The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2192-1 advisory.

  - A possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 in the multipart     parsing component of Rack. (CVE-2022-30122)

  - A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a     possible shell escape in the Lint and CommonLogger components of Rack. (CVE-2022-30123)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-5530 advisory.

    Several vulnerabilities were discovered in ruby-rack, a modular Ruby webserver interface, which may result     in denial of service and shell escape sequence injection. For the oldstable distribution (bullseye), these     problems have been fixed in version 2.1.4-3+deb11u1. We recommend that you upgrade your ruby-rack     packages. For the detailed security status of ruby-rack please refer to its security tracker page at:
    https://security-tracker.debian.org/tracker/ruby-rack

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2022:0280 advisory.

    Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:

      CVE-2019-11358:
      jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true,     {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable
    __proto__ property, it could extend the native Object.prototype.

      CVE-2020-11023:
      In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option>     elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods     (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

      CVE-2022-30123:
      A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a     possible shell escape in the Lint and CommonLogger components of Rack.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7343 advisory.

  - jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true,     {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable
    __proto__ property, it could extend the native Object.prototype. (CVE-2019-11358)

  - In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option>     elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods     (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
    (CVE-2020-11023)

  - A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a     possible shell escape in the Lint and CommonLogger components of Rack. (CVE-2022-30123)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2022-4104:06 advisory.

    * rubygem-rack: crafted requests can cause shell escape sequences (CVE-2022-30123)
      * jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution,     or property injection (CVE-2019-11358)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1486 advisory.

    Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &     OpenTSDB.

    Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic     design. It focuses on automating as much as possible and adhering to the DRY (Don't Repeat Yourself)     principle.

    Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text     files and to perform system management tasks.

    Security Fix(es):

    * puma-5.6.4: http request smuggling vulnerabilities (CVE-2022-24790)

    * rubygem-rack: crafted requests can cause shell escape sequences (CVE-2022-30123)

    * moment: inefficient parsing algorithm resulting in DoS (CVE-2022-31129)

    * rubygem-tzinfo: arbitrary code execution (CVE-2022-31163)

    * rubygem-rack: crafted multipart POST request may cause a DoS (CVE-2022-30122)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-7343 advisory.

    [0.9.169-3.0.1]
    - replace logo pcsd/public/favicon.ico in tarball
    - remove Source1 HAM-logo.png

    [0.9.169-3.el7_3.2]
    - Update rubygem rack
    - Upgrade jquery in web-ui
    - Resolves: rhbz#2099578 rhbz#2093232

    [0.9.169-3.el7_3.1]
    - Explicitly close libcurl connections to prevent stalled TCP connections in CLOSE-WAIT state
    - Added support for loading DH keys from a file
    - Resolves: rhbz#1870551 rhbz#1888479

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
162555	SUSE SLES15 Security Update : rubygem-rack (SUSE-SU-2022:2192-1)	Nessus	SuSE Local Security Checks	2022/6/28	2023/7/13	critical
183679	Debian DSA-5530-1 : ruby-rack - security update	Nessus	Debian Local Security Checks	2023/10/22	2025/1/24	critical
238629	TencentOS Server 2: pcs (TSSA-2022:0280)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/23	critical
208606	CentOS 7 : pcs (RHSA-2022:7343)	Nessus	CentOS Local Security Checks	2024/10/9	2025/1/24	critical
291880	MiracleLinux 7 : pcs-0.9.169-3.el7.3 (AXSA:2022-4104:06)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	critical
173453	RHEL 7 : Red Hat Gluster Storage web-admin-build (RHSA-2023:1486)	Nessus	Red Hat Local Security Checks	2023/3/28	2024/11/7	critical
166935	Oracle Linux 7 : pcs (ELSA-2022-7343)	Nessus	Oracle Linux Local Security Checks	2022/11/3	2024/10/22	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical