The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:4142 advisory.

  - jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true,     {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable
    __proto__ property, it could extend the native Object.prototype. (CVE-2019-11358)

  - In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option>     elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods     (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
    (CVE-2020-11023)

  - jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to     recognize and remove <script> HTML tags that contain a whitespace character, i.e: </script >, which     results in the enclosed script logic to be executed. (CVE-2020-7656)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Rocky Linux 8 : pcs (RLSA-2021:4142)

medium Nessus Plugin ID 184665

Version 1.2

Version 1.1

Version 1.0

Version 1.2 Jan 24, 2025, 4:21 PM CISA reference Plugin Feed: 202501241621
Version 1.1 Nov 7, 2023, 9:51 PM CEA reference Plugin Feed: 202311072151
Version 1.0 Nov 7, 2023, 2:31 AM New Plugin Feed: 202311070231