In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5693 advisory.

    Red Hat Ceph Storage is a scalable, open, software-defined storage platform     that combines the most stable version of the Ceph storage system with a     Ceph management platform, deployment utilities, and support services.

    These new packages include numerous enhancements, and bug fixes. Space precludes documenting all of these     changes in this advisory.
    Users are directed to the Red Hat Ceph Storage Release Notes for     information on the most significant of these changes:

    https://access.redhat.com/documentation/en-us/red_hat_ceph_storage/6.1/html/release_notes/index

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of F5 Networks BIG-IP installed on the remote host is prior to 13.1.3.4 / 17.1.0. It is, therefore, affected by a vulnerability as referenced in the K05380109 advisory.

  - In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy. (CVE-2018-14041)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0553 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.4.9 serves as a     replacement for Red Hat JBoss Enterprise Application Platform 7.4.8, and includes bug fixes and     enhancements. See the Red Hat JBoss Enterprise Application Platform 7.4.9 Release Notes for information     about the most significant bug fixes and enhancements included in this release.

    Security Fix(es):

    * jquery: Prototype pollution in object's prototype leading to denial of     service, remote code execution, or property injection (CVE-2019-11358)

    * jquery: Cross-site scripting via cross-domain ajax requests (CVE-2015-9251)

    * bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute     (CVE-2018-14040)

    * jquery: Untrusted code execution via <option> tag in HTML passed to DOM     manipulation methods (CVE-2020-11023)

    * jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method     (CVE-2020-11022)

    * bootstrap: XSS in the data-target attribute (CVE-2016-10735)

    * bootstrap: Cross-site Scripting (XSS) in the data-target property of scrollspy     (CVE-2018-14041)

    * sshd-common: mina-sshd: Java unsafe deserialization vulnerability     (CVE-2022-45047)

    * woodstox-core: woodstox to serialise XML data was vulnerable to Denial of     Service attacks (CVE-2022-40152)

    * bootstrap: Cross-site Scripting (XSS) in the data-container property of     tooltip (CVE-2018-14042)

    * bootstrap: XSS in the tooltip or popover data-template attribute     (CVE-2019-8331)

    * nodejs-moment: Regular expression denial of service (CVE-2017-18214)

    * wildfly-elytron: possible timing attacks via use of unsafe comparator     (CVE-2022-3143)

    * jackson-databind: use of deeply nested arrays (CVE-2022-42004)

    * jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS     (CVE-2022-42003)

    * jettison: parser crash by stackoverflow (CVE-2022-40149)

    * jettison: memory exhaustion via user-supplied XML or JSON data     (CVE-2022-40150)

    * jettison: If the value in map is the map's self, the new new JSONObject(map) cause StackOverflowError     which may lead to dos (CVE-2022-45693)

    * CXF: Apache CXF: SSRF Vulnerability (CVE-2022-46364)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0554 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.4.9 serves as a     replacement for Red Hat JBoss Enterprise Application Platform 7.4.8, and includes bug fixes and     enhancements. See the Red Hat JBoss Enterprise Application Platform 7.4.9 Release Notes for information     about the most significant bug fixes and enhancements included in this release.

    Security Fix(es):

    * jquery: Prototype pollution in object's prototype leading to denial of     service, remote code execution, or property injection (CVE-2019-11358)

    * jquery: Cross-site scripting via cross-domain ajax requests (CVE-2015-9251)

    * bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute     (CVE-2018-14040)

    * jquery: Untrusted code execution via <option> tag in HTML passed to DOM     manipulation methods (CVE-2020-11023)

    * jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method     (CVE-2020-11022)

    * bootstrap: XSS in the data-target attribute (CVE-2016-10735)

    * bootstrap: Cross-site Scripting (XSS) in the data-target property of scrollspy     (CVE-2018-14041)

    * sshd-common: mina-sshd: Java unsafe deserialization vulnerability     (CVE-2022-45047)

    * woodstox-core: woodstox to serialise XML data was vulnerable to Denial of     Service attacks (CVE-2022-40152)

    * bootstrap: Cross-site Scripting (XSS) in the data-container property of     tooltip (CVE-2018-14042)

    * bootstrap: XSS in the tooltip or popover data-template attribute     (CVE-2019-8331)

    * nodejs-moment: Regular expression denial of service (CVE-2017-18214)

    * wildfly-elytron: possible timing attacks via use of unsafe comparator     (CVE-2022-3143)

    * jackson-databind: use of deeply nested arrays (CVE-2022-42004)

    * jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS     (CVE-2022-42003)

    * jettison: parser crash by stackoverflow (CVE-2022-40149)

    * jettison: memory exhaustion via user-supplied XML or JSON data     (CVE-2022-40150)

    * jettison: If the value in map is the map's self, the new new JSONObject(map) cause StackOverflowError     which may lead to dos (CVE-2022-45693)

    * CXF: Apache CXF: SSRF Vulnerability (CVE-2022-46364)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0552 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.4.9 serves as a     replacement for Red Hat JBoss Enterprise Application Platform 7.4.8, and includes bug fixes and     enhancements. See the Red Hat JBoss Enterprise Application Platform 7.4.9 Release Notes for information     about the most significant bug fixes and enhancements included in this release.

    Security Fix(es):

    * jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution,     or property injection (CVE-2019-11358)

    * jquery: Cross-site scripting via cross-domain ajax requests (CVE-2015-9251)

    * bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute (CVE-2018-14040)

    * jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods     (CVE-2020-11023)

    * jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)

    * bootstrap: XSS in the data-target attribute (CVE-2016-10735)

    * bootstrap: Cross-site Scripting (XSS) in the data-target property of scrollspy (CVE-2018-14041)

    * sshd-common: mina-sshd: Java unsafe deserialization vulnerability (CVE-2022-45047)

    * woodstox-core: woodstox to serialise XML data was vulnerable to Denial of Service attacks     (CVE-2022-40152)

    * bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip (CVE-2018-14042)

    * bootstrap: XSS in the tooltip or popover data-template attribute (CVE-2019-8331)

    * nodejs-moment: Regular expression denial of service (CVE-2017-18214)

    * wildfly-elytron: possible timing attacks via use of unsafe comparator (CVE-2022-3143)

    * jackson-databind: use of deeply nested arrays (CVE-2022-42004)

    * jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003)

    * jettison: parser crash by stackoverflow (CVE-2022-40149)

    * jettison: memory exhaustion via user-supplied XML or JSON data (CVE-2022-40150)

    * jettison: If the value in map is the map's self, the new new JSONObject(map) cause StackOverflowError     which may lead to dos (CVE-2022-45693)

    * CXF: Apache CXF: SSRF Vulnerability (CVE-2022-46364)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1519 advisory.

  - jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request     is performed without the dataType option, causing text/javascript responses to be executed.
    (CVE-2015-9251)

  - In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target     attribute, a different vulnerability than CVE-2018-14041. (CVE-2016-10735)

  - In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute. (CVE-2018-14040)

  - In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy. (CVE-2018-14041)

  - In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip. (CVE-2018-14042)

  - In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute. (CVE-2018-20676)

  - In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property. (CVE-2018-20677)

  - jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true,     {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable
    __proto__ property, it could extend the native Object.prototype. (CVE-2019-11358)

  - In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template     attribute. (CVE-2019-8331)

  - In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources -     even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and     others) may execute untrusted code. This problem is patched in jQuery 3.5.0. (CVE-2020-11022)

  - A flaw was found in all ipa versions 4.x.x through 4.8.0. When sending a very long password (>= 1,000,000     characters) to the server, the password hashing process could exhaust memory and CPU leading to a denial     of service and the website becoming unresponsive. The highest threat from this vulnerability is to system     availability. (CVE-2020-1722)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of TYPO3 installed on the remote host is 8.x prior to 8.7.23 or 9.x prior to 9.5.4. It is, therefore, affected by multiple vulnerabilities:
  - A cross-site scripting (XSS) vulnerability exists in Typo3's bundled, third-party component Bootstrap   due to improper validation of user-supplied input before returning it to users. An unauthenticated,   remote attacker can exploit this, by convincing a user to click a specially crafted URL, to execute   arbitrary script code in a user's browser session (CVE-2018-14041).

  - A remote code execution vulnerability exists in Typo3 due to omissions from a configuration blacklist.   An authenticated, remote attacker can exploit this to execute arbitrary commands on an affected host.

  - An information disclosure vulnerability exists in Typo3's RequireJS package due to a failure to   configure it properly. An unauthenticated, remote attacker can exploit this to disclose potentially   sensitive information.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version

According to its self-reported version number, Bootstrap is at least 4.0.0 and prior to 4.1.2. Therefore, it may be affected by a Cross-Site Scripting (XSS) vulnerability via the tooltip, collapse and scrollspy plugins.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
182992	RHEL 9 : Red Hat Ceph Storage 6.1 (RHSA-2023:5693)	Nessus	Red Hat Local Security Checks	medium
174569	F5 Networks BIG-IP : Bootstrap vulnerability (K05380109)	Nessus	F5 Networks Local Security Checks	medium
170914	RHEL 8 : Red Hat JBoss Enterprise Application Platform 7.4.9 Security update (Important) (RHSA-2023:0553)	Nessus	Red Hat Local Security Checks	critical
170911	RHEL 9 : Red Hat JBoss Enterprise Application Platform 7.4.9 Security update (Important) (RHSA-2023:0554)	Nessus	Red Hat Local Security Checks	critical
170909	RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.4.9 Security update (Important) (RHSA-2023:0552)	Nessus	Red Hat Local Security Checks	critical
141974	Amazon Linux 2 : ipa-client (ALAS-2020-1519)	Nessus	Amazon Linux Local Security Checks	medium
138890	TYPO3 8.x < 8.7.23 / 9.x < 9.5.4 Multiple Vulnerabilities	Nessus	CGI abuses	medium
112374	Bootstrap 4.0.0 < 4.1.2 Cross-Site Scripting	Web App Scanning	Component Vulnerability	medium

Detections

Analytics

CVE-2018-14041

medium

Tenable Plugins

medium

medium

critical

critical

critical

medium

medium

medium