The versions of Primavera Unifier installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2023 CPU advisory.

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: User     Interface (UnderscoreJS)). Supported versions that are affected are 18.8, 19.12, 20.12, 21.12 and 22.12.
    Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to     compromise Primavera Unifier. Successful attacks of this vulnerability can result in unauthorized update,     insert or delete access to some of Primavera Unifier accessible data as well as unauthorized read access     to a subset of Primavera Unifier accessible data. (CVE-2021-23358)     
  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Event     Streams and Communications (Apache Kafka)). Supported versions that are affected are 18.8, 19.12, 20.12,     21.12 and 22.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via     HTTP to compromise Primavera Unifier. Successful attacks of this vulnerability can result in unauthorized     ability to cause a hang or frequently repeatable crash (complete DOS) of Primavera Unifier.
    (CVE-2022-34917)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Document     Management (jackson-databind)). Supported versions that are affected are 18.8, 19.12, 20.12, 21.12 and     22.12. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to     compromise Primavera Unifier. Successful attacks require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of Primavera Unifier. (CVE-2022-42003)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Atlassian Jira Service Management Data Center and Server (Jira Service Desk) running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-15978 advisory.

  - The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to     Arbitrary Code Injection via the template function, particularly when a variable property is passed as an     argument as it is not sanitized. (CVE-2021-23358)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

node-underscore and libjs-underscore are vulnerable to Arbitrary Code Execution via the template function, particulary when a variable property is passed as an argument as it is not sanitized.

For Debian 9 stretch, this problem has been fixed in version 1.8.3~dfsg-1+deb9u1.

We recommend that you upgrade your underscore packages.

For the detailed security status of underscore please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/underscore

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 21.04 host has packages installed that are affected by a vulnerability as referenced in the USN-4913-2 advisory.

    USN-4913-1 fixed vulnerabilities in Underscore. This update provides the corresponding updates for Ubuntu     21.04.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Tenable Nessus application running on the remote host is 10.x prior to 10.1.0, or 8.x prior to 8.15.3. It is, therefore, affected by a vulnerability in a third-party library:

  - The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary     Code Injection via the template function, particularly when a variable property is passed as an argument as it is     not sanitized. (CVE-2021-23358)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016621 advisory.

    The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to     Arbitrary Code Injection via the template function, particularly when a variable property is passed as an     argument as it is not sanitized.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to     Arbitrary Code Injection via the template function, particularly when a variable property is passed as an     argument as it is not sanitized. (CVE-2021-23358)

Note that Nessus relies on the presence of the package as reported by the vendor.

It was discovered that missing input sanitising in the template() function of the Underscore JavaScript library could result in the execution of arbitrary code.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4913-1 advisory.

    It was discovered that Underscore incorrectly handled certain inputs. An attacker could possibly use this     issue to inject arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:2769 advisory.

    Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable     version of the Ceph storage system with a Ceph management platform, deployment utilities, and support     services.

    These new packages include numerous security and bug fixes. Space precludes documenting all of these     changes in this advisory. Users are directed to the Red Hat Ceph Storage Release Notes for information on     the most significant of these changes:

    https://docs.redhat.com/en/documentation/red_hat_ceph_storage/7/html/7.1_release_notes

    ==========================================     IMPORTANT:
    The Red Hat Ceph Storage team has migrated our defect tracking from Bugzilla to an internal Jira system.
    Bug fixes and CVE information that was previously listed in the errata releases are now listed in the     Release Notes.

    During the migration period, some defect details might still appear temporarily in the Errata. However,     the release notes contain the most current and authoritative information, including the complete list of     fixes and security updates.

    Refer to the release notes going forward for the latest and most accurate fix and CVE information.
    ==========================================

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Tenable SecurityCenter application installed on the remote host is less than 5.19.0 and is therefore affected by multiple vulnerabilities in the following components: 
  - Apache FOP
  - Underscore
  - Handlebars
  - PHP
  - sqlite

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

ID	Name	Product	Family	Published	Updated	Severity
170193	Oracle Primavera Unifier (Jan 2023 CPU)	Nessus	CGI abuses	1/20/2023	2/24/2026	high
216853	Atlassian Jira Service Management Data Center and Server 10.3.1 (JSDSERVER-15978)	Nessus	Misc.	2/26/2025	2/26/2025	high
148275	Debian DLA-2613-1 : underscore security update	Nessus	Debian Local Security Checks	4/1/2021	1/12/2024	high
149044	Ubuntu 21.04 : Underscore vulnerability (USN-4913-2)	Nessus	Ubuntu Local Security Checks	4/28/2021	10/29/2024	high
157339	Tenable Nessus 10.x < 10.1.0 / 8.x < 8.15.3 Third-Party Vulnerability (TNS-2022-04)	Nessus	Misc.	2/3/2022	11/17/2023	high
316219	Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: nodejs-underscore (UTSA-2026-016621)	Nessus	Unity Linux Local Security Checks	5/22/2026	8/28/2026	high
223685	Linux Distros Unpatched Vulnerability : CVE-2021-23358	Nessus	Misc.	3/4/2025	10/13/2025	high
148300	Debian DSA-4883-1 : underscore - security update	Nessus	Debian Local Security Checks	4/2/2021	1/12/2024	high
148555	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Underscore vulnerability (USN-4913-1)	Nessus	Ubuntu Local Security Checks	4/14/2021	8/27/2024	high
299273	RHEL 8 / 9 : Red Hat Ceph Storage 7.1 (RHSA-2026:2769)	Nessus	Red Hat Local Security Checks	2/17/2026	2/17/2026	high
152986	Tenable SecurityCenter < 5.19.0 Multiple Vulnerabilities (TNS-2021-14)	Nessus	Misc.	9/3/2021	5/10/2024	critical

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high

critical