================================================================================
               VULNERABILITY SCAN REPORT — OPENVAS / GVM 22.8
================================================================================
Report ID:      rpt-2026-0409-a7c3e1
Scan Profile:   Full and Fast
Scan Start:     2026-04-07 02:00:00 UTC
Scan End:       2026-04-07 04:37:22 UTC
Scanner:        OpenVAS 22.8.1 (Feed: 2026-04-06)
Targets:        192.168.10.0/24 (5 hosts discovered)
Total Findings: 25

================================================================================
HOST 1: 192.168.10.10  (web-prod-01)
  OS Detected:  Ubuntu 22.04 LTS
  Open Ports:   22/tcp, 80/tcp, 443/tcp, 8080/tcp
================================================================================

[1] CRITICAL — CVE-2021-44228 (Log4Shell)
    CVSS v3.1:    10.0  (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
    Plugin ID:    OID:1.3.6.1.4.1.25623.1.0.117834
    Port:         8080/tcp
    Software:     Apache Log4j 2.14.1  (bundled in Apache Tomcat 9.0.54)
    Description:  Remote code execution via crafted JNDI lookup in log messages.
                  Attacker can achieve full system compromise without authentication.
    Fix:          Upgrade Log4j to 2.17.1+ or remove JndiLookup class from classpath.
    References:   https://nvd.nist.gov/vuln/detail/CVE-2021-44228
                  https://logging.apache.org/log4j/2.x/security.html
    Exploit:      Public exploit available. Actively exploited in the wild.
                  Listed in CISA KEV catalog.

[2] HIGH — CVE-2023-48795 (Terrapin Attack)
    CVSS v3.1:    5.9  (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)
    Plugin ID:    OID:1.3.6.1.4.1.25623.1.0.118201
    Port:         22/tcp
    Software:     OpenSSH 8.9p1
    Description:  SSH channel integrity vulnerability allowing prefix truncation
                  attacks. Enables downgrade of connection security.
    Fix:          Upgrade OpenSSH to 9.6p1+ or disable affected ciphers.
    References:   https://nvd.nist.gov/vuln/detail/CVE-2023-48795

[3] HIGH — CVE-2024-6387 (regreSSHion)
    CVSS v3.1:    8.1  (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
    Plugin ID:    OID:1.3.6.1.4.1.25623.1.0.118455
    Port:         22/tcp
    Software:     OpenSSH 8.9p1
    Description:  Race condition in sshd signal handler allows unauthenticated
                  remote code execution on glibc-based Linux systems.
    Fix:          Upgrade OpenSSH to 9.8p1+.
    References:   https://nvd.nist.gov/vuln/detail/CVE-2024-6387
    Exploit:      PoC available. Exploitation is non-trivial but demonstrated.

[4] MEDIUM — Missing HTTP Security Headers
    CVSS v3.1:    5.3  (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
    Plugin ID:    OID:1.3.6.1.4.1.25623.1.0.112081
    Port:         443/tcp
    Software:     nginx 1.24.0
    Description:  The following security headers are missing from HTTPS responses:
                  - Strict-Transport-Security (HSTS)
                  - X-Content-Type-Options
                  - Content-Security-Policy
                  - Permissions-Policy
    Fix:          Configure appropriate security headers in the web server.

[5] MEDIUM — TLS Certificate Using SHA-1 Signature
    CVSS v3.1:    5.9  (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
    Plugin ID:    OID:1.3.6.1.4.1.25623.1.0.105880
    Port:         443/tcp
    Description:  The server TLS certificate is signed using SHA-1, which is
                  considered cryptographically weak.
    Fix:          Reissue the certificate with SHA-256 or stronger signature.

[6] LOW — Server Banner Disclosure
    CVSS v3.1:    0.0 (Informational)
    Plugin ID:    OID:1.3.6.1.4.1.25623.1.0.100051
    Port:         80/tcp, 443/tcp
    Software:     nginx 1.24.0
    Description:  The web server discloses its software version in HTTP headers
                  (Server: nginx/1.24.0). This information aids attacker reconnaissance.
    Fix:          Set "server_tokens off;" in nginx configuration.

================================================================================
HOST 2: 192.168.10.20  (db-prod-01)
  OS Detected:  CentOS Stream 9
  Open Ports:   22/tcp, 3306/tcp, 9100/tcp
================================================================================

[7] CRITICAL — CVE-2017-0144 (EternalBlue / MS17-010)
    CVSS v3.1:    8.1  (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
    Note:         Originally CVSS v2 scored 9.3; v3.1 base = 8.1 but treated as
                  Critical due to widespread weaponization.
    Plugin ID:    OID:1.3.6.1.4.1.25623.1.0.108385
    Port:         445/tcp (SMBv1 — should not be open on a database server)
    Software:     Samba 4.16.2 (compiled with SMBv1 support)
    Description:  SMBv1 remote code execution vulnerability. While the original
                  CVE targets Windows, this Samba build has SMBv1 enabled and
                  is vulnerable to related SMBv1 protocol attacks.
    Fix:          Disable SMBv1 entirely. Upgrade Samba to 4.19+. Close port 445
                  if SMB is not required.
    Exploit:      Multiple public exploits. Used by WannaCry, NotPetya, and
                  numerous ransomware campaigns. In CISA KEV catalog.

[8] HIGH — CVE-2023-22515 (Default/Weak Credentials — MySQL)
    CVSS v3.1:    7.2  (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
    Plugin ID:    OID:1.3.6.1.4.1.25623.1.0.117220
    Port:         3306/tcp
    Software:     MySQL 8.0.35
    Description:  MySQL root account is accessible with default credentials
                  (root / root). The database is bound to 0.0.0.0 and reachable
                  from the entire subnet.
    Fix:          Change the root password immediately. Restrict bind-address to
                  127.0.0.1 or specific application IPs. Implement network ACLs.

[9] HIGH — CVE-2024-20961
    CVSS v3.1:    7.5  (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
    Plugin ID:    OID:1.3.6.1.4.1.25623.1.0.118390
    Port:         3306/tcp
    Software:     MySQL 8.0.35
    Description:  Denial of service vulnerability in MySQL Server optimizer
                  component. Unauthenticated attacker can cause hang or crash.
    Fix:          Upgrade MySQL to 8.0.36+ or 8.3.0+.

[10] MEDIUM — CVE-2023-5678 (OpenSSL Excessive Time Checking DH Keys)
     CVSS v3.1:   5.3  (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
     Plugin ID:    OID:1.3.6.1.4.1.25623.1.0.118102
     Port:         3306/tcp
     Software:     OpenSSL 3.0.10
     Description:  Processing DH keys or parameters with excessively long values
                   can cause server slowdown (DoS potential).
     Fix:          Upgrade OpenSSL to 3.0.13+ or 3.1.5+.

[11] LOW — ICMP Timestamp Response
     CVSS v3.1:    0.0 (Informational)
     Plugin ID:    OID:1.3.6.1.4.1.25623.1.0.100024
     Description:  Host responds to ICMP timestamp requests, potentially allowing
                   an attacker to estimate the system clock.
     Fix:          Block ICMP timestamp requests at the host firewall.

================================================================================
HOST 3: 192.168.10.30  (app-staging-01)
  OS Detected:  Debian 12 (Bookworm)
  Open Ports:   22/tcp, 80/tcp, 443/tcp, 5000/tcp, 6379/tcp
================================================================================

[12] HIGH — CVE-2024-31449 (Redis Lua Sandbox Escape)
     CVSS v3.1:    8.8  (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
     Plugin ID:    OID:1.3.6.1.4.1.25623.1.0.118511
     Port:         6379/tcp
     Software:     Redis 7.0.11
     Description:  Authenticated users can escape the Lua sandbox and execute
                   arbitrary code on the Redis server.
     Fix:          Upgrade Redis to 7.0.15+ or 7.2.4+.

[13] HIGH — Redis Unauthenticated Access
     CVSS v3.1:    9.8  (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
     Plugin ID:    OID:1.3.6.1.4.1.25623.1.0.108833
     Port:         6379/tcp
     Software:     Redis 7.0.11
     Description:  Redis is accessible without authentication. Any host on the
                   network can read/write data and execute CONFIG commands.
     Fix:          Enable requirepass in redis.conf. Bind to 127.0.0.1 or use
                   network ACLs. Enable TLS for in-transit encryption.

