sanitize-url (aka @braintree/sanitize-url) before 6.0.2 allows XSS via HTML entities.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - grafana: session control failure may lead to information disclosure (CVE-2022-32275)

  - protobufjs: prototype pollution using user-controlled protobuf message (CVE-2023-36665)

  - The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to     add/modify properties of the Object.prototype. This vulnerability can occur in multiple ways: 1. by     providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption functions 2. by     parsing/loading .proto files (CVE-2022-25878)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 9 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - grafana: session control failure may lead to information disclosure (CVE-2022-32275)

  - protobufjs: prototype pollution using user-controlled protobuf message (CVE-2023-36665)

  - The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to     add/modify properties of the Object.prototype. This vulnerability can occur in multiple ways: 1. by     providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption functions 2. by     parsing/loading .proto files (CVE-2022-25878)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

ID	Name	Product	Family	Severity
199102	RHEL 8 : grafana (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199090	RHEL 9 : grafana (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
195407	RHEL 9 : sanitize-url (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	medium
195361	RHEL 8 : sanitize-url (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2022-48345

medium

Tenable Plugins

critical

critical

medium

medium