According to its self-reported version number, HandlebarsJS on the remote server is prior to version 4.7.7. Therefore, it may be affected by multiple vulnerabilities.

- A Prototype Pollution Vulnerability when seleclecting certain compiling options to compile templates originating from untrusted sources (CVE-2021-23383).

- A Remote Code Execution vulnerability when seleclecting certain compiling options to compile templates originating from untrusted sources (CVE-2021-23369).

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain
    compiling options to compile templates coming from an untrusted source. (CVE-2021-23369)

The 12.2.1.4.0 and 14.1.1.0.0 versions of WebLogic Server installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2024 CPU advisory:

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Samples (handlebars)).     Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows \     unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of     this vulnerability can result in takeover of Oracle WebLogic Server. (CVE-2021-23369)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized Thirdparty     Jars (Bouncy Castle Java Library)). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise     Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset     of Oracle WebLogic Server accessible data. (CVE-2023-2976)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). The     supported version that is affected is 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker     with network access via HTTP/2 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can     result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic     Server. (CVE-2023-44487)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Nessus Network Monitor running on the remote host is prior to 6.3.1. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2023-43 advisory.

  - Nessus Network Monitor leverages third-party software to help provide underlying functionality. Several of     the third-party components (HandlebarsJS, OpenSSL, and jquery-file-upload)were found to contain     vulnerabilities, and updated versions have been made available by the providers.Out of caution and in line     with best practice, Tenable has opted to upgrade these components to address the potential impact of the     issues. Nessus Network Monitor 6.3.1 updates HandlebarsJS to version 4.7.8, OpenSSL to version 3.0.12, and     jquery-file-upload to version 10.8.0. Tenable has released Nessus Network Monitor 6.3.1 to address these     issues. The installation files can be obtained from the Tenable Downloads Portal     (https://www.tenable.com/downloads/nessus-network-monitor). (CVE-2018-9206, CVE-2021-23369,     CVE-2021-23383, CVE-2023-5363)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Nessus Network Monitor (NNM) installed on the remote host is prior to 6.2.0. It is, therefore, affected by multiple vulnerabilities in third-party software. Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues.
Nessus Network Monitor 6.2.0 updates moment.js to version 2.29.4 and handlebars to version 4.7.7 to address the identified vulnerabilities.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain     compiling options to compile templates coming from an untrusted source. (CVE-2021-23369)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
114093	HandlebarsJS < 4.7.7 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	10/24/2023	10/25/2023	critical
414203	SCA: security update for handlebars, org.webjars.bowergithub.wycats:handlebars.js, org.webjars.npm:handlebars, org.webjars:handlebars (GHSA-f2jv-r9rf-7988)	Tenable Self-Hosted Container Security	SCA Checks	1/23/2025	7/2/2026	critical
414203	SCA: security update for handlebars, org.webjars.bowergithub.wycats:handlebars.js, org.webjars.npm:handlebars, org.webjars:handlebars (GHSA-f2jv-r9rf-7988)	Tenable Cloud Security	SCA Checks	1/23/2025	7/2/2026	critical
193425	Oracle WebLogic Server (April 2024 CPU)	Nessus	Misc.	4/17/2024	10/18/2024	critical
186472	Nessus Network Monitor < 6.3.1 Multiple Vulnerabilities (TNS-2023-43)	Nessus	Misc.	11/30/2023	12/19/2023	critical
170688	Nessus Network Monitor < 6.2.0 Multiple Vulnerabilities (TNS-2022-28)	Nessus	Misc.	1/27/2023	9/6/2023	critical
223661	Linux Distros Unpatched Vulnerability : CVE-2021-23369	Nessus	Misc.	3/4/2025	8/30/2026	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical