According to its self-reported version number, HandlebarsJS on the remote server is prior to version 4.7.7. Therefore, it may be affected by multiple vulnerabilities.

- A Prototype Pollution Vulnerability when seleclecting certain compiling options to compile templates originating from untrusted sources (CVE-2021-23383).

- A Remote Code Execution vulnerability when seleclecting certain compiling options to compile templates originating from untrusted sources (CVE-2021-23369).

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The 12.2.1.4.0 and 14.1.1.0.0 versions of WebLogic Server installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2024 CPU advisory:

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Samples (handlebars)).     Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows \     unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of     this vulnerability can result in takeover of Oracle WebLogic Server. (CVE-2021-23369)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized Thirdparty     Jars (Bouncy Castle Java Library)). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise     Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset     of Oracle WebLogic Server accessible data. (CVE-2023-2976)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). The     supported version that is affected is 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker     with network access via HTTP/2 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can     result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic     Server. (CVE-2023-44487)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - ejs: server-side template injection in outputFunctionName (CVE-2022-29078)

  - The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling     options to compile templates coming from an untrusted source. (CVE-2021-23383)

  - The glob-parent package before 6.0.1 for Node.js allows ReDoS (regular expression denial of service)     attacks against the enclosure regular expression. (CVE-2021-35065)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

According to its self-reported version, the Nessus Network Monitor running on the remote host is prior to 6.3.1. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2023-43 advisory.

  - Nessus Network Monitor leverages third-party software to help provide underlying functionality. Several of     the third-party components (HandlebarsJS, OpenSSL, and jquery-file-upload)were found to contain     vulnerabilities, and updated versions have been made available by the providers.Out of caution and in line     with best practice, Tenable has opted to upgrade these components to address the potential impact of the     issues. Nessus Network Monitor 6.3.1 updates HandlebarsJS to version 4.7.8, OpenSSL to version 3.0.12, and     jquery-file-upload to version 10.8.0. Tenable has released Nessus Network Monitor 6.3.1 to address these     issues. The installation files can be obtained from the Tenable Downloads Portal     (https://www.tenable.com/downloads/nessus-network-monitor). (CVE-2018-9206, CVE-2021-23369,     CVE-2021-23383, CVE-2023-5363)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Nessus Network Monitor (NNM) installed on the remote host is prior to 6.2.0. It is, therefore, affected by multiple vulnerabilities in third-party software. Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues.
Nessus Network Monitor 6.2.0 updates moment.js to version 2.29.4 and handlebars to version 4.7.7 to address the identified vulnerabilities.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
114093	HandlebarsJS < 4.7.7 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	10/24/2023	10/25/2023	critical
195479	RHEL 7 : nodejs-handlebars (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	5/11/2024	5/31/2024	critical
193425	Oracle WebLogic Server (April 2024 CPU)	Nessus	Misc.	4/17/2024	10/18/2024	critical
199198	RHEL 8 : pcs (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	6/3/2024	10/21/2024	critical
186472	Nessus Network Monitor < 6.3.1 Multiple Vulnerabilities (TNS-2023-43)	Nessus	Misc.	11/30/2023	12/19/2023	critical
170688	Nessus Network Monitor < 6.2.0 Multiple Vulnerabilities (TNS-2022-28)	Nessus	Misc.	1/27/2023	9/6/2023	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical