The remote Ubuntu 16.04 ESM / 18.04 LTS / 20.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6065-1 advisory.

  - The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear     Time Complexity relative to the size of the input. (CVE-2021-33587)

  - The package css-what before 2.1.3 are vulnerable to Regular Expression Denial of Service (ReDoS) due to     the usage of insecure regular expression in the re_attr variable of index.js. The exploitation of this     vulnerability could be triggered via the parse function. (CVE-2022-21222)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3350 advisory.

  - The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear     Time Complexity relative to the size of the input. (CVE-2021-33587)

  - The package css-what before 2.1.3 are vulnerable to Regular Expression Denial of Service (ReDoS) due to     the usage of insecure regular expression in the re_attr variable of index.js. The exploitation of this     vulnerability could be triggered via the parse function. (CVE-2022-21222)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
175560	Ubuntu 16.04 ESM / 18.04 LTS / 20.04 ESM : css-what vulnerabilities (USN-6065-1)	Nessus	Ubuntu Local Security Checks	5/13/2023	10/20/2023	high
172087	Debian DLA-3350-1 : node-css-what - LTS security update	Nessus	Debian Local Security Checks	3/3/2023	8/31/2023	high
194919	Splunk Enterprise < 8.1.14, 8.2.0 < 8.2.11, 9.0.0 < 9.0.5 (SVD-2023-0613)	Nessus	CGI abuses	5/2/2024	5/30/2024	critical

Detections

Analytics

Plugins Search

high

high

critical