[14] MEDIUM — CVE-2024-28849 (follow-redirects SSRF)
     CVSS v3.1:    6.5  (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
     Plugin ID:    OID:1.3.6.1.4.1.25623.1.0.118440
     Port:         5000/tcp
     Software:     Node.js application using follow-redirects 1.15.4
     Description:  Authorization header leak when following cross-origin redirects.
     Fix:          Upgrade follow-redirects to 1.15.6+.

[15] MEDIUM — TLS 1.0 and 1.1 Enabled
     CVSS v3.1:    5.3  (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N)
     Plugin ID:    OID:1.3.6.1.4.1.25623.1.0.105042
     Port:         443/tcp
     Software:     nginx 1.24.0
     Description:  Server accepts TLS 1.0 and TLS 1.1 connections, which are
                   deprecated and have known cryptographic weaknesses.
     Fix:          Disable TLS 1.0 and 1.1. Only allow TLS 1.2 and 1.3.
                   In nginx: ssl_protocols TLSv1.2 TLSv1.3;

[16] LOW — Directory Listing Enabled
     CVSS v3.1:    5.3  (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
     Plugin ID:    OID:1.3.6.1.4.1.25623.1.0.100050
     Port:         80/tcp
     Description:  Directory listing is enabled on /static/ and /uploads/,
                   revealing file names and directory structure.
     Fix:          Disable autoindex in nginx configuration for these paths.

================================================================================
HOST 4: 192.168.10.40  (ci-runner-02)
  OS Detected:  Ubuntu 20.04 LTS (EOL April 2025 — PAST END OF LIFE)
  Open Ports:   22/tcp, 8080/tcp, 9090/tcp, 50000/tcp
================================================================================

[17] CRITICAL — CVE-2024-23897 (Jenkins Arbitrary File Read)
     CVSS v3.1:    9.8  (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
     Plugin ID:    OID:1.3.6.1.4.1.25623.1.0.118372
     Port:         8080/tcp
     Software:     Jenkins 2.426.2 LTS
     Description:  Unauthenticated arbitrary file read via CLI argument parsing.
                   Can lead to remote code execution by reading SSH keys,
                   credentials, or secrets from the filesystem.
     Fix:          Upgrade Jenkins to 2.442+ or LTS 2.426.3+.
                   Disable CLI access: set -Dhudson.cli.CLICommand.disabled=true
     Exploit:      Public exploit available. Actively exploited in the wild.
                   Listed in CISA KEV catalog.

[18] HIGH — End of Life Operating System
     CVSS v3.1:    N/A (Policy violation)
     Plugin ID:    OID:1.3.6.1.4.1.25623.1.0.103674
     Software:     Ubuntu 20.04 LTS (Standard support ended April 2025)
     Description:  The operating system has reached end of standard support.
                   No further security updates will be provided unless ESM
                   (Extended Security Maintenance) is purchased.
     Fix:          Upgrade to Ubuntu 22.04 LTS or 24.04 LTS.

[19] MEDIUM — CVE-2024-21626 (runc Container Escape — Leaky Vessels)
     CVSS v3.1:    8.6  (AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
     Plugin ID:    OID:1.3.6.1.4.1.25623.1.0.118410
     Software:     Docker 24.0.5 / runc 1.1.9
     Description:  Container escape via /proc/self/fd race condition.
                   Malicious container image can break out to host.
     Fix:          Upgrade Docker to 25.0.1+ (includes runc 1.1.12).
     Exploit:      PoC available. High impact in CI/CD environments.

[20] MEDIUM — Jenkins CSRF Protection Disabled
     CVSS v3.1:    6.5  (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
     Plugin ID:    OID:1.3.6.1.4.1.25623.1.0.113005
     Port:         8080/tcp
     Software:     Jenkins 2.426.2 LTS
     Description:  CSRF protection is disabled in Jenkins global security
                   configuration, allowing cross-site request forgery attacks.
     Fix:          Enable CSRF protection in Manage Jenkins > Security.

[21] LOW — SSH Weak MAC Algorithms
     CVSS v3.1:    2.6  (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N)
     Plugin ID:    OID:1.3.6.1.4.1.25623.1.0.108077
     Port:         22/tcp
     Software:     OpenSSH 8.9p1
     Description:  SSH server accepts weak MAC algorithms: hmac-sha1, hmac-md5.
     Fix:          Remove weak MAC algorithms from sshd_config. Use
                   hmac-sha2-256-etm@openssh.com or hmac-sha2-512-etm@openssh.com.

================================================================================
HOST 5: 192.168.10.50  (monitoring-01)
  OS Detected:  Rocky Linux 9.3
  Open Ports:   22/tcp, 3000/tcp, 9090/tcp, 9093/tcp
================================================================================

[22] HIGH — CVE-2024-1313 (Grafana IDOR)
     CVSS v3.1:    6.5  (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
     Plugin ID:    OID:1.3.6.1.4.1.25623.1.0.118488
     Port:         3000/tcp
     Software:     Grafana 10.2.3
     Description:  Insecure Direct Object Reference allows low-privilege users
                   to delete dashboards owned by other organizations.
     Fix:          Upgrade Grafana to 10.2.5+ or 10.3.3+.

[23] MEDIUM — CVE-2024-4068 (braces ReDoS)
     CVSS v3.1:    7.5  (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
     Plugin ID:    OID:1.3.6.1.4.1.25623.1.0.118502
     Port:         3000/tcp
     Software:     Grafana 10.2.3 (bundled Node.js dependency)
     Description:  Regular expression denial of service in braces package used
                   by Grafana's frontend build.
     Fix:          Upgrade Grafana to latest version (includes patched braces).

[24] MEDIUM — Prometheus Unauthenticated Access
     CVSS v3.1:    5.3  (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
     Plugin ID:    OID:1.3.6.1.4.1.25623.1.0.114200
     Port:         9090/tcp
     Software:     Prometheus 2.48.1
     Description:  Prometheus web UI and API are accessible without authentication.
                   Internal metrics, service discovery configs, and target labels
                   are exposed. This may reveal internal hostnames, IP addresses,
                   and architecture details.
     Fix:          Enable basic auth or use a reverse proxy with authentication.
                   Restrict network access to trusted IPs only.

[25] LOW — Alertmanager Version Disclosure
     CVSS v3.1:    0.0 (Informational)
     Plugin ID:    OID:1.3.6.1.4.1.25623.1.0.114201
     Port:         9093/tcp
     Software:     Alertmanager 0.26.0
     Description:  Alertmanager exposes its version number and build information
                   at the /api/v1/status endpoint without authentication.
     Fix:          Restrict access to Alertmanager API to authenticated users.

================================================================================
                            SUMMARY BY SEVERITY
================================================================================

  CRITICAL:  3   (CVE-2021-44228, CVE-2017-0144, CVE-2024-23897)
  HIGH:      7   (CVE-2023-48795, CVE-2024-6387, CVE-2023-22515, CVE-2024-20961,
                   CVE-2024-31449, Redis unauth, CVE-2024-1313, EOL OS)
  MEDIUM:    9   (Missing headers, SHA-1 cert, CVE-2023-5678, CVE-2024-28849,
                   TLS 1.0/1.1, CVE-2024-21626, Jenkins CSRF, CVE-2024-4068,
                   Prometheus unauth)
  LOW:       6   (Banner disclosure, ICMP timestamp, directory listing,
                   weak SSH MACs, Alertmanager disclosure)

  TOTAL:    25

================================================================================
                         HOSTS WITH CRITICAL FINDINGS
================================================================================

  192.168.10.10  web-prod-01     Log4Shell (CVE-2021-44228)
  192.168.10.20  db-prod-01      EternalBlue / SMBv1 (CVE-2017-0144)
  192.168.10.40  ci-runner-02    Jenkins File Read (CVE-2024-23897)

================================================================================
END OF REPORT
================================================================================
