The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2861 advisory.

  - kubernetes: YAML parsing vulnerable to Billion Laughs attack, allowing for remote denial of service     (CVE-2019-11253)

  - grafana: XSS annotation popup vulnerability (CVE-2020-12052)

  - grafana: XSS via column.title or cellLinkTooltip (CVE-2020-12245)

  - grafana: SSRF incorrect access control vulnerability allows unauthenticated users to make grafana send     HTTP requests to any URL (CVE-2020-13379)

  - grafana: XSS via the OpenTSDB datasource (CVE-2020-13430)

  - npm-serialize-javascript: allows remote attackers to inject arbitrary code via the function     deleteFunctions within index.js (CVE-2020-7660)

  - npmjs-websocket-extensions: ReDoS vulnerability in Sec-WebSocket-Extensions parser (CVE-2020-7662)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2796 advisory.

  - kubernetes: YAML parsing vulnerable to Billion Laughs attack, allowing for remote denial of service     (CVE-2019-11253)

  - npm-serialize-javascript: XSS via unsafe characters in serialized regular expressions (CVE-2019-16769)

  - npm-serialize-javascript: allows remote attackers to inject arbitrary code via the function     deleteFunctions within index.js (CVE-2020-7660)

  - npmjs-websocket-extensions: ReDoS vulnerability in Sec-WebSocket-Extensions parser (CVE-2020-7662)

  - grafana: XSS annotation popup vulnerability (CVE-2020-12052)

  - grafana: XSS via column.title or cellLinkTooltip (CVE-2020-12245)

  - grafana: SSRF incorrect access control vulnerability allows unauthenticated users to make grafana send     HTTP requests to any URL (CVE-2020-13379)

  - grafana: XSS via the OpenTSDB datasource (CVE-2020-13430)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
138178	RHEL 8 : Red Hat OpenShift Service Mesh 1.0 servicemesh-grafana (RHSA-2020:2861)	Nessus	Red Hat Local Security Checks	7/7/2020	1/23/2023	high
138031	RHEL 8 : Red Hat OpenShift Service Mesh servicemesh-grafana (RHSA-2020:2796)	Nessus	Red Hat Local Security Checks	7/1/2020	4/28/2024	high
194919	Splunk Enterprise < 8.1.14, 8.2.0 < 8.2.11, 9.0.0 < 9.0.5 (SVD-2023-0613)	Nessus	CGI abuses	5/2/2024	5/30/2024	critical

Detections

Analytics

Plugins Search

high

high

critical