An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being included in a comment.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse     external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by     PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS     nodes (rules, properties) despite being included in a comment. (CVE-2023-44270)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-c17ef0f176 advisory.

    **phpMyAdmin 5.2.2 is released**

    Welcome to the release of phpMyAdmin version 5.2.2, the I should have released this sooner release. This     is primarily a bugfix release but also contains a few security fixes as noted below.

    *    fix possible security issue in sql-parser which could cause long execution times that could create a     DOS attack (thanks to Maximilian Krg)
    *    fix an XSS vulnerability in the check tables feature (**PMASA-2025-1**, thanks to bluebird)
    *    fix an XSS vulnerability in the Insert tab (**PMASA-2025-2**, thanks to frequent contributor Kamil     Tekiela)
    *    fix possible security issue with library code slim/psr7 (**CVE-2023-30536**)
    *    fix possible security issue relating to iconv (**CVE-2024-2961, PMASA-2025-3**)
    *    fix a full path disclosure in the Monitoring tab
    *    issue #18268 Fix UI issue the theme manager is disabled
    *    issue Allow opening server breadcrumb links in new tab with Ctrl/Meta key
    *    issue #19141 Add cookie prefix '-__Secure-' to cookies to help prevent cookie smuggling
    *    issue #18106 Fix renaming database with a view
    *    issue #18120 Fix bug with numerical tables during renaming database
    *    issue #16851 Fix ($cfg['Order']) default column order doesn't have have any effect since phpMyAdmin     4.2.0
    *    issue #18258 Speed improvements when exporting a database
    *    issue #18769 Improved collations support for MariaDB 10.10

    There are many, many more fixes that you can see in the ChangeLog file included with this release or     [online](https://github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2_2/ChangeLog)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-4b8ab3834c advisory.

    **phpMyAdmin 5.2.2 is released**

    Welcome to the release of phpMyAdmin version 5.2.2, the I should have released this sooner release. This     is primarily a bugfix release but also contains a few security fixes as noted below.

    *    fix possible security issue in sql-parser which could cause long execution times that could create a     DOS attack (thanks to Maximilian Krg)
    *    fix an XSS vulnerability in the check tables feature (**PMASA-2025-1**, thanks to bluebird)
    *    fix an XSS vulnerability in the Insert tab (**PMASA-2025-2**, thanks to frequent contributor Kamil     Tekiela)
    *    fix possible security issue with library code slim/psr7 (**CVE-2023-30536**)
    *    fix possible security issue relating to iconv (**CVE-2024-2961, PMASA-2025-3**)
    *    fix a full path disclosure in the Monitoring tab
    *    issue #18268 Fix UI issue the theme manager is disabled
    *    issue Allow opening server breadcrumb links in new tab with Ctrl/Meta key
    *    issue #19141 Add cookie prefix '-__Secure-' to cookies to help prevent cookie smuggling
    *    issue #18106 Fix renaming database with a view
    *    issue #18120 Fix bug with numerical tables during renaming database
    *    issue #16851 Fix ($cfg['Order']) default column order doesn't have have any effect since phpMyAdmin     4.2.0
    *    issue #18258 Speed improvements when exporting a database
    *    issue #18769 Improved collations support for MariaDB 10.10

    There are many, many more fixes that you can see in the ChangeLog file included with this release or     [online](https://github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2_2/ChangeLog)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse
    external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by
    PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS
    nodes (rules, properties) despite being included in a comment. (CVE-2023-44270)

The remote Debian 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-4003 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4003-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Bastien Roucaris     December 26, 2024                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : node-postcss     Version        : 8.2.1+~cs5.3.23-8+deb11u1     CVE ID         : CVE-2021-23566 CVE-2023-44270 CVE-2024-55565     Debian Bug     : 1053282

    Multiple vulnerabilities were fixed in node-postcss a     tool for transforming styles with JS plugins.

    CVE-2021-23566

        nanoid package is vulnerable to Information Exposure via the         valueOf() function which allows to reproduce the last id generated.

    CVE-2023-44270

        The vulnerability affects linters using PostCSS to parse external         untrusted CSS. An attacker can prepare CSS in such a way that it will         contains parts parsed by PostCSS as a CSS comment. After processing         by PostCSS, it will be included in the PostCSS output in CSS nodes         (rules, properties) despite being included in a comment.

    CVE-2024-55565

        nanoid package mishandles non-integer values of size parameter.

    For Debian 11 bullseye, these problems have been fixed in version     8.2.1+~cs5.3.23-8+deb11u1.

    We recommend that you upgrade your node-postcss packages.

    For the detailed security status of node-postcss please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/node-postcss

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2024-d335b971e7 advisory.

    New jupyterlab and notebook fixing security vulnerabilities.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2024-c4377d35e6 advisory.

    New jupyterlab and notebook fixing security vulnerabilities.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
227171	Linux Distros Unpatched Vulnerability : CVE-2023-44270	Nessus	Misc.	medium
214840	Fedora 40 : phpMyAdmin (2025-c17ef0f176)	Nessus	Fedora Local Security Checks	medium
214839	Fedora 41 : phpMyAdmin (2025-4b8ab3834c)	Nessus	Fedora Local Security Checks	medium
412027	SCA: security update for postcss (GHSA-7fh5-64p2-3v2j)	Tenable Cloud Security	SCA Checks	medium
412027	SCA: security update for postcss (GHSA-7fh5-64p2-3v2j)	Tenable Self-Hosted Container Security	SCA Checks	medium
213394	Debian dla-4003 : node-postcss - security update	Nessus	Debian Local Security Checks	medium
213072	Fedora 41 : jupyterlab / python-notebook (2024-d335b971e7)	Nessus	Fedora Local Security Checks	medium
213071	Fedora 40 : jupyterlab / python-notebook (2024-c4377d35e6)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2023-44270

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium