Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does not necessarily return the original DOM tree, and a namespace can change from HTML to MathML, as demonstrated by nesting of FORM elements.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does     not necessarily return the original DOM tree, and a namespace can change from HTML to MathML, as     demonstrated by nesting of FORM elements. (CVE-2020-26870)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does
    not necessarily return the original DOM tree, and a namespace can change from HTML to MathML, as
    demonstrated by nesting of FORM elements. (CVE-2020-26870)

The version of Solarwinds Web Help Desk installed on the remote host is prior to 12.8.4. It is, therefore, affected by multiple vulnerabilities as referenced in the 12.8.4 release notes.

  - Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does     not necessarily return the original DOM tree, and a namespace can change from HTML to MathML, as     demonstrated by nesting of FORM elements. (CVE-2020-26870)

  - SolarWinds Web Help Desk was susceptible to a local file read vulnerability. This vulnerability requires     the software be installed on Linux and configured to use non-default development/test mode making exposure     to the vulnerability very limited. (CVE-2024-45709)

  - DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It has been     discovered that malicious HTML using special nesting techniques can bypass the depth checking added to     DOMPurify in recent releases. It was also possible to use Prototype Pollution to weaken the depth check.
    This renders dompurify unable to avoid cross site scripting (XSS) attacks. This issue has been addressed     in versions 2.5.4 and 3.1.3 of DOMPurify. All users are advised to upgrade. There are no known workarounds     for this vulnerability. (CVE-2024-45801)

  - DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was     vulnerable to nesting-based mXSS. This vulnerability is fixed in 2.5.0 and 3.1.3. (CVE-2024-47875)

  - DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify was     vulnerable to prototype pollution. This vulnerability is fixed in 2.4.2. (CVE-2024-48910)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Dell Wyse Management Suite installed on the remote host is prior to 4.0. It is, therefore, affected by multiple vulnerabilities as referenced in the DSA-2022-329 advisory.

  - Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does     not necessarily return the original DOM tree, and a namespace can change from HTML to MathML, as     demonstrated by nesting of FORM elements. (CVE-2020-26870)

  - The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via     the writeReplace() method in internal classes, which may lead to DoS attacks. (CVE-2022-25647)

  - The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious     XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler     and execute arbitrary Java bytecode. The Apache Xalan Java project is dormant and in the process of being     retired. No future releases of Apache Xalan Java to address this issue are expected. Note: Java runtimes     (such as OpenJDK) include repackaged copies of Xalan. (CVE-2022-34169)

  - Wyse Management Suite Repository 3.8 and earlier contain an information disclosure vulnerability in error     pages with which an attacker may potentially discover the internal structure of the application and its     components and use this information for further vulnerability research. (CVE-2022-46675)

  - Wyse Management Suite 3.8 and earlier contain an improper access control vulnerability. A malicious admin     user may potentially disable or delete users under administration and unassigned admins for which the     group admin is not authorized. (CVE-2022-46676)

  - Wyse Management Suite 3.8 and earlier contain an improper access control vulnerability. An authenticated     malicious admin user may potentially create a subgroup under a group for which the admin is not     authorized. (CVE-2022-46677)

  - Wyse Management Suite 3.8 and earlier contain an improper access control vulnerability. An authenticated     malicious admin user may potentially edit general client policy for which the user is not authorized.
    (CVE-2022-46678, CVE-2022-46755)

  - Wyse Management Suite 3.8 and earlier contain an improper access control vulnerability. An authenticated     malicious admin user may potentially access certain pro license features for which this admin is not     authorized in order to configure user controlled external entities. (CVE-2022-46754)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2021 CPU advisory.

  - Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions     that are affected are 12.1.0.2 and 19c. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via Oracle Net to compromise Advanced Networking Option. Successful attacks require     human interaction from a person other than the attacker and while the vulnerability is in Advanced     Networking Option, attacks may significantly impact additional products. Successful attacks of this     vulnerability can result in takeover of Advanced Networking Option. (CVE-2021-2351)

  - Vulnerability in the Oracle Text component of Oracle Database Server. Supported versions that are affected     are 12.1.0.2 and 19c. Easily exploitable vulnerability allows high privileged attacker having Create Any     Procedure, Alter Any Table privilege with network access via Oracle Net to compromise Oracle Text.
    Successful   attacks of this vulnerability can result in takeover of Oracle Text. (CVE-2021-2328)

  - Vulnerability in the Oracle XML DB component of Oracle Database Server. Supported versions that are     affected   are 12.1.0.2 and 19c. Easily exploitable vulnerability allows high privileged attacker having     Create Any   Procedure, Create Public Synonym privilege with network access via Oracle Net to compromise     Oracle XML DB.   Successful attacks of this vulnerability can result in takeover of Oracle XML DB.
    (CVE-2021-2329)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Microsoft Visual Studio Products are missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - An elevation of privilege vulnerability. An attacker can     exploit this to gain elevated privileges.
    (CVE-2021-1651, CVE-2021-1680)

  - A denial of service (DoS) vulnerability. An attacker can     exploit this issue to cause the affected component to     deny system or application services. (CVE-2021-1723)

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2020-26870)

Two issues have been found in dompurify.js, an XSS sanitizer for HTML, MathML and SVG.

Both issues are related to mXSS issues in SVG- or MATH-elements.

For Debian 9 stretch, these problems have been fixed in version 0.8.2~dfsg1-1+deb9u1.

We recommend that you upgrade your dompurify.js packages.

For the detailed security status of dompurify.js please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/dompurify.js

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
262706	Linux Distros Unpatched Vulnerability : CVE-2020-26870	Nessus	Misc.	Local	medium
411157	SCA: security update for dompurify (GHSA-63q7-h895-m982)	Tenable Cloud Security	SCA Checks	Local	medium
411157	SCA: security update for dompurify (GHSA-63q7-h895-m982)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
213005	SolarWinds Web Help Desk < 12.8.4 Multiple Vulnerabilities	Nessus	CGI abuses	Combined	critical
168926	Dell Wyse Management Suite < 4.0 Multiple Vulnerabilities (DSA-2022-329)	Nessus	Windows	Local	high
152026	Oracle Database Server Multiple Vulnerabilities (Jul 2021 CPU)	Nessus	Databases	Combined	critical
144977	Security Updates for Microsoft Visual Studio Products (January 2021)	Nessus	Windows : Microsoft Bulletins	Local	medium
142105	Debian DLA-2419-1 : dompurify.js security update	Nessus	Debian Local Security Checks	Local	medium

Detections

Analytics

CVE-2020-26870

medium

Tenable Plugins

medium

medium

medium

critical

high

critical

medium

medium