The version of Firefox installed on the remote macOS or Mac OS X host is prior to 100.0.2. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-19 advisory.

  - If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution,     they could have achieved execution of attacker-controlled JavaScript code in a privileged context.
    (CVE-2022-1802)

  - An attacker could have sent a message to the parent process where the contents were used to double-index     into a JavaScript object, leading to prototype pollution and ultimately attacker-controlled JavaScript     executing in the privileged parent process. (CVE-2022-1529)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 91.9.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-19 advisory.

  - If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution,     they could have achieved execution of attacker-controlled JavaScript code in a privileged context.
    (CVE-2022-1802)

  - An attacker could have sent a message to the parent process where the contents were used to double-index     into a JavaScript object, leading to prototype pollution and ultimately attacker-controlled JavaScript     executing in the privileged parent process. (CVE-2022-1529)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 91.9.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-19 advisory.

  - If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution,     they could have achieved execution of attacker-controlled JavaScript code in a privileged context.
    (CVE-2022-1802)

  - An attacker could have sent a message to the parent process where the contents were used to double-index     into a JavaScript object, leading to prototype pollution and ultimately attacker-controlled JavaScript     executing in the privileged parent process. (CVE-2022-1529)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is running a version of macOS / Mac OS X that is 12.x prior to 12.4 Monterey. It is, therefore, affected by multiple vulnerabilities :

  - Exploitation of this vulnerability may lead to memory corruption issue. (CVE-2018-25032)

  - A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser. (CVE-2021-44790)

  - Exploitation of this vulnerability may lead to arbitrary code execution. (CVE-2021-45444)

Note that Nessus has not tested for this issue but has instead relied only on the operating system's self-reported version number.

The remote host is running a version of macOS / Mac OS X that is prior to Catalina Security Update 2022-004.
It is, therefore, affected by multiple vulnerabilities :

  - zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many     distant matches. (CVE-2018-25032)

  - A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL     pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for     requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This     issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included). (CVE-2021-44224)

  - A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser     (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the     vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and     earlier. (CVE-2021-44790)

  - In zsh before 5.8.1, an attacker can achieve code execution if they control a command output inside the     prompt, as demonstrated by a %F argument. This occurs because of recursive PROMPT_SUBST expansion.
    (CVE-2021-45444)

  - A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local     string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially     crafted zip file, leading to a crash or code execution. (CVE-2022-0530)

  - The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop     forever for non-prime moduli. Internally this function is used when parsing certificates that contain     elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point     encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has     invalid explicit curve parameters. Since certificate parsing happens prior to verification of the     certificate signature, any process that parses an externally supplied certificate may thus be subject to a     denial of service attack. The infinite loop can also be reached when parsing crafted private keys as they     can contain explicit elliptic curve parameters. Thus vulnerable situations include: - TLS clients     consuming server certificates - TLS servers consuming client certificates - Hosting providers taking     certificates or private keys from customers - Certificate authorities parsing certification requests from     subscribers - Anything else which parses ASN.1 elliptic curve parameters Also any other applications that     use the BN_mod_sqrt() where the attacker can control the parameter values are vulnerable to this DoS     issue. In the OpenSSL 1.0.2 version the public key is not parsed during initial parsing of the certificate     which makes it slightly harder to trigger the infinite loop. However any operation which requires the     public key from the certificate will trigger the infinite loop. In particular the attacker can use a self-     signed certificate to trigger the loop during verification of the certificate signature. This issue     affects OpenSSL versions 1.0.2, 1.1.1 and 3.0. It was addressed in the releases of 1.1.1n and 3.0.2 on the     15th March 2022. Fixed in OpenSSL 3.0.2 (Affected 3.0.0,3.0.1). Fixed in OpenSSL 1.1.1n (Affected     1.1.1-1.1.1m). Fixed in OpenSSL 1.0.2zd (Affected 1.0.2-1.0.2zc). (CVE-2022-0778)

  - A validation issue was addressed with improved input sanitization. This issue is fixed in iOS 15.3 and     iPadOS 15.3, watchOS 8.4, tvOS 15.3, Safari 15.3, macOS Monterey 12.2. Processing a maliciously crafted     mail message may lead to running arbitrary javascript. (CVE-2022-22589)

  - A logic issue was addressed with improved validation. This issue is fixed in macOS Monterey 12.3. A     malicious application may be able to gain root privileges. (CVE-2022-22665)

  - A carefully crafted request body can cause a read to a random memory area which could cause the process to     crash. This issue affects Apache HTTP Server 2.4.52 and earlier. (CVE-2022-22719)

  - Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered     discarding the request body, exposing the server to HTTP Request Smuggling (CVE-2022-22720)

  - If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems     an integer overflow happens which later causes out of bounds writes. This issue affects Apache HTTP Server     2.4.52 and earlier. (CVE-2022-22721)

  - valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes. (CVE-2022-23308)

Note that Nessus has not tested for this issue but has instead relied only on the operating system's self-reported version number.

The remote host is running a version of macOS / Mac OS X that is 11.x prior to 11.6.6 Big Sur. It is, therefore, affected by multiple vulnerabilities including the following:

  - A logic issue in AppKit that may allow a malicious application to gain root privileges. (CVE-2022-22665)

  - A logic issue in Apache HTTP Server where it fails to close an inbound connection when errors are encountered     discarding the request body, exposing the server to HTTP Request Smuggling. (CVE-2022-22720)

  - A buffer overflow issue in the mod_lua component of Apache HTTP Server. (CVE-2021-44790)

Note that Nessus has not tested for this issue but has instead relied only on the operating system's self-reported version number.

Adobe InCopy is installed on the remote macOS host.

The Microsoft Visual Studio Products installed on the remote macOS or Mac OS X host is missing a security update. It is, therefore, affected by denial of service vulnerability:

  - A denial of service (DoS) vulnerability exists in Microsoft Visual Studio 2019. An unauthenticated,     remote attacker can exploit this issue to cause the application to stop responding.     (CVE-2022-29145, CVE-2022-23267)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version

The version of Google Chrome installed on the remote macOS host is prior to 101.0.4951.64. It is, therefore, affected by multiple vulnerabilities as referenced in the 2022_05_stable-channel-update-for-desktop_10 advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Adobe Creative Cloud installed on the remote macOS host is prior to 2.5. It is, therefore, affected by multiple vulnerabilities as referenced in the apsb21-41 advisory.

  - Adobe Creative Cloud Desktop Application (installer) version 2.4 (and earlier) is affected by an     Uncontrolled Search Path Element vulnerability. An unauthenticated attacker could leverage this     vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this     issue requires user interaction in that a victim must open a malicious file. (CVE-2021-28594)

  - Adobe Creative Cloud Desktop Application (installer) version 2.4 (and earlier) is affected by an Insecure     temporary file creation vulnerability. An attacker could leverage this vulnerability to cause arbitrary     file overwriting in the context of the current user. Exploitation of this issue requires physical     interaction to the system. (CVE-2021-28633)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 91.9. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-18 advisory.

  - When viewing an email message A, which contains an attached message B, where B is encrypted or digitally     signed or both, Thunderbird may show an incorrect encryption or signature status. After opening and     viewing the attached message B, when returning to the display of message A, the message A might be shown     with the security status of message B. (CVE-2022-1520)

  - When reusing existing popups Thunderbird would allow them to cover the fullscreen notification UI, which     could enable browser spoofing attacks. (CVE-2022-29914)

  - Documents in deeply-nested cross-origin browsing contexts could obtain permissions granted to the top-     level origin, bypassing the existing prompt and wrongfully inheriting the top-level permissions.
    (CVE-2022-29909)

  - Thunderbird would behave slightly differently for already known resources, when loading CSS resources     through resolving CSS variables. This could be used to probe the browser history. (CVE-2022-29916)

  - Thunderbird did not properly protect against top-level navigations for iframe sandbox with a policy     relaxed through a keyword like <code>allow-top-navigation-by-user-activation</code>. (CVE-2022-29911)

  - Requests initiated through reader mode did not properly omit cookies with a SameSite attribute.
    (CVE-2022-29912)

  - The parent process would not properly check whether the Speech Synthesis feature is enabled, when     receiving instructions from a child process. (CVE-2022-29913)

  - Mozilla developers Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team reported memory safety bugs     present in Thunderbird 91.8. Some of these bugs showed evidence of memory corruption and we presume that     with enough effort some of these could have been exploited to run arbitrary code. (CVE-2022-29917)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Splunk is installed on the remote macOS host.

According to its self-reported version number, the version of Splunk running on the remote web server is Splunk Enterprise 8.1.x prior to 8.1.7.2 or 8.2.x prior to 8.2.3.3. It may, therefore, be affected by the following vulnerabilities related to the use of Log4j, as follows:

  - Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI     features used in configuration, log messages, and parameters do not protect against attacker controlled     LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters     can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From     log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3,     and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to     log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.
    (CVE-2021-44228)

  - It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain     non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input     data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for     example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input     data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some     environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix     this issue by removing support for message lookup patterns and disabling JNDI functionality by default.
    (CVE-2021-45046)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 91.9. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-17 advisory.

  - When reusing existing popups Firefox would have allowed them to cover the fullscreen notification UI,     which could have enabled browser spoofing attacks. (CVE-2022-29914)

  - Documents in deeply-nested cross-origin browsing contexts could have obtained permissions granted to the     top-level origin, bypassing the existing prompt and wrongfully inheriting the top-level permissions.
    (CVE-2022-29909)

  - Firefox behaved slightly differently for already known resources when loading CSS resources involving CSS     variables. This could have been used to probe the browser history. (CVE-2022-29916)

  - Firefox did not properly protect against top-level navigations for an iframe sandbox with a policy relaxed     through a keyword like <code>allow-top-navigation-by-user-activation</code>. (CVE-2022-29911)

  - Requests initiated through reader mode did not properly omit cookies with a SameSite attribute.
    (CVE-2022-29912)

  - Mozilla developers Andrew McCreight, Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team reported     memory safety bugs present in Firefox 99 and Firefox ESR 91.8. Some of these bugs showed evidence of     memory corruption and we presume that with enough effort some of these could have been exploited to run     arbitrary code. (CVE-2022-29917)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 100.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-16 advisory.

  - When reusing existing popups Firefox would have allowed them to cover the fullscreen notification UI,     which could have enabled browser spoofing attacks. (CVE-2022-29914)

  - Documents in deeply-nested cross-origin browsing contexts could have obtained permissions granted to the     top-level origin, bypassing the existing prompt and wrongfully inheriting the top-level permissions.
    (CVE-2022-29909)

  - Firefox behaved slightly differently for already known resources when loading CSS resources involving CSS     variables. This could have been used to probe the browser history. (CVE-2022-29916)

  - Firefox did not properly protect against top-level navigations for an iframe sandbox with a policy relaxed     through a keyword like <code>allow-top-navigation-by-user-activation</code>. (CVE-2022-29911)

  - Requests initiated through reader mode did not properly omit cookies with a SameSite attribute.
    (CVE-2022-29912)

  - When closed or sent to the background, Firefox for Android would not properly record and persist HSTS     settings. Note: This issue only affected Firefox for Android. Other operating systems are unaffected.
    (CVE-2022-29910)

  - The Performance API did not properly hide the fact whether a request cross-origin resource has observed     redirects. (CVE-2022-29915)

  - Mozilla developers Andrew McCreight, Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team reported     memory safety bugs present in Firefox 99 and Firefox ESR 91.8. Some of these bugs showed evidence of     memory corruption and we presume that with enough effort some of these could have been exploited to run     arbitrary code. (CVE-2022-29917)

  - Mozilla developers Gabriele Svelto, Randell Jesup and the Mozilla Fuzzing Team reported memory safety bugs     present in Firefox 99. Some of these bugs showed evidence of memory corruption and we presume that with     enough effort some of these could have been exploited to run arbitrary code. (CVE-2022-29918)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote macOS host is prior to 101.0.4951.41. It is, therefore, affected by multiple vulnerabilities as referenced in the 2022_04_stable-channel-update-for-desktop_26 advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Adobe After Effects is installed on the remote macOS or Mac OS X host.

Adobe ColdFusion is installed on the remote macOS or Mac OS X host.

The Microsoft Visual Studio Products installed on the remote macOS or Mac OS X host is missing a security update. It is, therefore, affected by multiple vulnerabilities including the following:

  - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges.     (CVE-2022-24513)

  - A buffer overflow vulnerability. An attacker can exploit this to trigger crash in the system.     (CVE-2020-8927)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version

The version of Google Chrome installed on the remote macOS host is prior to 100.0.4896.127. It is, therefore, affected by a vulnerability as referenced in the 2022_04_stable-channel-update-for-desktop_14 advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Microsoft Office product installed on the remote host is missing security updates. It is, therefore, affected by two remote code execution vulnerabilities in Excel.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Adobe Photoshop installed on the remote macOS or Mac OS X host is prior to 22.5.7/23.3. It is, therefore, affected by multiple vulnerabilities as referenced in the apsb22-20 advisory.

  - Adobe Photoshop versions 22.5.6 (and earlier)and 23.2.2 (and earlier) are affected by an out-of-bounds     write vulnerability that could result in arbitrary code execution in the context of the current user.
    Exploitation of this issue requires user interaction in that a victim must open a malicious file.
    (CVE-2022-23205)

  - Adobe Photoshop versions 22.5.6 (and earlier)and 23.2.2 (and earlier) are affected by an improper input     validation vulnerability when parsing a PCX file that could result in arbitrary code execution in the     context of the current user. Exploitation of this issue requires user interaction in that a victim must     open a malicious PCX file. (CVE-2022-24098)

  - Adobe Photoshop versions 22.5.6 (and earlier)and 23.2.2 (and earlier) are affected by an out-of-bounds     write vulnerability that could result in arbitrary code execution in the context of the current user.
    Exploitation of this issue requires user interaction in that a victim must open a malicious U3D file.
    (CVE-2022-24105)

  - Adobe Photoshop versions 22.5.6 (and earlier) and 23.2.2 (and earlier) are affected by an out-of-bounds     write vulnerability that could result in arbitrary code execution in the context of the current user.
    Exploitation of this issue requires user interaction in that a victim must open a malicious SVG file.
    (CVE-2022-28270)

  - Adobe Photoshop versions 22.5.6 (and earlier)and 23.2.2 (and earlier) are affected by a use-after-free     vulnerability that could result in arbitrary code execution in the context of the current user.
    Exploitation of this issue requires user interaction in that a victim must open a malicious PDF file.
    (CVE-2022-28271)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Adobe Reader installed on the remote macOS host is a version prior to 17.012.30227, 17.012.30229, 20.005.30331, 20.005.30331, 20.005.30334, 20.005.30334, 22.001.20112, or 22.001.20117. It is, therefore, affected by multiple vulnerabilities.

  - Acrobat Reader DC ActiveX Control versions 21.007.20099 (and earlier), 20.004.30017 (and earlier) and     17.011.30204 (and earlier) are affected by an Information Disclosure vulnerability. An unauthenticated     attacker could leverage this vulnerability to obtain NTLMv2 credentials. Exploitation of this issue     requires user interaction in that a victim must visit an attacker controlled web page. (CVE-2021-44702)

  - Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and     earlier) are affected by a use-after-free vulnerability in the processing of Format event actions that     could result in arbitrary code execution in the context of the current user. Exploitation of this issue     requires user interaction in that a victim must open a malicious file. (CVE-2021-44706, CVE-2021-45064)

  - Acrobat Reader DC ActiveX Control versions 21.007.20099 (and earlier), 20.004.30017 (and earlier) and     17.011.30204 (and earlier) are affected by an Information Disclosure vulnerability. An unauthenticated     attacker could leverage this vulnerability to obtain NTLMv2 credentials. Exploitation of this issue     requires user interaction in that a victim must open a maliciously crafted Microsoft Office file, or visit     an attacker controlled web page. (CVE-2021-44739)

  - Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and     earlier) are affected by an Access of Memory Location After End of Buffer vulnerability that could lead to     disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such     as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
    (CVE-2021-45067)

  - Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and     earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code     execution in the context of the current user. Exploitation of this issue requires user interaction in that     a victim must open a malicious font file. (CVE-2022-24091, CVE-2022-24092)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Adobe Acrobat installed on the remote macOS host is a version prior to 17.012.30227, 17.012.30229, 20.005.30331, 20.005.30331, 20.005.30334, 20.005.30334, 22.001.20112, or 22.001.20117. It is, therefore, affected by multiple vulnerabilities.

  - Acrobat Reader DC ActiveX Control versions 21.007.20099 (and earlier), 20.004.30017 (and earlier) and     17.011.30204 (and earlier) are affected by an Information Disclosure vulnerability. An unauthenticated     attacker could leverage this vulnerability to obtain NTLMv2 credentials. Exploitation of this issue     requires user interaction in that a victim must visit an attacker controlled web page. (CVE-2021-44702)

  - Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and     earlier) are affected by a use-after-free vulnerability in the processing of Format event actions that     could result in arbitrary code execution in the context of the current user. Exploitation of this issue     requires user interaction in that a victim must open a malicious file. (CVE-2021-44706, CVE-2021-45064)

  - Acrobat Reader DC ActiveX Control versions 21.007.20099 (and earlier), 20.004.30017 (and earlier) and     17.011.30204 (and earlier) are affected by an Information Disclosure vulnerability. An unauthenticated     attacker could leverage this vulnerability to obtain NTLMv2 credentials. Exploitation of this issue     requires user interaction in that a victim must open a maliciously crafted Microsoft Office file, or visit     an attacker controlled web page. (CVE-2021-44739)

  - Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and     earlier) are affected by an Access of Memory Location After End of Buffer vulnerability that could lead to     disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such     as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
    (CVE-2021-45067)

  - Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and     earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code     execution in the context of the current user. Exploitation of this issue requires user interaction in that     a victim must open a malicious font file. (CVE-2022-24091, CVE-2022-24092)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote macOS host is prior to 100.0.4896.88. It is, therefore, affected by multiple vulnerabilities as referenced in the 2022_04_stable-channel-update-for-desktop_11 advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

HCL BigFix Client (formerly IBM BigFix, IBM Endpoint Manager, Tivoli Endpoint Manager (TEM)) was detected on the remote macOS host.

The remote host is running a version of macOS / Mac OS X that is 12.x prior to 12.3.1 Monterey. It is, therefore, affected by multiple vulnerabilities :

  - An out-of-bounds read issue may lead to the disclosure of kernel memory and was addressed with improved input     validation. (CVE-2022-22674)

  - An out-of-bounds write issue was addressed with improved bounds checking. (CVE-2022-22675)

Note that Nessus has not tested for this issue but has instead relied only on the operating system's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 91.8. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-15 advisory.

  - <code>NSSToken</code> objects were referenced via direct points, and could have been accessed in an unsafe     way on different threads, leading to a use-after-free and potentially exploitable crash. (CVE-2022-1097)

  - If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to     the parent process, an out of bounds write would have occurred leading to memory corruption and a     potentially exploitable crash. (CVE-2022-28281)

  - When importing a revoked key that specified key compromise as the revocation reason, Thunderbird did not     update the existing copy of the key that was not yet revoked, and the existing key was kept as non-     revoked. Revocation statements that used another revocation reason, or that didn't specify a revocation     reason, were unaffected. (CVE-2022-1197)

  - After a VR Process is destroyed, a reference to it may have been retained and used, leading to a use-     after-free and potentially exploitable crash. (CVE-2022-1196)

  - By using a link with <code>rel=localization</code> a use-after-free could have been triggered by     destroying an object during JavaScript execution and then referencing the object through a freed pointer,     leading to a potential exploitable crash. (CVE-2022-28282)

  - When generating the assembly code for <code>MLoadTypedArrayElementHole</code>, an incorrect AliasSet was     used. In conjunction with another vulnerability this could have been used for an out of bounds memory     read. (CVE-2022-28285)

  - Due to a layout change, iframe contents could have been rendered outside of its border. This could have     led to user confusion or spoofing attacks. (CVE-2022-28286)

  - The rust regex crate did not properly prevent crafted regular expressions from taking an arbitrary amount     of time during parsing. If an attacker was able to supply input to this crate, they could have caused a     denial of service in the browser. (CVE-2022-24713)

  - Mozilla developers and community members Nika Layzell, Andrew McCreight, Gabriele Svelto, and the Mozilla     Fuzzing Team reported memory safety bugs present in Thunderbird 91.7. Some of these bugs showed evidence     of memory corruption and we presume that with enough effort some of these could have been exploited to run     arbitrary code. (CVE-2022-28289)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 99.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-13 advisory.

  - <code>NSSToken</code> objects were referenced via direct points, and could have been accessed in an unsafe     way on different threads, leading to a use-after-free and potentially exploitable crash. (CVE-2022-1097)

  - If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to     the parent process, an out of bounds write would have occurred leading to memory corruption and a     potentially exploitable crash. (CVE-2022-28281)

  - By using a link with <code>rel=localization</code> a use-after-free could have been triggered by     destroying an object during JavaScript execution and then referencing the object through a freed pointer,     leading to a potentially exploitable crash. (CVE-2022-28282)

  - The sourceMapURL feature in devtools was missing security checks that would have allowed a webpage to     attempt to include local files or other files that should have been inaccessible. (CVE-2022-28283)

  - SVG's <code><use></code> element could have been used to load unexpected content that could have     executed script in certain circumstances. While the specification seems to allow this, other browsers do     not, and web developers relied on this property for script security so gecko's implementation was aligned     with theirs. (CVE-2022-28284)

  - When generating the assembly code for <code>MLoadTypedArrayElementHole</code>, an incorrect AliasSet was     used. In conjunction with another vulnerability this could have been used for an out of bounds memory     read. (CVE-2022-28285)

  - Due to a layout change, iframe contents could have been rendered outside of its border. This could have     led to user confusion or spoofing attacks. (CVE-2022-28286)

  - In unusual circumstances, selecting text could cause text selection caching to behave incorrectly, leading     to a crash. (CVE-2022-28287)

  - The rust regex crate did not properly prevent crafted regular expressions from taking an arbitrary amount     of time during parsing. If an attacker was able to supply input to this crate, they could have caused a     denial of service in the browser. (CVE-2022-24713)

  - Mozilla developers and community members Nika Layzell, Andrew McCreight, Gabriele Svelto, and the Mozilla     Fuzzing Team reported memory safety bugs present in Firefox 98 and Firefox ESR 91.7. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. (CVE-2022-28289)

  - Mozilla developers and community members Randell Jesup, Sebastian Hengst, and the Mozilla Fuzzing Team     reported memory safety bugs present in Firefox 98. Some of these bugs showed evidence of memory corruption     and we presume that with enough effort some of these could have been exploited to run arbitrary code.
    (CVE-2022-28288)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 91.8. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-14 advisory.

  - <code>NSSToken</code> objects were referenced via direct points, and could have been accessed in an unsafe     way on different threads, leading to a use-after-free and potentially exploitable crash. (CVE-2022-1097)

  - If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to     the parent process, an out of bounds write would have occurred leading to memory corruption and a     potentially exploitable crash. (CVE-2022-28281)

  - After a VR Process is destroyed, a reference to it may have been retained and used, leading to a use-     after-free and potentially exploitable crash. (CVE-2022-1196)

  - By using a link with <code>rel=localization</code> a use-after-free could have been triggered by     destroying an object during JavaScript execution and then referencing the object through a freed pointer,     leading to a potential exploitable crash. (CVE-2022-28282)

  - When generating the assembly code for <code>MLoadTypedArrayElementHole</code>, an incorrect AliasSet was     used. In conjunction with another vulnerability this could have been used for an out of bounds memory     read. (CVE-2022-28285)

  - Due to a layout change, iframe contents could have been rendered outside of its border. This could have     led to user confusion or spoofing attacks. (CVE-2022-28286)

  - The rust regex crate did not properly prevent crafted regular expressions from taking an arbitrary amount     of time during parsing. If an attacker was able to supply input to this crate, they could have caused a     denial of service in the browser. (CVE-2022-24713)

  - Mozilla developers and community members Nika Layzell, Andrew McCreight, Gabriele Svelto, and the Mozilla     Fuzzing Team reported memory safety bugs present in Firefox 98 and Firefox ESR 91.7. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. (CVE-2022-28289)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote macOS host is prior to 100.0.4896.75. It is, therefore, affected by a vulnerability as referenced in the 2022_04_stable-channel-update-for-desktop advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote macOS host is prior to 100.0.4896.60. It is, therefore, affected by multiple vulnerabilities as referenced in the 2022_03_stable-channel-update-for-desktop_29 advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote macOS host is prior to 99.0.4844.84. It is, therefore, affected by a vulnerability as referenced in the 2022_03_stable-channel-update-for-desktop_25 advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Microsoft Office product installed on the remote host is missing security updates. It is, therefore, affected by a tampering vulnerability in Microsoft Office Word.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is running a version of macOS / Mac OS X that is 12.x prior to 12.3 Monterey. It is, therefore, affected by multiple vulnerabilities, including the following:
  - A use after free issue was addressed with improved memory management. Successful exploitation could   result in arbitrary code execution with kernel privileges (CVE-2022-22614). 

  - A logic issue was addressed with improved state management. Successful exploitation could result in   privilege escalation (CVE-2022-22632).

  - A null pointer dereference was addressed with improved validation. Successful exploitation could   result in a denial of service condition. (CVE-2022-22638).

Note that Nessus has not tested for this issue but has instead relied only on the operating system's self-reported version number.

The remote host is running a version of macOS / Mac OS X that is 11.x prior to 11.6.5 Big Sur. It is, therefore, affected by multiple vulnerabilities including the following:

  - Opening a maliciously crafted PDF file may lead to an unexpected application termination or arbitrary code     execution. (CVE-2022-22633)

  - Processing a maliciously crafted AppleScript binary may result in unexpected application termination or     disclosure of process memory. (CVE-2022-22626, CVE-2022-22627)

  - A local attacker may be able to view the previous logged in user's desktop from the fast user switching     screen. (CVE-2022-22579)

Note that Nessus has not tested for this issue but has instead relied only on the operating system's self-reported version number.

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 3.6.2. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-3.6.2 advisory.

  - Infinite loop in RTMPT protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of     service via packet injection or crafted capture file (CVE-2022-0586)

  - Large loops in multiple protocol dissectors in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allow denial     of service via packet injection or crafted capture file (CVE-2022-0585)

  - Crash in the PVFS protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of     service via packet injection or crafted capture file (CVE-2022-0583)

  - Unaligned access in the CSN.1 protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows     denial of service via packet injection or crafted capture file (CVE-2022-0582)

  - Crash in the CMS protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of     service via packet injection or crafted capture file (CVE-2022-0581)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apple iTunes U installed on the remote iOS host is prior to 3.8.3. It is, therefore, affected by a vulnerability as referenced in the HT212809 advisory.

  - ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by     the CVE program. Notes: none. (CVE-2021-30862)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is running a version of macOS / Mac OS X that is prior to Catalina Security Update 2022-003 Catalina. It is, therefore, affected by multiple vulnerabilities :

  - An application may be able to gain elevated privileges (CVE-2022-22617, CVE-2022-22631)

  - An application may be able to read restricted memory (CVE-2022-22648)

  - Processing a maliciously crafted AppleScript binary may result in unexpected application termination or     disclosure of process memory (CVE-2022-22625, CVE-2022-22626, CVE-2022-22627)

  - Processing a maliciously crafted file may lead to arbitrary code execution (CVE-2022-22597)

  - A maliciously crafted ZIP archive may bypass Gatekeeper checks (CVE-2022-22616)

  - An application may be able to execute arbitrary code with kernel privileges (CVE-2022-22613,     CVE-2022-22614, CVE-2022-22615, CVE-2022-22661)

  - An attacker in a privileged position may be able to perform a denial of service attack (CVE-2022-22638)

  - A person with access to a Mac may be able to bypass Login Window (CVE-2022-22647)

  - A local attacker may be able to view the previous logged in user's desktop from the fast user switching     screen (CVE-2022-22656)

  - A plug-in may be able to inherit the application's permissions and access user data (CVE-2022-22650)

  - Processing maliciously crafted web content may disclose sensitive user information (CVE-2022-22662)

  - A local user may be able to write arbitrary files (CVE-2022-22582)

Note that Nessus has not tested for this issue but has instead relied only on the operating system's self-reported version number.

The version of Google Chrome installed on the remote macOS host is prior to 99.0.4844.74. It is, therefore, affected by multiple vulnerabilities as referenced in the 2022_03_stable-channel-update-for-desktop_15 advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 91.7. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-12 advisory.

  - When resizing a popup after requesting fullscreen access, the popup would not display the fullscreen     notification. (CVE-2022-26383)

  - If an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code> but not     <code>allow-scripts</code>, they were able to craft a link that, when clicked, would lead to JavaScript     execution in violation of the sandbox. (CVE-2022-26384)

  - When installing an add-on, Thunderbird verified the signature before prompting the user; but while the     user was confirming the prompt, the underlying add-on file could have been modified and Thunderbird would     not have noticed. (CVE-2022-26387)

  - An attacker could have caused a use-after-free by forcing a text reflow in an SVG object leading to a     potentially exploitable crash. (CVE-2022-26381)

  - Previously Thunderbird for macOS and Linux would download temporary files to a user-specific directory in     <code>/tmp</code>, but this behavior was changed to download them to <code>/tmp</code> where they could be     affected by other local users.  This behavior was reverted to the original, user-specific directory.  This     bug only affects Thunderbird for macOS and Linux. Other operating systems are unaffected. (CVE-2022-26386)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Xcode running on the remote host is prior to 12.4. It is, Therefore, potentially affected by arbitrary file access as referenced in the vendor advisory. A remote attacker can exploit this to read arbitrary files and disclose sensitive information.

The version of Adobe Photoshop installed on the remote macOS or Mac OS X host is prior to 22.5.6/23.2. It is, therefore, affected by a vulnerability as referenced in the apsb22-14 advisory.

  - Adobe Photoshop versions 23.1.1 (and earlier) and 22.5.5 (and earlier) are affected by an out-of-bounds     read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this     vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in     that a victim must open a malicious file. (CVE-2022-24090)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 98.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-10 advisory.

  - When resizing a popup after requesting fullscreen access, the popup would not display the fullscreen     notification. (CVE-2022-26383)

  - If an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code> but not     <code>allow-scripts</code>, they were able to craft a link that, when clicked, would lead to JavaScript     execution in violation of the sandbox. (CVE-2022-26384)

  - When installing an add-on, Firefox verified the signature before prompting the user; but while the user     was confirming the prompt, the underlying add-on file could have been modified and Firefox would not have     noticed. (CVE-2022-26387)

  - An attacker could have caused a use-after-free by forcing a text reflow in an SVG object leading to a     potentially exploitable crash. (CVE-2022-26381)

  - While the text displayed in Autofill tooltips cannot be directly read by JavaScript, the text was rendered     using page fonts. Side-channel attacks on the text by using specially crafted fonts could have lead to     this text being inferred by the webpage. (CVE-2022-26382)

  - In unusual circumstances, an individual thread may outlive the thread's manager during shutdown.  This     could have led to a use-after-free causing a potentially exploitable crash. (CVE-2022-26385)

  - Mozilla developers Kershaw Chang, Ryan VanderMeulen, and Randell Jesup reported memory safety bugs present     in Firefox 97. Some of these bugs showed evidence of memory corruption and we presume that with enough     effort some of these could have been exploited to run arbitrary code. (CVE-2022-0843)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 91.7. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-11 advisory.

  - When resizing a popup after requesting fullscreen access, the popup would not display the fullscreen     notification. (CVE-2022-26383)

  - If an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code> but not     <code>allow-scripts</code>, they were able to craft a link that, when clicked, would lead to JavaScript     execution in violation of the sandbox. (CVE-2022-26384)

  - When installing an add-on, Firefox verified the signature before prompting the user; but while the user     was confirming the prompt, the underlying add-on file could have been modified and Firefox would not have     noticed. (CVE-2022-26387)

  - An attacker could have caused a use-after-free by forcing a text reflow in an SVG object leading to a     potentially exploitable crash. (CVE-2022-26381)

  - Previously Firefox for macOS and Linux would download temporary files to a user-specific directory in     <code>/tmp</code>, but this behavior was changed to download them to <code>/tmp</code> where they could be     affected by other local users.  This behavior was reverted to the original, user-specific directory.  This     bug only affects Firefox for macOS and Linux. Other operating systems are unaffected. (CVE-2022-26386)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 91.6.2. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-09 advisory.

  - Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had     reports of attacks in the wild abusing this flaw. (CVE-2022-26485)

  - An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox     escape.  We have had reports of attacks in the wild abusing this flaw. (CVE-2022-26486)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 97.0.2. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-09 advisory.

  - Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had     reports of attacks in the wild abusing this flaw. (CVE-2022-26485)

  - An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox     escape.  We have had reports of attacks in the wild abusing this flaw. (CVE-2022-26486)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 91.6.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-09 advisory.

  - Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had     reports of attacks in the wild abusing this flaw. (CVE-2022-26485)

  - An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox     escape.  We have had reports of attacks in the wild abusing this flaw. (CVE-2022-26486)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Citrix Workspace App is installed on the unix host.

The version of Google Chrome installed on the remote macOS host is prior to 99.0.4844.51. It is, therefore, affected by multiple vulnerabilities as referenced in the 2022_03_stable-channel-update-for-desktop advisory.

  - Use after free in Chrome OS Shell in Google Chrome on Chrome OS prior to 99.0.4844.51 allowed a remote     attacker who convinced a user to engage in a series of user interaction to potentially exploit heap     corruption via user interactions. (CVE-2022-0808)

  - Heap buffer overflow in ANGLE in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2022-0789)

  - Use after free in Cast UI in Google Chrome prior to 99.0.4844.51 allowed a remote attacker who convinced a     user to engage in specific user interaction to potentially perform a sandbox escape via a crafted HTML     page. (CVE-2022-0790)

  - Use after free in Omnibox in Google Chrome prior to 99.0.4844.51 allowed a remote attacker who convinced a     user to engage in specific user interactions to potentially exploit heap corruption via user interactions.
    (CVE-2022-0791)

  - Out of bounds read in ANGLE in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2022-0792)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Severity
161413	Mozilla Firefox < 100.0.2	critical
161412	Mozilla Firefox ESR < 91.9.1	critical
161411	Mozilla Thunderbird < 91.9.1	critical
161410	macOS 12.x < 12.4 (HT213257)	critical
161402	macOS 10.15.x < Catalina Security Update 2022-004 Catalina (HT213255)	critical
161395	macOS 11.x < 11.6.6 Multiple Vulnerabilities (HT213256)	critical
161173	Adobe InCopy Installed (macOS)	info
161121	Security Update for Visual Studio 2019 (May 2022) (macOS)	high
160905	Google Chrome < 101.0.4951.64 Multiple Vulnerabilities	critical
160843	Adobe Creative Cloud < 2.5 Multiple Vulnerabilities (APSB21-41) (macOS)	high
160526	Mozilla Thunderbird < 91.9	high
160472	Splunk Installed (macOS)	info
160471	Splunk Enterprise 8.1.x < 8.1.7.2 / 8.2.x < 8.2.3.3 Log4j (macOS)	critical
160468	Mozilla Firefox ESR < 91.9	critical
160466	Mozilla Firefox < 100.0	critical
160216	Google Chrome < 101.0.4951.41 Multiple Vulnerabilities	critical
160082	Adobe After Effects Installed (macOS)	info
160081	Adobe ColdFusion Installed (macOS)	info
159887	Security Update for Visual Studio 2019 (April 2022) (macOS)	high
159740	Google Chrome < 100.0.4896.127 Vulnerability	high
159707	Security Updates for Microsoft Office Products (April 2022) (macOS)	high
159665	Adobe Photoshop 22.x < 22.5.7 / 23.x < 23.3 Multiple Vulnerabilities (macOS APSB22-20)	high
159659	Adobe Reader < 17.012.30227 / 17.012.30229 / 20.005.30331 / 20.005.30331 / 20.005.30334 / 20.005.30334 / 22.001.20112 / 22.001.20117 Multiple Vulnerabilities (APSB22-16) (macOS)	high
159658	Adobe Acrobat < 17.012.30227 / 17.012.30229 / 20.005.30331 / 20.005.30331 / 20.005.30334 / 20.005.30334 / 22.001.20112 / 22.001.20117 Multiple Vulnerabilities (APSB22-16) (macOS)	high
159637	Google Chrome < 100.0.4896.88 Multiple Vulnerabilities	critical
159628	HCL BigFix Client Installed (macOS)	info
159571	macOS 12.x < 12.3.1 (HT213220)	critical
159547	Mozilla Thunderbird < 91.8	high
159529	Mozilla Firefox < 99.0	high
159528	Mozilla Firefox ESR < 91.8	high
159493	Google Chrome < 100.0.4896.75 Vulnerability	high
159305	Google Chrome < 100.0.4896.60 Multiple Vulnerabilities	critical
159236	Google Chrome < 99.0.4844.84 Vulnerability	high
159181	Security Updates for Microsoft Office Products (March 2022) (macOS)	medium
159106	macOS 12.x < 12.3 (HT213183)	critical
159105	macOS 11.x < 11.6.5 Multiple Vulnerabilities (HT213184)	critical
158991	Wireshark 3.6.x < 3.6.2 Multiple Vulnerabilities (macOS)	critical
158981	Apple iTunes U < 3.8.3 A Vulnerability (credentialed check)	medium
158976	macOS 10.15.x < Catalina Security Update 2022-003 Catalina (HT213185)	critical
158935	Google Chrome < 99.0.4844.74 Multiple Vulnerabilities	critical
158928	Mozilla Thunderbird < 91.7	critical
158830	Apple Xcode < 12.4 access to arbitrary files (macOS)	medium
158729	Adobe Photoshop 22.x < 22.5.6 / 23.x < 23.2 Vulnerability (macOS APSB22-14)	medium
158693	Mozilla Firefox < 98.0	critical
158691	Mozilla Firefox ESR < 91.7	critical
158656	Mozilla Thunderbird < 91.6.2	critical
158655	Mozilla Firefox < 97.0.2	critical
158652	Mozilla Firefox ESR < 91.6.1	critical
158567	Citrix Workspace App Installed (nix)	info
158501	Google Chrome < 99.0.4844.51 Multiple Vulnerabilities	critical

MacOS X Local Security Checks Family for Nessus

critical

critical

critical

critical

critical

critical

info

high

critical

high

high

info

critical

critical

critical

critical

info

info

high

high

high

high

high

high

critical

info

critical

high

high

high

high

critical

high

medium

critical

critical

critical

medium

critical

critical

critical

medium

medium

critical

critical

critical

critical

critical

info

critical