According to its self-reported version number, the Kibana application running on the remote host is prior to 6.8.2 or 7.x prior to 7.2.1. It is, therefore, affected by :

 - A prototype pollution vulnerability in lodash. (CVE-2019-10744)

 - A server-side request forgery (SSRF) vulnerability in the graphite integration for Timelion visualizer. (CVE-2019-7616)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, Lodash is prior to 4.17.12. It is, therefore, affected by a prototype pollution vulnerability in the function defaultsDeep which could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for ovirt-web-ui is now available for Red Hat Virtualization Engine 4.3.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The ovirt-web-ui package provides the web interface for Red Hat Virtualization.

Security Fix(es) :

* nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties (CVE-2019-10744)

* bootstrap: XSS in the tooltip or popover data-template attribute (CVE-2019-8331)

* js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection (CVE-2019-11358)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es) :

* Known moderate severity security vulnerability detected by GitHub on ovirt-web-ui components (BZ#1694032)

The version of F5 Networks BIG-IP installed on the remote host is prior to 12.1.5.2 / 13.1.3.4 / 13.1.3.5 / 14.1.2.5 / 14.1.2.7 / 15.0.1.4 / 15.1.0.5 / 15.1.1 / 16.0.0. It is, therefore, affected by a vulnerability as referenced in the K47105354 advisory.

  - Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep     could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
    (CVE-2019-10744)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2362 advisory.

  - nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties     (CVE-2019-10744)

  - jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)

  - grafana: information disclosure through world-readable grafana configuration files (CVE-2020-12459)

  - nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a     constructor or __proto__ payload (CVE-2020-7598)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
98979	Kibana < 6.8.2 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	3/5/2020	3/14/2023	critical
113008	Lodash < 4.17.12 Prototype Pollution	Web App Scanning	Component Vulnerability	10/4/2021	3/14/2023	critical
98980	Kibana 7.x < 7.2.1 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	3/5/2020	3/14/2023	critical
129862	RHEL 7 : Virtualization Manager (RHSA-2019:3024)	Nessus	Red Hat Local Security Checks	10/15/2019	4/18/2024	critical
135940	F5 Networks BIG-IP : Lodash library vulnerability (K47105354)	Nessus	F5 Networks Local Security Checks	4/24/2020	3/14/2024	critical
137064	RHEL 7 / 8 : Red Hat OpenShift Service Mesh (RHSA-2020:2362)	Nessus	Red Hat Local Security Checks	6/3/2020	1/23/2023	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical