The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - jQuery Cookie 1.4.1 is affected by prototype pollution, which can lead to DOM cross-site scripting (XSS).
    (CVE-2022-23395)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to its self-reported version, the Nessus Network Monitor running on the remote host is prior to 6.2.2. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2023-23 advisory. Several of the third-party components were found to contain vulnerabilities, and updated versions have been made available by the providers. Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues. Nessus Network Monitor 6.2.2 updates the following components:

  - c-ares from version 1.10.0 to version 1.19.1.
  - curl from version 7.79.1 to version 8.1.2.
  - libbzip2 from version 1.0.6 to version 1.0.8.
  - libpcre from version 8.42 to version 8.44.
  - libxml2 from version 2.7.7 to version 2.11.1.
  - libxslt from version 1.1.26 to version 1.1.37.
  - libxmlsec from version 1.2.18 to version 1.2.37.
  - sqlite from version 3.27.2 to version 3.40.1.
  - jQuery Cookie from version 1.3.1 to version 1.4.1.
  - jQuery UI from version 1.13.0 to version 1.13.2.
  - OpenSSL from version 3.0.8 to version 3.0.9.

The versions of Oracle Siebel CRM installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2026 CPU advisory.

  - Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Application Interface     (jquery-cookie)). Supported versions that are affected are 17.0-25.9. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.
    Successful attacks require human interaction from a person other than the attacker and while the     vulnerability is in Siebel CRM Deployment, attacks may significantly impact additional products (scope     change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete     access to some of Siebel CRM Deployment accessible data as well as unauthorized read access to a subset of     Siebel CRM Deployment accessible data. (CVE-2022-23395)

  - Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: EAI (Apache     Xerces-C++)). Supported versions that are affected are 17.0-25.9. Easily exploitable vulnerability allows     high privileged attacker with network access via HTTP to compromise Siebel CRM Integration. Successful     attacks of this vulnerability can result in takeover of Siebel CRM Integration. (CVE-2024-23807)

  - Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Email Marketing     (Apache Commons FileUpload)). Supported versions that are affected are 17.0-25.9. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps -     Marketing. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of Siebel Apps - Marketing. (CVE-2025-48976)

  - Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure     (Bouncy Castle Java Library)). Supported versions that are affected are 17.0-25.9. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Siebel CRM     Deployment. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial     denial of service (partial DOS) of Siebel CRM Deployment. (CVE-2025-8916)

  - Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: REST (Apache Commons     Lang)). Supported versions that are affected are 17.0-25.9. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration. Successful     attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service     (partial DOS) of Siebel CRM Integration. (CVE-2025-48924)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
259637	Linux Distros Unpatched Vulnerability : CVE-2022-23395	Nessus	Misc.	8/30/2025	4/29/2026	medium
177842	Nessus Network Monitor < 6.2.2 Multiple Vulnerabilities (TNS-2023-23)	Nessus	Misc.	6/30/2023	7/6/2023	critical
294868	Oracle Siebel Server <= 25.9 (January 2026 CPU)	Nessus	Misc.	1/21/2026	4/30/2026	medium

Detections

Analytics

Plugins Search

medium

critical

medium