Have @voh.com.vn email addresses appeared in exposed data or information-stealer (infostealer) logs?

No record associated with an @voh.com.vn email address was found in the currently available data. This does not rule out incidents that have not been observed.

What technologies does www.voh.com.vn use, and which CVEs (security vulnerabilities) may apply?

The assessment identified 3 technologies on www.voh.com.vn. Only 1 had a version reliable enough for accurate CVE matching.

Which public IPs, services, and ports does www.voh.com.vn expose?

The assessment observed 1 public IPs and 2 open ports for www.voh.com.vn. An open port is not the same as a vulnerability, but the website owner should keep every public service updated and appropriately restrict access.

How many subdomains of voh.com.vn have been discovered?

The assessment observed 35+ public subdomains of voh.com.vn. This list can reveal additional entry points such as APIs, administration systems, or test environments, but it does not mean that every subdomain is risky.

Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

Is www.voh.com.vn Safe? Security Score 81.3/100 | CyStack

www.voh.com.vn

VOH - Đài Tiếng nói Nhân dân Thành phố Hồ Chí Minh

Trang nghe radio online, xem tin tức thời sự trong và ngoài nước về chính trị xã hội, kinh tế, pháp luật, thể thao, giải trí, sức khỏe,..

Industry: News and Media
Origin: Vietnam
Global rank: #25,889
Rank in Vietnam: #444

Updated at 11:11, 09/14/2026

B81.3/100

Security level: Good
Data confidence: High
Scope checked: 97.3%

The higher the score, the more externally observable protections the system has recorded. This page does not certify that the website is reputable, legitimate, or completely free of vulnerabilities.

Is the website “www.voh.com.vn” safe?

As of September 14, 2026 at 11:11, www.voh.com.vn has a security score of 81.3/100 (grade B: “Good”). CyStack’s automated assessment recorded 12 issues to review after completing 97.3% of applicable checks. The website owner should address “Known-exploited CVE candidates” first, then review the remaining items in order of impact.

Does www.voh.com.vn show known scam, phishing, or malware signals?

At assessment time, CyStack did not find www.voh.com.vn or related infrastructure on any scam, phishing, or malware warning list after checking 5 online reputation sources. This result reflects external observations; it does not guarantee absolute safety or verify the organization’s legal status or reputation.

Items to fix or review

Open services

Risk overview12 Public infrastructure2 Website protection Exposed data & subdomains35+

Observed infrastructure

Addresses, servers and services that are visible from the Internet.

Resolved addresses

Addresses scanned

nginx/1.16.1

Server

Frequently asked questions

What affects the security of www.voh.com.vn?

A valid SSL certificate still does not prove that www.voh.com.vn is safe, legitimate, or free of scam signals. For a more complete assessment, this report also checks phishing and malware, exposed email records, IPs and open ports, subdomains, technologies, and CVEs that may apply to observed versions.

Does www.voh.com.vn use HTTPS, and is its SSL certificate valid?

www.voh.com.vn used a valid SSL certificate at assessment time, valid until February 22, 2027. This status may change when the certificate expires or the server configuration changes.

Review HTTPS and certificate

Check your system now

Explore more website security reports

Recently completed assessments, prioritizing websites with a similar sector, country or security grade for easier comparison.

U - Unrated59 points

Data sources

Data compiled fromCyStack cybersecurity monitoring systems

CyStack compiles scan results from its internal cybersecurity monitoring systems, including CyStack VulnScan and CyStack Threat Intelligence, together with publicly available Internet data. The assessment only observes and analyzes information already available; it does not attempt unauthorized access, test passwords, send exploit code, or change or disrupt the assessed system.

Search the vulnerability database Learn about Threat Intelligence data

Discover a completeweb risk management solution

CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the enterprise.

Explore CyStack VulnScan

Fix or validate these first

These 3 failed checks or warnings have the greatest impact on the result for www.voh.com.vn.

Known-exploited CVE candidatesFound 1 known-exploited candidate(s), but the external product fingerprint requires verification.Critical

Why it matters

This check asks whether an applicable CVE candidate also appears in the CISA Known Exploited Vulnerabilities (KEV) catalog. A positive match means attackers have used that vulnerability in real incidents and warrants urgent investigation, but the installed software still needs to be confirmed as affected.

What to do

Verify the installed product immediately and follow the CISA and vendor instructions for mitigation, patching, or upgrading if it is affected.

Evidence and check scope

Known exploited vulnerabilities:: 1
Total known-exploited candidates:: 1
Possible CVE identifiers:: CVE-2019-20372, CVE-2021-23017, CVE-2021-3618, CVE-2023-44487, CVE-2025-23419
Possible CVE identifiers shown:: CVE-2019-20372, CVE-2021-23017, CVE-2021-3618, CVE-2023-44487, CVE-2025-23419
Total possible vulnerabilities:: 5
Possible vulnerabilities shown:: 5
Known-exploited lookup complete:: Yes
Complete:: Yes
Products checked:: 1
Products ready for matching:: 1

16 additional evidence fields are not shown here.

References

National Vulnerability Database CISA Known Exploited Vulnerabilities Catalog

Allowed browser content (CSP)The inspected root HTML response does not include a Content-Security-Policy header.High

Why it matters

Content Security Policy (CSP) limits where scripts, styles, frames, and other browser content may come from. A strong policy reduces the impact if an attacker manages to inject content into a page.

What to do

Define only the sources the application needs, test the policy before activating it, and avoid broad wildcard (*) rules, unsafe-inline, and unsafe-eval where possible.

Email spoofing protection (DMARC)No DMARC record was found for the registrable email domain.High

Why it matters

DMARC lets the domain owner tell receiving services what to do when the visible From address is not verified by SPF or DKIM. Without DMARC, attackers have more opportunity to impersonate the domain in phishing email.

What to do

Publish a DMARC record at _dmarc, begin by collecting reports, and confirm that legitimate senders pass before applying a blocking policy.

CPE identitycpe:2.3:a:f5:nginx:1.16.1:*:*:*:*:*:*:*

ConfidenceHigh

Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.

nginx.org/en

Potential CVEs for this product

CVE-2023-44487nginx 1.16.1KEVCVSS 7.5

Matched product: nginx 1.16.1
Confidence: High

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

Nvd

CVE-2021-23017nginx 1.16.1CVSS 7.7

Matched product: nginx 1.16.1
Confidence: High

A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact.

Nvd

CVE-2021-3618nginx 1.16.1CVSS 7.4

Matched product: nginx 1.16.1
Confidence: High

ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim's traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.

Nvd

CVE-2019-20372nginx 1.16.1CVSS 5.3

Matched product: nginx 1.16.1
Confidence: High

NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer.

Nvd

CVE-2025-23419nginx 1.16.1CVSS 5.3

Matched product: nginx 1.16.1
Confidence: High

When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_ticket_key are used and/or the SSL session cache https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache are used in the default server and the default server is performing client certificate authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Nvd

Potential CVEs for this product

CVE-2023-44487nginx 1.16.1KEVCVSS 7.5

Matched product: nginx 1.16.1
Confidence: High

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

Nvd

CVE-2021-23017nginx 1.16.1CVSS 7.7

Matched product: nginx 1.16.1
Confidence: High

Nvd

CVE-2021-3618nginx 1.16.1CVSS 7.4

Matched product: nginx 1.16.1
Confidence: High

Nvd

CVE-2019-20372nginx 1.16.1CVSS 5.3

Matched product: nginx 1.16.1
Confidence: High

Nvd

CVE-2025-23419nginx 1.16.1CVSS 5.3

Matched product: nginx 1.16.1
Confidence: High