The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2575-1 advisory.

  - All versions of package trim are vulnerable to Regular Expression Denial of Service (ReDoS) via trim().
    (CVE-2020-7753)

  - ansi-regex is vulnerable to Inefficient Regular Expression Complexity (CVE-2021-3807)

  - json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype     Pollution') (CVE-2021-3918)

  - In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues()     method, aka lib/internal/iterator.js createObjectIterator prototype pollution. (CVE-2021-43138)

  - follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor     (CVE-2022-0155)

  - In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because     an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error. (CVE-2022-27664)

  - Grafana is an open-source platform for monitoring and observability. Versions on the 8.x and 9.x branch     prior to 9.0.3, 8.5.9, 8.4.10, and 8.3.10 are vulnerable to stored cross-site scripting via the Unified     Alerting feature of Grafana. An attacker can exploit this vulnerability to escalate privilege from editor     to admin by tricking an authenticated admin to click on a link. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10     contain a patch. As a workaround, it is possible to disable alerting or use legacy alerting.
    (CVE-2022-31097)

  - Grafana is an open-source platform for monitoring and observability. In versions 5.3 until 9.0.3, 8.5.9,     8.4.10, and 8.3.10, it is possible for a malicious user who has authorization to log into a Grafana     instance via a configured OAuth IdP which provides a login name to take over the account of another user     in that Grafana instance. This can occur when the malicious user is authorized to log in to Grafana via     OAuth, the malicious user's external user id is not already associated with an account in Grafana, the     malicious user's email address is not already associated with an account in Grafana, and the malicious     user knows the Grafana username of the target user. If these conditions are met, the malicious user can     set their username in the OAuth provider to that of the target user, then go through the OAuth flow to log     in to Grafana. Due to the way that external and internal user accounts are linked together during login,     if the conditions above are all met then the malicious user will be able to log in to the target user's     Grafana account. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch for this issue. As a     workaround, concerned users can disable OAuth login to their Grafana instance, or ensure that all users     authorized to log in via OAuth have a corresponding user account in Grafana linked to their email address.
    (CVE-2022-31107)

  - An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage     will take significant time to parse. (CVE-2022-32149)

  - Grafana is an open-source platform for monitoring and observability. Versions prior to 9.1.6 and 8.5.13     are vulnerable to an escalation from admin to server admin when auth proxy is used, allowing an admin to     take over the server admin account and gain full control of the grafana instance. All installations should     be upgraded as soon as possible. As a workaround deactivate auth proxy following the instructions at:
    https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/auth-     proxy/ (CVE-2022-35957)

  - Grafana is an open-source platform for monitoring and observability. In versions prior to 8.5.13, 9.0.9,     and 9.1.6, Grafana is subject to Improper Preservation of Permissions resulting in privilege escalation on     some folders where Admin is the only used permission. The vulnerability impacts Grafana instances where     RBAC was disabled and enabled afterwards, as the migrations which are translating legacy folder     permissions to RBAC permissions do not account for the scenario where the only user permission in the     folder is Admin, as a result RBAC adds permissions for Editors and Viewers which allow them to edit and     view folders accordingly. This issue has been patched in versions 8.5.13, 9.0.9, and 9.1.6. A workaround     when the impacted folder/dashboard is known is to remove the additional permissions manually.
    (CVE-2022-36062)

  - Grafana is an open-source platform for monitoring and observability. Starting with the 9.1 branch, Grafana     introduced the ability to search for a JWT in the URL query parameter auth_token and use it as the     authentication token. By enabling the url_login configuration option (disabled by default), a JWT might     be sent to data sources. If an attacker has access to the data source, the leaked token could be used to     authenticate to Grafana. (CVE-2023-1387)

  - Grafana is an open-source platform for monitoring and observability. Grafana had a stored XSS     vulnerability in the Graphite FunctionDescription tooltip. The stored XSS vulnerability was possible due     the value of the Function Description was not properly sanitized. An attacker needs to have control over     the Graphite data source in order to manipulate a function description and a Grafana admin needs to     configure the data source, later a Grafana user needs to select a tampered function and hover over the     description. Users may upgrade to version 8.5.22, 9.2.15 and 9.3.11 to receive a fix. (CVE-2023-1410)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0487-1 advisory.

  - All versions of package trim are vulnerable to Regular Expression Denial of Service (ReDoS) via trim().
    (CVE-2020-7753)

  - ansi-regex is vulnerable to Inefficient Regular Expression Complexity (CVE-2021-3807)

  - json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype     Pollution') (CVE-2021-3918)

  - In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues()     method, aka lib/internal/iterator.js createObjectIterator prototype pollution. (CVE-2021-43138)

  - Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through     8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files.
    The vulnerable URL path is: `<grafana_host_url>/public/plugins//`, where is the plugin ID for any     installed plugin. At no time has Grafana Cloud been vulnerable. Users are advised to upgrade to patched     versions 8.0.7, 8.1.8, 8.2.7, or 8.3.1. The GitHub Security Advisory contains more information about     vulnerable URL paths, mitigation, and the disclosure timeline. (CVE-2021-43798)

  - Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and     7.5.12 has a directory traversal for arbitrary .csv files. It only affects instances that have the     developer testing tool called TestData DB data source enabled and configured. The vulnerability is limited     in scope, and only allows access to files with the extension .csv to authenticated users only. Grafana     Cloud instances have not been affected by the vulnerability. Versions 8.3.2 and 7.5.12 contain a patch for     this issue. There is a workaround available for users who cannot upgrade. Running a reverse proxy in front     of Grafana that normalizes the PATH of the request will mitigate the vulnerability. The proxy will have to     also be able to handle url encoded paths. (CVE-2021-43815)

  - follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor     (CVE-2022-0155)

  - Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion     or denial of service. The parsed regexp representation is linear in the size of the input, but in some     cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger     amounts of memory. After fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular     expressions whose representation would use more space than that are rejected. Normal use of regular     expressions is unaffected. (CVE-2022-41715)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2578-1 advisory.

  - All versions of package trim are vulnerable to Regular Expression Denial of Service (ReDoS) via trim().
    (CVE-2020-7753)

  - ansi-regex is vulnerable to Inefficient Regular Expression Complexity (CVE-2021-3807)

  - json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype     Pollution') (CVE-2021-3918)

  - In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues()     method, aka lib/internal/iterator.js createObjectIterator prototype pollution. (CVE-2021-43138)

  - follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor     (CVE-2022-0155)

  - In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because     an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error. (CVE-2022-27664)

  - Grafana is an open-source platform for monitoring and observability. Versions on the 8.x and 9.x branch     prior to 9.0.3, 8.5.9, 8.4.10, and 8.3.10 are vulnerable to stored cross-site scripting via the Unified     Alerting feature of Grafana. An attacker can exploit this vulnerability to escalate privilege from editor     to admin by tricking an authenticated admin to click on a link. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10     contain a patch. As a workaround, it is possible to disable alerting or use legacy alerting.
    (CVE-2022-31097)

  - Grafana is an open-source platform for monitoring and observability. In versions 5.3 until 9.0.3, 8.5.9,     8.4.10, and 8.3.10, it is possible for a malicious user who has authorization to log into a Grafana     instance via a configured OAuth IdP which provides a login name to take over the account of another user     in that Grafana instance. This can occur when the malicious user is authorized to log in to Grafana via     OAuth, the malicious user's external user id is not already associated with an account in Grafana, the     malicious user's email address is not already associated with an account in Grafana, and the malicious     user knows the Grafana username of the target user. If these conditions are met, the malicious user can     set their username in the OAuth provider to that of the target user, then go through the OAuth flow to log     in to Grafana. Due to the way that external and internal user accounts are linked together during login,     if the conditions above are all met then the malicious user will be able to log in to the target user's     Grafana account. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch for this issue. As a     workaround, concerned users can disable OAuth login to their Grafana instance, or ensure that all users     authorized to log in via OAuth have a corresponding user account in Grafana linked to their email address.
    (CVE-2022-31107)

  - An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage     will take significant time to parse. (CVE-2022-32149)

  - Grafana is an open-source platform for monitoring and observability. Versions prior to 9.1.6 and 8.5.13     are vulnerable to an escalation from admin to server admin when auth proxy is used, allowing an admin to     take over the server admin account and gain full control of the grafana instance. All installations should     be upgraded as soon as possible. As a workaround deactivate auth proxy following the instructions at:
    https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/auth-     proxy/ (CVE-2022-35957)

  - Grafana is an open-source platform for monitoring and observability. In versions prior to 8.5.13, 9.0.9,     and 9.1.6, Grafana is subject to Improper Preservation of Permissions resulting in privilege escalation on     some folders where Admin is the only used permission. The vulnerability impacts Grafana instances where     RBAC was disabled and enabled afterwards, as the migrations which are translating legacy folder     permissions to RBAC permissions do not account for the scenario where the only user permission in the     folder is Admin, as a result RBAC adds permissions for Editors and Viewers which allow them to edit and     view folders accordingly. This issue has been patched in versions 8.5.13, 9.0.9, and 9.1.6. A workaround     when the impacted folder/dashboard is known is to remove the additional permissions manually.
    (CVE-2022-36062)

  - Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion     or denial of service. The parsed regexp representation is linear in the size of the input, but in some     cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger     amounts of memory. After fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular     expressions whose representation would use more space than that are rejected. Normal use of regular     expressions is unaffected. (CVE-2022-41715)

  - Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8.2, if     someone has access to a Prometheus web.yml file and users' bcrypted passwords, they can bypass security by     poisoning the built-in authentication cache. Versions 0.7.2 and 0.8.2 contain a fix for the issue. There     is no workaround, but attacker must have access to the hashed password to use this functionality.
    (CVE-2022-46146)

  - Grafana is an open-source platform for monitoring and observability. Starting with the 9.1 branch, Grafana     introduced the ability to search for a JWT in the URL query parameter auth_token and use it as the     authentication token. By enabling the url_login configuration option (disabled by default), a JWT might     be sent to data sources. If an attacker has access to the data source, the leaked token could be used to     authenticate to Grafana. (CVE-2023-1387)

  - Grafana is an open-source platform for monitoring and observability. Grafana had a stored XSS     vulnerability in the Graphite FunctionDescription tooltip. The stored XSS vulnerability was possible due     the value of the Function Description was not properly sanitized. An attacker needs to have control over     the Graphite data source in order to manipulate a function description and a Grafana admin needs to     configure the data source, later a Grafana user needs to select a tampered function and hover over the     description. Users may upgrade to version 8.5.22, 9.2.15 and 9.3.11 to receive a fix. (CVE-2023-1410)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2023-0613 advisory.

  - A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as     @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable. NOTE: the vendor states we are in     the process of marking this report as invalid; however, some third parties takes the position that A     prototype injection/Prototype pollution is not just when global objects are polluted with recursive merge     or deep cloning but also when a target object is polluted. (CVE-2022-37616)

  - When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by     finalizing the operation with a rename from a temporary name to the final target file name.In that rename     operation, it might accidentally *widen* the permissions for the target file, leaving the updated file     accessible to more users than intended. (CVE-2022-32207)

  - An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the     XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to     access an array at a negative 2GB offset, typically leading to a segmentation fault. (CVE-2022-40303)

  - An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a     hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be     provoked. (CVE-2022-40304)

  - There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName.
    X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME     incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently     interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL     checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may     allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or     enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate     chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these     inputs, the other input must already contain an X.400 address as a CRL distribution point, which is     uncommon. As such, this vulnerability is most likely to only affect applications which have implemented     their own functionality for retrieving CRLs over a network. (CVE-2023-0286)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
177500	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : SUSE Manager Client Tools (SUSE-SU-2023:2575-1)	Nessus	SuSE Local Security Checks	6/22/2023	7/14/2023	critical
190632	SUSE SLES15 / openSUSE 15 Security Update : SUSE Manager Client Tools (SUSE-SU-2024:0487-1)	Nessus	SuSE Local Security Checks	2/17/2024	2/19/2024	critical
177497	SUSE SLES15 / openSUSE 15 Security Update : SUSE Manager Client Tools (SUSE-SU-2023:2578-1)	Nessus	SuSE Local Security Checks	6/22/2023	7/14/2023	critical
194919	Splunk Enterprise < 8.1.14, 8.2.0 < 8.2.11, 9.0.0 < 9.0.5 (SVD-2023-0613)	Nessus	CGI abuses	5/2/2024	7/26/2024	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical