jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed.

According to its self-reported version number, jQuery is prior to 1.9.0. Therefore, it may be affected by a cross-site scripting vulnerability because the load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - jquery: Cross-site scripting (XSS) via <script> HTML tags containing whitespaces (CVE-2020-7656)

  - jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function     does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery     determined whether the input was HTML by looking for the '<' character anywhere in the string, giving     attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery     only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploitability     only to attackers who can control the beginning of a string, which is far less common. (CVE-2012-6708)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 / 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4211 advisory.

    Red Hat AMQ Interconnect is a component of the AMQ 7 product family. AMQ Interconnect provides flexible     routing of messages between AMQP-enabled endpoints, whether they are clients, servers, brokers, or any     other entity that can send or receive standard AMQP messages.

    This release of Red Hat AMQ Interconnect 1.9.0 serves as a replacement for Red Hat AMQ Interconnect 1.8.0     and includes security and bug fixes, and enhancements.  For further information, refer to the release     notes linked to in the References section.

    Security Fix(es):

    * jQuery: allows XSS via the load method (CVE-2020-7656)

    * jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)

    * jQuery: passing HTML containing <option> elements to manipulation methods could result in untrusted code     execution (CVE-2020-11023)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgements, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:4142 advisory.

  - jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true,     {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable
    __proto__ property, it could extend the native Object.prototype. (CVE-2019-11358)

  - In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option>     elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods     (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
    (CVE-2020-11023)

  - jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to     recognize and remove <script> HTML tags that contain a whitespace character, i.e: </script >, which     results in the enclosed script logic to be executed. (CVE-2020-7656)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Tenable Nessus application running on the remote host is 10.4.2 or earlier. It is, therefore, affected by multiple vulnerabilities in OpenSSL prior to version 3.0.8, spin.js prior to version 2.3.2, and datatables.net prior to version 1.13.2:
    
    - An attacker that had observed a genuine connection between a client and a server could use the flaw to send trial       messages to the server and record the time taken to process them. After a sufficiently large number of messages       the attacker could recover the pre-master secret used for the original connection. (CVE-2022-4304)

    - The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes any header data and the payload       data. Under certain conditions, a double free will occur. This will most likely lead to a crash. (CVE-2022-4450)

    - The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. Under certain conditions,       the BIO chain is not properly cleaned up and the BIO passed by the caller still retains internal pointers to the previously       freed filter BIO. This will most likely result in a crash. (CVE-2023-0215)

    - An invalid pointer dereference on read can be triggered when an application tries to load malformed PKCS7 data. The result of the       dereference is an application crash which could lead to a denial of service attack. (CVE-2023-0216)

    - An invalid pointer dereference on read can be triggered when an application tries to check a malformed DSA public key by the       EVP_PKEY_public_check() function. This will most likely lead to an application crash. (CVE-2023-0217)

    - A NULL pointer can be dereferenced when signatures are being verified on PKCS7 signed or signedAndEnveloped data. In case the hash       algorithm used for the signature is known to the OpenSSL library but the implementation of the hash algorithm is not available the       digest initialization will fail. (CVE-2023-0401) 

    - A read buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking, which       might result in a crash which could lead to a denial of service attack. (CVE-2022-4203)

    - All versions of package datatables.net are vulnerable to Prototype Pollution due to an incomplete fix for       https:/snyk.io/vuln/SNYK-JS-DATATABLESNET-598806. (CVE-2020-28458)

    - With the package datatables.net before 1.11.3 if an array is passed to the HTML escape entities function it would not       have its contents escaped. (CVE-2021-23445)

    - jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of       Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the       native Object.prototype. (CVE-2019-11358)

    - In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted       sources, even after sanitizing it, to one of jQuery DOM manipulation methods may execute untrusted code. (CVE-2020-11023)

    - jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method that fails to recognize and remove <script>       HTML tags that contain a whitespace character and trigger execution of the enclosed script logic. (CVE-2020-7656)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:4142 advisory.

  - jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to     recognize and remove <script> HTML tags that contain a whitespace character, i.e: </script >, which     results in the enclosed script logic to be executed. (CVE-2020-7656)

  - In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option>     elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods     (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
    (CVE-2020-11023)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9552 advisory.

    [0.10.10-4.0.1]
    - Replace HAM-logo.png with a generic one

    [0.10.10-4]
    - Fixed unfencing in
    - Resolves: rhbz#bz1991654

    [0.10.10-3]
    - Added add/remove syntax for command
    - Resolves: rhbz#1992668

    [0.10.10-2]
    - Fixed create resources with depth operation attribute
    - Resolves: rhbz#1998454

    [0.10.10-1]
    - Rebased to latest upstream sources (see CHANGELOG.md)
    - Updated pcs-web-ui
    - Resolves: rhbz#1885293 rhbz#1847102 rhbz#1935594

    [0.10.9-1]
    - Rebased to latest upstream sources (see CHANGELOG.md)
    - Resolves: rhbz#1432097 rhbz#1847102 rhbz#1935594 rhbz#1984901

    [0.10.8-4]
    - Rebased to latest upstream sources (see CHANGELOG.md)
    - Resolves: rhbz#1759995 rhbz#1872378 rhbz#1935594

    [0.10.8-3]
    - Rebased to latest upstream sources (see CHANGELOG.md)
    - Gating changes
    - Resolves: rhbz#1678273 rhbz#1690419 rhbz#1750240 rhbz#1759995 rhbz#1872378 rhbz#1909901 rhbz#1935594

    [0.10.8-2]
    - Rebased to latest upstream sources (see CHANGELOG.md)
    - Updated pcs-web-ui
    - Resolves: rhbz#1285269 rhbz#1290830 rhbz#1720221 rhbz#1841019 rhbz#1854238 rhbz#1882291 rhbz#1885302     rhbz#1886342 rhbz#1896458 rhbz#1922996 rhbz#1927384 rhbz#1927394 rhbz#1930886 rhbz#1935594

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4142 advisory.

  - jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods     (CVE-2020-11023)

  - jquery: Cross-site scripting (XSS) via <script> HTML tags containing whitespaces (CVE-2020-7656)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:4142 advisory.

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

    The following packages have been upgraded to a later upstream version: pcs (0.10.10). (BZ#1935594)

    Security Fix(es):

    * jquery: Cross-site scripting (XSS) via <script> HTML tags containing whitespaces (CVE-2020-7656)

    * jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods     (CVE-2020-11023)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.5 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
114501	jQuery < 1.9.0 Cross-Site Scripting	Web App Scanning	Component Vulnerability	medium
198498	RHEL 7 : pcp (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
194284	RHEL 6 / 7 / 8 : Red Hat AMQ Interconnect 1.9.0 (RHSA-2020:4211)	Nessus	Red Hat Local Security Checks	medium
184665	Rocky Linux 8 : pcs (RLSA-2021:4142)	Nessus	Rocky Linux Local Security Checks	medium
172124	Tenable Nessus <= 10.4.2 Multiple Vulnerabilities (TNS-2023-09)	Nessus	Misc.	high
157556	AlmaLinux 8 : pcs (ALSA-2021:4142)	Nessus	Alma Linux Local Security Checks	medium
155616	Oracle Linux 8 : pcs (ELSA-2021-9552)	Nessus	Oracle Linux Local Security Checks	medium
155098	CentOS 8 : pcs (CESA-2021:4142)	Nessus	CentOS Local Security Checks	medium
155058	RHEL 8 : pcs (RHSA-2021:4142)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2020-7656

medium

Tenable Plugins

medium

medium

medium

medium

high

medium

medium

medium

medium