Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2023-0215 advisory.

  - Eventlet is a concurrent networking library for Python. A websocket peer may exhaust memory on Eventlet     side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending     highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As     a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but     there is no workaround to protect Eventlet process. (CVE-2021-21419)

  - An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling     the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute     allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS     code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3.
    (CVE-2021-28957)

  - Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path     traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1,     especially if a user-provided locale string is directly used to switch moment locale. This problem is     patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the     user-provided locale name before passing it to Moment.js. (CVE-2022-24785)

  - moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected     versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date     parsing in moment (more specifically rfc2822 parsing, which is tried by default) has quadratic (N^2)     complexity on specific inputs. Users may notice a noticeable slowdown is observed with inputs above 10k     characters. Users who pass user-provided strings without sanity length checks to moment constructor are     vulnerable to (Re)DoS attacks. The problem is patched in 2.29.4, the patch can be applied to all affected     versions with minimal tweaking. Users are advised to upgrade. Users unable to upgrade should consider     limiting date lengths accepted from user input. (CVE-2022-31129)

  - A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an     insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check     if an IP address is invalid before making DBS requests allowing rebinding attacks. (CVE-2022-32212)

  - In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands     discovered in the system mailcap file. This may allow attackers to inject shell commands into applications     that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or     arguments). The fix is also back-ported to 3.7, 3.8, 3.9 (CVE-2015-20107)

  - There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker     who is able to supply a crafted file to be processed by an application linked with the affected     functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to     application availability, with some potential impact to confidentiality and integrity if an attacker is     able to use memory information to further exploit the application. (CVE-2021-3517)

  - A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while     parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery     mode and post-validated, the flaw could be used to crash the application. The highest threat from this     vulnerability is to system availability. (CVE-2021-3537)

  - There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to     be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact     from this flaw is to confidentiality, integrity, and availability. (CVE-2021-3518)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-3256575fc8 advisory.

  - Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path     traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1,     especially if a user-provided locale string is directly used to switch moment locale. This problem is     patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the     user-provided locale name before passing it to Moment.js. (CVE-2022-24785)

  - moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected     versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date     parsing in moment (more specifically rfc2822 parsing, which is tried by default) has quadratic (N^2)     complexity on specific inputs. Users may notice a noticeable slowdown is observed with inputs above 10k     characters. Users who pass user-provided strings without sanity length checks to moment constructor are     vulnerable to (Re)DoS attacks. The problem is patched in 2.29.4, the patch can be applied to all affected     versions with minimal tweaking. Users are advised to upgrade. Users unable to upgrade should consider     limiting date lengths accepted from user input. (CVE-2022-31129)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1044 advisory.

  - bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute (CVE-2018-14040)

  - bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip (CVE-2018-14042)

  - jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or     property injection (CVE-2019-11358)

  - jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)

  - jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods     (CVE-2020-11023)

  - glob-parent: Regular Expression Denial of Service (CVE-2021-35065)

  - minimist: prototype pollution (CVE-2021-44906)

  - keycloak: HTML injection in execute-actions-email Admin REST API (CVE-2022-1274)

  - keycloak: XSS on impersonation under specific circumstances (CVE-2022-1438)

  - SnakeYaml: Constructor Deserialization Remote Code Execution (CVE-2022-1471)

  - Undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations     (CVE-2022-2764)

  - keycloak: Session takeover with OIDC offline refreshtokens (CVE-2022-3916)

  - keycloak: reflected XSS attack (CVE-2022-4137)

  - Moment.js: Path traversal  in moment.locale (CVE-2022-24785)

  - snakeyaml: Denial of Service due to missing nested depth limitation for collections (CVE-2022-25857)

  - moment: inefficient parsing algorithm resulting in DoS (CVE-2022-31129)

  - loader-utils:Regular expression denial of service (CVE-2022-37603)

  - snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode (CVE-2022-38749)

  - snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject     (CVE-2022-38750)

  - snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match (CVE-2022-38751)

  - jettison: parser crash by stackoverflow (CVE-2022-40149)

  - jettison: memory exhaustion via user-supplied XML or JSON data (CVE-2022-40150)

  - jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003)

  - jackson-databind: use of deeply nested arrays (CVE-2022-42004)

  - mina-sshd: Java unsafe deserialization vulnerability (CVE-2022-45047)

  - jettison:  If the value in map is the map's self, the new new JSONObject(map) cause StackOverflowError     which may lead to dos (CVE-2022-45693)

  - json5: Prototype Pollution in JSON5 via Parse Method (CVE-2022-46175)

  - Apache CXF: directory listing / code exfiltration (CVE-2022-46363)

  - Apache CXF: SSRF Vulnerability (CVE-2022-46364)

  - keycloak: Client Registration endpoint does not check token revocation (CVE-2023-0091)

  - keycloak: user impersonation via stolen uuid code (CVE-2023-0264)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1043 advisory.

  - bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute (CVE-2018-14040)

  - bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip (CVE-2018-14042)

  - jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or     property injection (CVE-2019-11358)

  - jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)

  - jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods     (CVE-2020-11023)

  - glob-parent: Regular Expression Denial of Service (CVE-2021-35065)

  - minimist: prototype pollution (CVE-2021-44906)

  - keycloak: HTML injection in execute-actions-email Admin REST API (CVE-2022-1274)

  - keycloak: XSS on impersonation under specific circumstances (CVE-2022-1438)

  - SnakeYaml: Constructor Deserialization Remote Code Execution (CVE-2022-1471)

  - Undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations     (CVE-2022-2764)

  - keycloak: Session takeover with OIDC offline refreshtokens (CVE-2022-3916)

  - keycloak: reflected XSS attack (CVE-2022-4137)

  - Moment.js: Path traversal  in moment.locale (CVE-2022-24785)

  - snakeyaml: Denial of Service due to missing nested depth limitation for collections (CVE-2022-25857)

  - moment: inefficient parsing algorithm resulting in DoS (CVE-2022-31129)

  - loader-utils:Regular expression denial of service (CVE-2022-37603)

  - snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode (CVE-2022-38749)

  - snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject     (CVE-2022-38750)

  - snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match (CVE-2022-38751)

  - jettison: parser crash by stackoverflow (CVE-2022-40149)

  - jettison: memory exhaustion via user-supplied XML or JSON data (CVE-2022-40150)

  - jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003)

  - jackson-databind: use of deeply nested arrays (CVE-2022-42004)

  - mina-sshd: Java unsafe deserialization vulnerability (CVE-2022-45047)

  - jettison:  If the value in map is the map's self, the new new JSONObject(map) cause StackOverflowError     which may lead to dos (CVE-2022-45693)

  - json5: Prototype Pollution in JSON5 via Parse Method (CVE-2022-46175)

  - Apache CXF: directory listing / code exfiltration (CVE-2022-46363)

  - Apache CXF: SSRF Vulnerability (CVE-2022-46364)

  - keycloak: Client Registration endpoint does not check token revocation (CVE-2023-0091)

  - keycloak: user impersonation via stolen uuid code (CVE-2023-0264)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1045 advisory.

  - bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute (CVE-2018-14040)

  - bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip (CVE-2018-14042)

  - jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or     property injection (CVE-2019-11358)

  - jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)

  - jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods     (CVE-2020-11023)

  - glob-parent: Regular Expression Denial of Service (CVE-2021-35065)

  - minimist: prototype pollution (CVE-2021-44906)

  - keycloak: HTML injection in execute-actions-email Admin REST API (CVE-2022-1274)

  - keycloak: XSS on impersonation under specific circumstances (CVE-2022-1438)

  - SnakeYaml: Constructor Deserialization Remote Code Execution (CVE-2022-1471)

  - Undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations     (CVE-2022-2764)

  - keycloak: Session takeover with OIDC offline refreshtokens (CVE-2022-3916)

  - keycloak: reflected XSS attack (CVE-2022-4137)

  - Moment.js: Path traversal  in moment.locale (CVE-2022-24785)

  - snakeyaml: Denial of Service due to missing nested depth limitation for collections (CVE-2022-25857)

  - moment: inefficient parsing algorithm resulting in DoS (CVE-2022-31129)

  - loader-utils:Regular expression denial of service (CVE-2022-37603)

  - snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode (CVE-2022-38749)

  - snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject     (CVE-2022-38750)

  - snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match (CVE-2022-38751)

  - jettison: parser crash by stackoverflow (CVE-2022-40149)

  - jettison: memory exhaustion via user-supplied XML or JSON data (CVE-2022-40150)

  - jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003)

  - jackson-databind: use of deeply nested arrays (CVE-2022-42004)

  - mina-sshd: Java unsafe deserialization vulnerability (CVE-2022-45047)

  - jettison:  If the value in map is the map's self, the new new JSONObject(map) cause StackOverflowError     which may lead to dos (CVE-2022-45693)

  - json5: Prototype Pollution in JSON5 via Parse Method (CVE-2022-46175)

  - Apache CXF: directory listing / code exfiltration (CVE-2022-46363)

  - Apache CXF: SSRF Vulnerability (CVE-2022-46364)

  - keycloak: Client Registration endpoint does not check token revocation (CVE-2023-0091)

  - keycloak: user impersonation via stolen uuid code (CVE-2023-0264)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3295 advisory.

  - Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path     traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1,     especially if a user-provided locale string is directly used to switch moment locale. This problem is     patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the     user-provided locale name before passing it to Moment.js. (CVE-2022-24785)

  - moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected     versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date     parsing in moment (more specifically rfc2822 parsing, which is tried by default) has quadratic (N^2)     complexity on specific inputs. Users may notice a noticeable slowdown is observed with inputs above 10k     characters. Users who pass user-provided strings without sanity length checks to moment constructor are     vulnerable to (Re)DoS attacks. The problem is patched in 2.29.4, the patch can be applied to all affected     versions with minimal tweaking. Users are advised to upgrade. Users unable to upgrade should consider     limiting date lengths accepted from user input. (CVE-2022-31129)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Nessus Network Monitor (NNM) installed on the remote host is prior to 6.2.0. It is, therefore, affected by multiple vulnerabilities in third-party software. Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues.
Nessus Network Monitor 6.2.0 updates moment.js to version 2.29.4 and handlebars to version 4.7.7 to address the identified vulnerabilities.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:0076 advisory.

  - Moment.js: Path traversal  in moment.locale (CVE-2022-24785)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Tenable Nessus application running on the remote host is 10.x prior to 10.3.1. It is, therefore, affected by multiple vulnerabilities, including:

  - A use-after-free vulnerability in the doContent function in xmlparse.c in libexpat. (CVE-2022-40674)

  - A path traversal vulnerability in the locale string handling functionality of Moment.js. (CVE-2022-24785)

  - A denial of service vulnerability in the string-to-date parsing functinality in Moment.js (CVE-2022-31129)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:6272 advisory.

  - Moment.js: Path traversal  in moment.locale (CVE-2022-24785)

  - moment: inefficient parsing algorithm resulting in DoS (CVE-2022-31129)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6277 advisory.

  - golang: encoding/pem: fix stack overflow in Decode (CVE-2022-24675)

  - Moment.js: Path traversal  in moment.locale (CVE-2022-24785)

  - golang: regexp: stack exhaustion via a deeply nested expression (CVE-2022-24921)

  - golang: crypto/elliptic: panic caused by oversized scalar (CVE-2022-28327)

  - golang: syscall: faccessat checks wrong group (CVE-2022-29526)

  - golang: crypto/tls: session tickets lack random ticket_age_add (CVE-2022-30629)

  - moment: inefficient parsing algorithm resulting in DoS (CVE-2022-31129)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5559-1 advisory.

  - Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path     traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1,     especially if a user-provided locale string is directly used to switch moment locale. This problem is     patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the     user-provided locale name before passing it to Moment.js. (CVE-2022-24785)

  - moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected     versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date     parsing in moment (more specifically rfc2822 parsing, which is tried by default) has quadratic (N^2)     complexity on specific inputs. Users may notice a noticeable slowdown is observed with inputs above 10k     characters. Users who pass user-provided strings without sanity length checks to moment constructor are     vulnerable to (Re)DoS attacks. The problem is patched in 2.29.4, the patch can be applied to all affected     versions with minimal tweaking. Users are advised to upgrade. Users unable to upgrade should consider     limiting date lengths accepted from user input. (CVE-2022-31129)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:4918 advisory.

  - jackson-databind: denial of service via a large depth of nested objects (CVE-2020-36518)

  - netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data (CVE-2021-37136)

  - netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an     unnecessary way (CVE-2021-37137)

  - h2: Remote Code Execution in Console (CVE-2021-42392)

  - netty: control chars in header names may lead to HTTP request smuggling (CVE-2021-43797)

  - xnio: org.xnio.StreamConnection.notifyReadClosed log to debug instead of stderr (CVE-2022-0084)

  - jboss-client: memory leakage in remote client transaction (CVE-2022-0853)

  - wildfly: Wildfly management of EJB Session context returns wrong caller principal with Elytron Security     enabled (CVE-2022-0866)

  - undertow: Double AJP response for 400 from EAP 7 results in CPING failures (CVE-2022-1319)

  - OpenJDK: Infinite loop related to incorrect handling of newlines in XMLEntityScanner (JAXP, 8270646)     (CVE-2022-21299)

  - mysql-connector-java: Difficult to exploit vulnerability allows high privileged attacker with network     access via multiple protocols to compromise MySQL Connectors (CVE-2022-21363)

  - h2: Loading of custom classes from remote servers through JNDI (CVE-2022-23221)

  - xerces-j2: infinite loop when handling specially crafted XML document payloads (CVE-2022-23437)

  - artemis-commons: Apache ActiveMQ Artemis DoS (CVE-2022-23913)

  - Moment.js: Path traversal  in moment.locale (CVE-2022-24785)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:4919 advisory.

  - jackson-databind: denial of service via a large depth of nested objects (CVE-2020-36518)

  - netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data (CVE-2021-37136)

  - netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an     unnecessary way (CVE-2021-37137)

  - h2: Remote Code Execution in Console (CVE-2021-42392)

  - netty: control chars in header names may lead to HTTP request smuggling (CVE-2021-43797)

  - xnio: org.xnio.StreamConnection.notifyReadClosed log to debug instead of stderr (CVE-2022-0084)

  - jboss-client: memory leakage in remote client transaction (CVE-2022-0853)

  - wildfly: Wildfly management of EJB Session context returns wrong caller principal with Elytron Security     enabled (CVE-2022-0866)

  - undertow: Double AJP response for 400 from EAP 7 results in CPING failures (CVE-2022-1319)

  - OpenJDK: Infinite loop related to incorrect handling of newlines in XMLEntityScanner (JAXP, 8270646)     (CVE-2022-21299)

  - mysql-connector-java: Difficult to exploit vulnerability allows high privileged attacker with network     access via multiple protocols to compromise MySQL Connectors (CVE-2022-21363)

  - h2: Loading of custom classes from remote servers through JNDI (CVE-2022-23221)

  - xerces-j2: infinite loop when handling specially crafted XML document payloads (CVE-2022-23437)

  - artemis-commons: Apache ActiveMQ Artemis DoS (CVE-2022-23913)

  - Moment.js: Path traversal  in moment.locale (CVE-2022-24785)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
194924	Splunk Enterprise 8.1 < 8.1.13, 8.2.0 < 8.2.10, 9.0.0 < 9.0.4 (SVD-2023-0215)	Nessus	CGI abuses	high
185336	Fedora 39 : python-notebook (2023-3256575fc8)	Nessus	Fedora Local Security Checks	high
172042	RHEL 8 : Red Hat Single Sign-On 7.6.2 security update on RHEL 8 (Important) (RHSA-2023:1044)	Nessus	Red Hat Local Security Checks	critical
172041	RHEL 7 : Red Hat Single Sign-On 7.6.2 security update on RHEL 7 (Important) (RHSA-2023:1043)	Nessus	Red Hat Local Security Checks	critical
172039	RHEL 9 : Red Hat Single Sign-On 7.6.2 security update on RHEL 9 (Important) (RHSA-2023:1045)	Nessus	Red Hat Local Security Checks	critical
170880	Debian DLA-3295-1 : node-moment - LTS security update	Nessus	Debian Local Security Checks	high
170688	Nessus Network Monitor < 6.2.0 Multiple Vulnerabilities (TNS-2022-28)	Nessus	Misc.	critical
169920	RHEL 8 / 9 : Red Hat Ceph Storage 5.3 security update and Bug Fix (Moderate) (RHSA-2023:0076)	Nessus	Red Hat Local Security Checks	high
166600	Tenable Nessus 10.x < 10.3.1 Multiple Vulnerabilities (TNS-2022-20)	Nessus	Misc.	critical
164616	RHEL 8 : Red Hat OpenShift Service Mesh 2.0.11 (RHSA-2022:6272)	Nessus	Red Hat Local Security Checks	high
164615	RHEL 8 : Red Hat OpenShift Service Mesh 2.1.5 (RHSA-2022:6277)	Nessus	Red Hat Local Security Checks	high
164015	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Moment.js vulnerabilities (USN-5559-1)	Nessus	Ubuntu Local Security Checks	high
161911	RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.4.5 security update on RHEL 7 (Moderate) (RHSA-2022:4918)	Nessus	Red Hat Local Security Checks	critical
161910	RHEL 8 : Red Hat JBoss Enterprise Application Platform 7.4.5 security update on RHEL 8 (Moderate) (RHSA-2022:4919)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2022-24785

high

Tenable Plugins

high

high

critical

critical

critical

high

critical

high

critical

high

high

high

critical

critical