15.5, iOS 15.5     and iPadOS 15.5, Security Update 2022-004 Catalina, watchOS 8.6, macOS Big Sur 11.6.6, macOS Monterey     12.4. A malicious app may be able to bypass signature validation. (CVE-2022-26766)

  - The issue was addressed with additional permissions checks. This issue is fixed in macOS Monterey 12.4,     macOS Big Sur 11.6.6. A malicious application may be able to bypass Privacy preferences. (CVE-2022-26767)

  - A memory corruption issue was addressed with improved state management. This issue is fixed in macOS     Monterey 12.4, watchOS 8.6, tvOS 15.5, macOS Big Sur 11.6.6. An application may be able to execute     arbitrary code with kernel privileges. (CVE-2022-26768)

  - A memory corruption issue was addressed with improved input validation. This issue is fixed in Security     Update 2022-004 Catalina, macOS Monterey 12.4, macOS Big Sur 11.6.6. A malicious application may be able     to execute arbitrary code with kernel privileges. (CVE-2022-26769)

  - An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in Security     Update 2022-004 Catalina, macOS Monterey 12.4, macOS Big Sur 11.6.6. A malicious application may be able     to execute arbitrary code with kernel privileges. (CVE-2022-26770)

  - This issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.4, macOS Big Sur     11.6.6. An attacker may be able to cause unexpected application termination or arbitrary code execution.
    (CVE-2022-26776)

  - This issue was addressed with improved checks. This issue is fixed in tvOS 15.5, watchOS 8.6, iOS 15.5 and     iPadOS 15.5, macOS Monterey 12.4, macOS Big Sur 11.6.6, Security Update 2022-004 Catalina. A remote user     may be able to cause a denial-of-service. (CVE-2022-32790)

  - A logic issue was addressed with improved state management. This issue is fixed in Security Update     2022-004 Catalina, macOS Monterey 12.4, macOS Big Sur 11.6.6. An app may be able to gain elevated     privileges. (CVE-2022-32794)

  - This issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.4, macOS Big Sur     11.6.6. An app may be able to bypass Privacy preferences. (CVE-2022-32882)

Note that Nessus has not tested for these issues but has instead relied only on the operating system's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
158541	EulerOS 2.0 SP9 : httpd (EulerOS-SA-2022-1306)	Nessus	Huawei Local Security Checks	3/2/2022	11/6/2023	critical
159251	EulerOS 2.0 SP8 : httpd (EulerOS-SA-2022-1349)	Nessus	Huawei Local Security Checks	3/28/2022	11/3/2023	critical
160017	EulerOS 2.0 SP10 : httpd (EulerOS-SA-2022-1507)	Nessus	Huawei Local Security Checks	4/20/2022	10/31/2023	critical
164114	GLSA-202208-20 : Apache HTTPD: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	8/15/2022	1/18/2024	critical
164852	RHEL 7 : httpd24-httpd (RHSA-2022:0303)	Nessus	Red Hat Local Security Checks	9/8/2022	11/7/2024	critical
156808	SUSE SLES15 Security Update : apache2 (SUSE-SU-2022:0119-1)	Nessus	SuSE Local Security Checks	1/19/2022	7/14/2023	critical
156776	SUSE SLED15 / SLES15 Security Update : apache2 (SUSE-SU-2022:0091-1)	Nessus	SuSE Local Security Checks	1/17/2022	7/14/2023	critical
156778	openSUSE 15 Security Update : apache2 (openSUSE-SU-2022:0091-1)	Nessus	SuSE Local Security Checks	1/18/2022	11/20/2023	critical
156466	Debian DSA-5035-1 : apache2 - security update	Nessus	Debian Local Security Checks	1/5/2022	11/21/2023	critical
159468	RHEL 7 : httpd (RHSA-2022:1136)	Nessus	Red Hat Local Security Checks	4/2/2022	11/7/2024	critical
161395	macOS 11.x < 11.6.6 Multiple Vulnerabilities (HT213256)	Nessus	MacOS X Local Security Checks	5/20/2022	8/20/2024	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical