jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery. Versions prior to 1.13.2 are potentially vulnerable to cross-site scripting. Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. Calling `.checkboxradio( "refresh" )` on such a widget and the initial HTML contained encoded HTML entities will make them erroneously get decoded. This can lead to potentially executing JavaScript code. The bug has been patched in jQuery UI 1.13.2. To remediate the issue, someone who can change the initial HTML can wrap all the non-input contents of the `label` in a `span`.

According to its self-reported version, the Moodle install hosted on the remote host is prior to 3.9.23 or 3.11.x prior to 3.11.16. The JQuery UI library included with Moodle has been upgraded to version 1.13.2, which includes fixes for multiples security issues.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Oracle Siebel CRM installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2023 CPU advisory.

  - Vulnerability in the Siebel CRM product of Oracle Siebel CRM (component: EAI (JSON-java)). Supported     versions that are affected are 23.5 and prior. Easily exploitable vulnerability allows unauthenticated     attacker with network access via HTTP to compromise Siebel CRM. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Siebel     CRM. (CVE-2020-15250, CVE-2022-45688)

  - Vulnerability in the Siebel CRM product of Oracle Siebel CRM (component: Siebel Core (Apache ZooKeeper)).
    Supported versions that are affected are 23.5 and prior. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Siebel CRM. Successful attacks of this     vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete     DOS) of Siebel CRM. (CVE-2020-36518, CVE-2020-9493, CVE-2021-21295, CVE-2021-37533, CVE-2022-2048,     CVE-2022-23307, CVE-2022-41915, CVE-2022-42003, CVE-2022-42004)

  - Vulnerability in the Siebel CRM product of Oracle Siebel CRM (component: UI Framework (jQueryUI)).
    Supported versions that are affected are 23.5 and prior. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Siebel CRM. Successful attacks require     human interaction from a person other than the attacker and while the vulnerability is in Siebel CRM,     attacks may significantly impact additional products (scope change). Successful attacks of this     vulnerability can result in unauthorized update, insert or delete access to some of Siebel CRM accessible     data as well as unauthorized read access to a subset of Siebel CRM accessible data. (CVE-2022-31160)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-7291b78111 advisory.

    A flaw was found in the jquery-UI package. Affected versions of this package are vulnerable to Cross-site     scripting (XSS)  attack via the initialization of a check-box-radio widget on an input tag enclosed within     a label, leading to the parent label contents being considered as the input label.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle Business Intelligence Enterprise Edition (OAS) 6.4.0.0.0 installed on the remote host is affected by multiple vulnerabilities as referenced in the January 2024 CPU advisory, including the following:

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Analytics Server (Apache Solr)). The supported version that is affected is 6.4.0.0.0.     Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to     compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can     result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle     Business Intelligence Enterprise Edition. (CVE-2021-33813)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Visual Analyzer (Apache Ivy)). The supported version that is affected is 6.4.0.0.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in     unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise     Edition accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of     Oracle Business Intelligence Enterprise Edition. (CVE-2022-46751)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Pod Admin). Supported versions that are affected are 6.4.0.0.0 and 12.2.1.4.0. Easily     exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise     Oracle Business Intelligence Enterprise Edition. While the vulnerability is in Oracle Business     Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change).     Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle     Business Intelligence Enterprise Edition accessible data. (CVE-2024-20904)   Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle Business Intelligence Enterprise Edition 12.2.1.4 installed on the remote host is affected by multiple vulnerabilities as referenced in the January 2024 CPU advisory, including the following:

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: BI Platform Security (jQueryUI)). Supported versions that are affected are 6.4.0.0.0,     7.0.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network     access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks require     human interaction from a person other than the attacker and while the vulnerability is in Oracle Business     Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change).     Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to     some of Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized read     access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. (CVE-2022-31160)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Presentation Services (Apache Batik)). Supported versions that are affected are 6.4.0.0.0,     7.0.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to     the infrastructure where Oracle Business Intelligence Enterprise Edition executes to compromise Oracle     Business Intelligence Enterprise Edition. Successful attacks require human interaction from a person     other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to     critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data     and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Business     Intelligence Enterprise Edition. (CVE-2022-44729)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: BI Platform Security). The supported version that is affected is 12.2.1.4.0. Easily     exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise     Oracle Business Intelligence Enterprise Edition. Successful attacks require human interaction from a     person other than the attacker and while the vulnerability is in Oracle Business Intelligence Enterprise     Edition, attacks may significantly impact additional products (scope change). Successful attacks of this     vulnerability can result in unauthorized update, insert or delete access to some of Oracle Business     Intelligence Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle     Business Intelligence Enterprise Edition accessible data. (CVE-2024-20913)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle Business Intelligence Enterprise Edition (OAS) 7.0.0.0 installed on the remote host is affected by multiple vulnerabilities as referenced in the January 2024 CPU advisory, including the following:

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Installation (Google Gson)). Supported versions that are affected are 6.4.0.0.0 and     7.0.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via     HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this     vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash     (complete DOS) of Oracle Business Intelligence Enterprise Edition. (CVE-2022-25647)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Majel Mobile Service (JSON-java)). Supported versions that are affected are 6.4.0.0.0 and     7.0.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of     Oracle Business Intelligence Enterprise Edition. (CVE-2023-5072)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Visual Analyzer (Snappy)). The supported version that is affected is 7.0.0.0.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to     compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of     Oracle Business Intelligence Enterprise Edition. (CVE-2023-43642)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Oracle Business Intelligence Publisher installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2023 CPU advisory.

  - Vulnerability in the BI Publisher product of Oracle Analytics (component: Mobile Service (jQuery)). The     supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated     attacker with network access via HTTP to compromise BI Publisher. Successful attacks require human     interaction from a person other than the attacker and while the vulnerability is in BI Publisher, attacks     may significantly impact additional products (scope change). Successful attacks of this vulnerability can     result in unauthorized update, insert or delete access to some of BI Publisher accessible data as well as     unauthorized read access to a subset of BI Publisher accessible data. (CVE-2020-11023)

  - Vulnerability in the BI Publisher product of Oracle Analytics (component: Development Operations     (XStream)). The supported version that is affected is 6.4.0.0.0. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise BI Publisher. Successful attacks of     this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash     (complete DOS) of BI Publisher. (CVE-2022-31160)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Primavera Unifier installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2023 CPU advisory.

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: User     Interface (jQueryUI)). Supported versions that are affected are 19.12.0-19.12.16, 20.12.0-20.12.16,     21.12.0-21.12.16 and 22.12.0-22.12.9. Easily exploitable vulnerability allows low privileged attacker with     network access via HTTP to compromise Primavera Unifier. Successful attacks require human interaction from     a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read     access to a subset of Primavera Unifier accessible data. (CVE-2022-31160)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform     (MPXJ)). Supported versions that are affected are 19.12.0-19.12.16, 20.12.0-20.12.16, 21.12.0-21.12.16 and     22.12.0-22.12.9. Easily exploitable vulnerability allows low privileged attacker with logon to the     infrastructure where Primavera Unifier executes to compromise Primavera Unifier. Successful attacks of     this vulnerability can result in unauthorized read access to a subset of Primavera Unifier accessible     data. (CVE-2022-41954)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 ESM / 20.04 ESM / 22.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5181-1 advisory.

    It was discovered that jQuery UI did not properly validate the values from untrusted sources. An attacker     could use this vulnerability to cause a crash or possibly execute arbitrary code. This issue affected only     Ubuntu 18.04 ESM and Ubuntu 20.4 ESM. (CVE-2021-41184)

    It was discovered that jQuery UI checkboxradio widget did not properly decode certain values from HTML     entities. An attacker could possibly use this issue to generate a cross-site scripting(XSS) attack,     resulting in a crash or possibly execute arbitrary code. (CVE-2022-31160)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6419-1 advisory.

    Hong Phat Ly discovered that jQuery UI did not properly manage parameters from untrusted sources, which     could lead to arbitrary web script or HTML code injection. A remote attacker could possibly use this issue     to perform a cross-site scripting (XSS) attack. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04     LTS. (CVE-2016-7103)

    Esben Sparre Andreasen discovered that jQuery UI did not properly handle values from untrusted sources in     the Datepicker widget. A remote attacker could possibly use this issue to perform a cross-site scripting     (XSS) attack and execute arbitrary code. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS,     Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-41182, CVE-2021-41183)

    It was discovered that jQuery UI did not properly validate values from untrusted sources. An attacker     could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only     affected Ubuntu 20.04 LTS. (CVE-2021-41184)

    It was discovered that the jQuery UI checkboxradio widget did not properly decode certain values from HTML     entities. An attacker could possibly use this issue to perform a cross-site scripting (XSS) attack and     cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 20.04 LTS.
    (CVE-2022-31160)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Nessus Network Monitor running on the remote host is prior to 6.2.2. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2023-23 advisory. Several of the third-party components were found to contain vulnerabilities, and updated versions have been made available by the providers. Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues. Nessus Network Monitor 6.2.2 updates the following components:

  - c-ares from version 1.10.0 to version 1.19.1.
  - curl from version 7.79.1 to version 8.1.2.
  - libbzip2 from version 1.0.6 to version 1.0.8.
  - libpcre from version 8.42 to version 8.44.
  - libxml2 from version 2.7.7 to version 2.11.1.
  - libxslt from version 1.1.26 to version 1.1.37.
  - libxmlsec from version 1.2.18 to version 1.2.37.
  - sqlite from version 3.27.2 to version 3.40.1.
  - jQuery Cookie from version 1.3.1 to version 1.4.1.
  - jQuery UI from version 1.13.0 to version 1.13.2.
  - OpenSSL from version 3.0.8 to version 3.0.9.

