The versions of MySQL Enterprise Monitor installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2023 CPU advisory.

  - Vulnerability in the MySQL Enterprise Monitor product of Oracle MySQL (component: Monitoring: General     (Spring Security)). Supported versions that are affected are 8.0.32 and prior. Easily exploitable     vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise     MySQL Enterprise Monitor. Successful attacks of this vulnerability can result in takeover of MySQL     Enterprise Monitor. (CVE-2022-31692)

  - Vulnerability in the MySQL Enterprise Monitor product of Oracle MySQL (component: Monitoring: General     (Apache Tomcat)). Supported versions that are affected are 8.0.32 and prior. Easily exploitable     vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise     MySQL Enterprise Monitor. Successful attacks of this vulnerability can result in unauthorized creation,     deletion or modification access to critical data or all MySQL Enterprise Monitor accessible data.
    (CVE-2022-42252)

  - Vulnerability in the MySQL Enterprise Monitor product of Oracle MySQL (component: Monitoring: General     (Spring Framework)). Supported versions that are affected are 8.0.32 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     MySQL Enterprise Monitor. Successful attacks of this vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete DOS) of MySQL Enterprise Monitor. (CVE-2022-22971)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3299 advisory.

  - google-oauth-client: missing PKCE support in accordance with the RFC for OAuth 2.0 for Native Apps can     lead to improper authorization (CVE-2020-7692)

  - kubernetes-client: Insecure deserialization in unmarshalYaml method (CVE-2021-4178)

  - jackson-databind: Possible DoS if using JDK serialization to serialize JsonNode (CVE-2021-46877)

  - springframework: Authorization Bypass in RegexRequestMatcher (CVE-2022-22978)

  - com.google.code.gson-gson: Deserialization of Untrusted Data in com.google.code.gson-gson (CVE-2022-25647)

  - xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks (CVE-2022-40151)

  - woodstox-core: woodstox to serialise XML data was vulnerable to Denial of Service attacks (CVE-2022-40152)

  - apache-commons-text: variable interpolation RCE (CVE-2022-42889)

  - jenkins-2-plugins/script-security: Sandbox bypass vulnerability in Script Security Plugin (CVE-2023-24422)

  - Apache Commons FileUpload: FileUpload DoS with excessive parts (CVE-2023-24998)

  - jenkins-2-plugins/JUnit: Stored XSS vulnerability in JUnit Plugin (CVE-2023-25761)

  - jenkins-2-plugins/pipeline-build-step: Stored XSS vulnerability in Pipeline: Build Step Plugin     (CVE-2023-25762)

  - Jenkins: Denial of Service attack (CVE-2023-27900, CVE-2023-27901)

  - Jenkins: Workspace temporary directories accessible through directory browser (CVE-2023-27902)

  - Jenkins: Information disclosure through error stack traces related to agents (CVE-2023-27904)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host contains a Spring Security version that is prior to 5.5.7 or 5.6.x prior to 5.6.4. It is, therefore, affected by an authorization bypass vulnerability.

  - In Spring Security versions 5.5.6 and 5.6.3 and older unsupported versions, RegexRequestMatcher can easily   be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with `.`   in the regular expression are possibly vulnerable to an authorization bypass. (CVE-2022-22978)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
170195	Oracle MySQL Enterprise Monitor (Jan 2023 CPU)	Nessus	CGI abuses	1/20/2023	11/1/2023	critical
194250	RHEL 8 : jenkins and jenkins-2-plugins (RHSA-2023:3299)	Nessus	Red Hat Local Security Checks	4/28/2024	4/29/2024	critical
170668	Spring Security < 5.5.7 / 5.6.x < 5.6.4 Authorization Bypass	Nessus	Misc.	1/26/2023	9/6/2023	critical
197084	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.8)	Nessus	Misc.	5/15/2024	9/8/2024	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical