ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes     via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can     overwrite this builtin attribute to manipulate the type detection result. (CVE-2019-20149)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes
    via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can
    overwrite this builtin attribute to manipulate the type detection result. (CVE-2019-20149)

The version of js-jquery installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2019-20149 advisory.

  - ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes     via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can     overwrite this builtin attribute to manipulate the type detection result. (CVE-2019-20149)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of js-jquery installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2019-20149 advisory.

  - ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes     via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can     overwrite this builtin attribute to manipulate the type detection result. (CVE-2019-20149)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2023-0613 advisory.

  - A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as     @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable. NOTE: the vendor states we are in     the process of marking this report as invalid; however, some third parties takes the position that A     prototype injection/Prototype pollution is not just when global objects are polluted with recursive merge     or deep cloning but also when a target object is polluted. (CVE-2022-37616)

  - When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by     finalizing the operation with a rename from a temporary name to the final target file name.In that rename     operation, it might accidentally *widen* the permissions for the target file, leaving the updated file     accessible to more users than intended. (CVE-2022-32207)

  - An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the     XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to     access an array at a negative 2GB offset, typically leading to a segmentation fault. (CVE-2022-40303)

  - An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a     hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be     provoked. (CVE-2022-40304)

  - There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName.
    X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME     incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently     interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL     checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may     allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or     enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate     chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these     inputs, the other input must already contain an X.400 address as a CRL distribution point, which is     uncommon. As such, this vulnerability is most likely to only affect applications which have implemented     their own functionality for retrieving CRLs over a network. (CVE-2023-0286)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
250930	Linux Distros Unpatched Vulnerability : CVE-2019-20149	Nessus	Misc.	high
422166	SCA: security update for kind-of (GHSA-6c8f-qphg-qjgp)	Tenable Cloud Security	SCA Checks	high
422166	SCA: security update for kind-of (GHSA-6c8f-qphg-qjgp)	Tenable Self-Hosted Container Security	SCA Checks	high
215556	Azure Linux 3.0 Security Update: js-jquery (CVE-2019-20149)	Nessus	Azure Linux Local Security Checks	high
207031	CBL Mariner 2.0 Security Update: js-jquery (CVE-2019-20149)	Nessus	MarinerOS Local Security Checks	high
194919	Splunk Enterprise < 8.1.14, 8.2.0 < 8.2.11, 9.0.0 < 9.0.5 (SVD-2023-0613)	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2019-20149

high

Tenable Plugins

high

high

high

high

high

critical