The versions of Oracle Business Intelligence Enterprise Edition (OBIEE) (OAS) installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2023 CPU advisory.

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Analytics Server (Apache Commons BeanUtils)). The supported version that is affected is     6.4.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability     can result in unauthorized update, insert or delete access to some of Oracle Business Intelligence     Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Business     Intelligence Enterprise Edition accessible data and unauthorized ability to cause a partial denial of     service (partial DOS) of Oracle Business Intelligence Enterprise Edition. (CVE-2019-10086)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Analytics Server (zlib)). The supported version that is affected is 6.4.0.0.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in     takeover of Oracle Business Intelligence Enterprise Edition. (CVE-2022-37434)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: BI Application Archive (Apache Commons Text)). The supported version that is affected is     6.4.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability     can result in takeover of Oracle Business Intelligence Enterprise Edition. (CVE-2022-42889)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of MySQL Enterprise Monitor installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2023 CPU advisory.

  - Vulnerability in the MySQL Workbench product of Oracle MySQL (component: Workbench (OpenSSL)). Supported     versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows unauthenticated     attacker with network access via MySQL Workbench to compromise MySQL Workbench. Successful attacks of this     vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete     DOS) of MySQL Workbench. (CVE-2023-0215)

  - Vulnerability in the Oracle SD-WAN Edge product of Oracle Communications (component: Internal tools     (Apache Tomcat)). The supported version that is affected is 9.1.1.4.0. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Oracle SD-WAN Edge. Successful     attacks of this vulnerability can result in unauthorized creation, deletion or modification access to     critical data or all Oracle SD-WAN Edge accessible data. (CVE-2022-45143)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console     (jQueryUI)). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Difficult to exploit     vulnerability allows high privileged attacker with logon to the infrastructure where Oracle WebLogic     Server executes to compromise Oracle WebLogic Server. While the vulnerability is in Oracle WebLogic     Server, attacks may significantly impact additional products (scope change). Successful attacks of this     vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebLogic Server     accessible data as well as unauthorized read access to a subset of Oracle WebLogic Server accessible data.
    (CVE-2022-31160)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle WebLogic Server installed on the remote host is missing a security patch from the April 2023 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilities, including:

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console     (Apache Commons FileUpload)). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and     14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized     ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server.
    (CVE-2023-24998)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Samples     (XStream)). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic     Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of Oracle WebLogic Server. (CVE-2022-40152)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Third Party     (Apache Commons Compress)). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server. (CVE-2021-36090)

  Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, jQuery UI is prior to 1.13.2. It is, therefore, affected by a Cross-Site Scripting when refreshing a checkboxradio with an HTML-like initial text label (CVE-2022-31160)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-1a01ed37e2 advisory.

    A flaw was found in the jquery-UI package. Affected versions of this package are vulnerable to Cross-site     scripting (XSS)  attack via the initialization of a check-box-radio widget on an input tag enclosed within     a label, leading to the parent label contents being considered as the input label.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 35 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-22d8ba36d0 advisory.

    A flaw was found in the jquery-UI package. Affected versions of this package are vulnerable to Cross-site     scripting (XSS)  attack via the initialization of a check-box-radio widget on an input tag enclosed within     a label, leading to the parent label contents being considered as the input label.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3230 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3230-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Utkarsh Gupta     December 07, 2022                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : jqueryui     Version        : 1.12.1+dfsg-5+deb10u1     CVE ID         : CVE-2021-41182 CVE-2021-41183 CVE-2021-41184                      CVE-2022-31160     Debian Bug     : 1015982

    jQuery-UI, the official jQuery user interface library, is a curated set     of user interface interactions, effects, widgets, and themes built on top     of jQuery were reported to have the following vulnerabilities.

    CVE-2021-41182

        jQuery-UI was accepting the value of the `altField` option of the         Datepicker widget from untrusted sources may execute untrusted code.
        This has been fixed and now any string value passed to the `altField`         option is now treated as a CSS selector.

    CVE-2021-41183

        jQuery-UI was accepting the value of various `*Text` options of the         Datepicker widget from untrusted sources may execute untrusted code.
        This has been fixed and now the values passed to various `*Text`         options are now always treated as pure text, not HTML.

    CVE-2021-41184

        jQuery-UI was accepting the value of the `of` option of the         `.position()` util from untrusted sources may execute untrusted code.
        This has been fixed and now any string value passed to the `of`         option is now treated as a CSS selector.

    CVE-2022-31160

        jQuery-UI was potentially vulnerable to cross-site scripting.
        Initializing a checkboxradio widget on an input enclosed within a         label makes that parent label contents considered as the input label.
        Calling `.checkboxradio( refresh )` on such a widget and the initial         HTML contained encoded HTML entities will make them erroneously get         decoded. This can lead to potentially executing JavaScript code.

    For Debian 10 buster, these problems have been fixed in version     1.12.1+dfsg-5+deb10u1.

    We recommend that you upgrade your jqueryui packages.

    For the detailed security status of jqueryui please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/jqueryui

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Tenable Nessus application running on the remote host is 10.x prior to 10.4.0. It is, therefore, affected by multiple vulnerabilities, including:

  - An authenticated attacker could utilize the identical agent and cluster node linking keys to potentially allow for a     scenario where unauthorized disclosure of agent logs and data is present. (CVE-2022-3499)   
  - An authenticated attacker could modify the client-side behavior to bypass the protection mechanisms resulting in     potentially unexpected interactions between the client and server. (CVE-2022-3498)

  - Cross-site scripting in the checkboxradio widget in JQuery UI. (CVE-2022-31160)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

The version of JQuery UI library hosted on the remote web server is prior to 1.13.2. It is, therefore, affected by a cross-site scripting vulnerability in the JQuery UI that allows remote attackers to inject arbitrary web script or HTML via processing the value of a compromised checkboxradio widget.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
114747	Moodle < 3.9.23 JQuery UI Library Upgrade	Web App Scanning	Component Vulnerability	medium
114746	Moodle 3.11.x < 3.11.16 JQuery UI Library Upgrade	Web App Scanning	Component Vulnerability	medium
212439	Oracle Siebel Server <= 23.5 (July 2023 CPU)	Nessus	Misc.	critical
211314	Fedora 37 : js-jquery-ui (2022-7291b78111)	Nessus	Fedora Local Security Checks	medium
189734	Oracle Business Intelligence Enterprise Edition (OAS 6.4) (January 2024 CPU)	Nessus	Misc.	high
189733	Oracle Business Intelligence Enterprise Edition (January 2024 CPU)	Nessus	Misc.	high
189732	Oracle Business Intelligence Enterprise Edition (OAS 7.0) (January 2024 CPU)	Nessus	Misc.	high
183413	Oracle Business Intelligence Publisher (October 2023 CPU)	Nessus	Misc.	medium
183393	Oracle Primavera Unifier (October 2023 CPU)	Nessus	CGI abuses	medium
183120	Ubuntu 18.04 ESM / 20.04 ESM / 22.04 ESM : jQuery UI vulnerability (USN-5181-1)	Nessus	Ubuntu Local Security Checks	medium
182583	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS : jQuery UI vulnerabilities (USN-6419-1)	Nessus	Ubuntu Local Security Checks	medium
177842	Nessus Network Monitor < 6.2.2 Multiple Vulnerabilities (TNS-2023-23)	Nessus	Misc.	critical
174743	Oracle Business Intelligence Enterprise Edition (OAS) (Apr 2023 CPU)	Nessus	Misc.	critical
174528	Oracle MySQL Enterprise Monitor (Apr 2023 CPU)	Nessus	CGI abuses	high
174464	Oracle WebLogic Server (Apr 2023 CPU)	Nessus	Misc.	high
113672	jQuery UI < 1.13.2 Cross-Site Scripting	Web App Scanning	Component Vulnerability	medium
169132	Fedora 36 : js-jquery-ui (2022-1a01ed37e2)	Nessus	Fedora Local Security Checks	medium
169086	Fedora 35 : js-jquery-ui (2022-22d8ba36d0)	Nessus	Fedora Local Security Checks	medium
168485	Debian dla-3230 : libjs-jquery-ui - security update	Nessus	Debian Local Security Checks	medium
166670	Tenable Nessus 10.x < 10.4.0 Multiple Vulnerabilities (TNS-2022-21)	Nessus	Misc.	medium
163599	JQuery UI < 1.13.2 XSS	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2022-31160

medium

Tenable Plugins

medium

medium

critical

medium

high

high

high

medium

medium

medium

medium

critical

critical

high

high

medium

medium

medium

medium

medium

medium