The Microsoft Visual Studio Products are missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - An elevation of privilege vulnerability. An attacker can     exploit this to gain elevated privileges.
    (CVE-2021-1651, CVE-2021-1680)

  - A denial of service (DoS) vulnerability. An attacker can     exploit this issue to cause the affected component to     deny system or application services. (CVE-2021-1723)

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2020-26870)

Two issues have been found in dompurify.js, an XSS sanitizer for HTML, MathML and SVG.

Both issues are related to mXSS issues in SVG- or MATH-elements.

For Debian 9 stretch, these problems have been fixed in version 0.8.2~dfsg1-1+deb9u1.

We recommend that you upgrade your dompurify.js packages.

For the detailed security status of dompurify.js please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/dompurify.js

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2021 CPU advisory.

  - Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions     that are affected are 12.1.0.2 and 19c. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via Oracle Net to compromise Advanced Networking Option. Successful attacks require     human interaction from a person other than the attacker and while the vulnerability is in Advanced     Networking Option, attacks may significantly impact additional products. Successful attacks of this     vulnerability can result in takeover of Advanced Networking Option. (CVE-2021-2351)

  - Vulnerability in the Oracle Text component of Oracle Database Server. Supported versions that are affected     are 12.1.0.2 and 19c. Easily exploitable vulnerability allows high privileged attacker having Create Any     Procedure, Alter Any Table privilege with network access via Oracle Net to compromise Oracle Text.
    Successful   attacks of this vulnerability can result in takeover of Oracle Text. (CVE-2021-2328)

  - Vulnerability in the Oracle XML DB component of Oracle Database Server. Supported versions that are     affected   are 12.1.0.2 and 19c. Easily exploitable vulnerability allows high privileged attacker having     Create Any   Procedure, Create Public Synonym privilege with network access via Oracle Net to compromise     Oracle XML DB.   Successful attacks of this vulnerability can result in takeover of Oracle XML DB.
    (CVE-2021-2329)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Dell Wyse Management Suite installed on the remote host is prior to 4.0. It is, therefore, affected by multiple vulnerabilities as referenced in the DSA-2022-329 advisory.

  - Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does     not necessarily return the original DOM tree, and a namespace can change from HTML to MathML, as     demonstrated by nesting of FORM elements. (CVE-2020-26870)

  - The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via     the writeReplace() method in internal classes, which may lead to DoS attacks. (CVE-2022-25647)

  - The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious     XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler     and execute arbitrary Java bytecode. The Apache Xalan Java project is dormant and in the process of being     retired. No future releases of Apache Xalan Java to address this issue are expected. Note: Java runtimes     (such as OpenJDK) include repackaged copies of Xalan. (CVE-2022-34169)

  - Wyse Management Suite Repository 3.8 and earlier contain an information disclosure vulnerability in error     pages with which an attacker may potentially discover the internal structure of the application and its     components and use this information for further vulnerability research. (CVE-2022-46675)

  - Wyse Management Suite 3.8 and earlier contain an improper access control vulnerability. A malicious admin     user may potentially disable or delete users under administration and unassigned admins for which the     group admin is not authorized. (CVE-2022-46676)

  - Wyse Management Suite 3.8 and earlier contain an improper access control vulnerability. An authenticated     malicious admin user may potentially create a subgroup under a group for which the admin is not     authorized. (CVE-2022-46677)

  - Wyse Management Suite 3.8 and earlier contain an improper access control vulnerability. An authenticated     malicious admin user may potentially edit general client policy for which the user is not authorized.
    (CVE-2022-46678, CVE-2022-46755)

  - Wyse Management Suite 3.8 and earlier contain an improper access control vulnerability. An authenticated     malicious admin user may potentially access certain pro license features for which this admin is not     authorized in order to configure user controlled external entities. (CVE-2022-46754)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
144977	Security Updates for Microsoft Visual Studio Products (January 2021)	Nessus	Windows : Microsoft Bulletins	1/14/2021	1/30/2024	high
142105	Debian DLA-2419-1 : dompurify.js security update	Nessus	Debian Local Security Checks	10/30/2020	2/13/2024	medium
152026	Oracle Database Server Multiple Vulnerabilities (Jul 2021 CPU)	Nessus	Databases	7/23/2021	12/6/2023	critical
168926	Dell Wyse Management Suite < 4.0 Multiple Vulnerabilities (DSA-2022-329)	Nessus	Windows	12/19/2022	9/12/2023	high

Detections

Analytics

Plugins Search

high

medium

critical

high