Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or a potential authentication bypass.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which
    could result in an application crash (potential information disclosure) or a potential authentication
    bypass. (CVE-2019-17195)

The 17.12.11, 18.8.11, 19.12.10, and 20.12.0 versions of Primavera Gateway installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2021 CPU advisory.

  - Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: Admin     (Nimbus JOSE+JWT)). Supported versions that are affected are 18.8.0-18.8.11. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera     Gateway. Successful attacks of this vulnerability can result in takeover of Primavera Gateway.
    (CVE-2019-17195)

  - Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: Admin     (Lodash)). Supported versions that are affected are 17.12.0-17.12.11, 18.8.0-18.8.11, 19.12.0-19.12.10 and     20.12.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Primavera Gateway. Successful attacks of this vulnerability can result in unauthorized     creation, deletion or modification access to critical data or all Primavera Gateway accessible data and     unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Primavera Gateway.
    (CVE-2020-8203)

  - Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: Admin     (Netty)). Supported versions that are affected are 17.12.0-17.12.11, 18.8.0-18.8.11 and 19.12.0-19.12.10.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to     compromise Primavera Gateway. Successful attacks of this vulnerability can result in unauthorized     creation, deletion or modification access to critical data or all Primavera Gateway accessible data.
    (CVE-2021-21409)     
  - Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component:
    jackson-databind). (CVE-2020-36189)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The 13.4.0.0 version of Enterprise Manager Base Platform installed on the remote host is affected by multiple vulnerabilities as referenced in the April 2021 CPU advisory.

  - Vulnerability in the Enterprise Manager for Virtualization product of Oracle Enterprise Manager     (component: Administration operations (Apache Commons BeanUtils)). The supported version that is affected     is 13.4.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Enterprise Manager for Virtualization. Successful attacks of this vulnerability can result     in unauthorized update, insert or delete access to some of Enterprise Manager for Virtualization accessible     data as well as unauthorized read access to a subset of Enterprise Manager for Virtualization accessible data     and unauthorized ability to cause a partial denial of service (partial DOS) of Enterprise Manager for     Virtualization. (CVE-2019-10086)

  - Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component:     EM on Market Place (Perl)). The supported version that is affected is 13.4.0.0. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Enterprise Manager Base Platform.     Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of Enterprise Manager Base Platform as well as unauthorized update, insert or delete access to     some of Enterprise Manager Base Platform accessible data and unauthorized read access to a subset of Enterprise     Manager Base Platform accessible data. (CVE-2020-10878)

  - Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Reporting     Framework (Apache Camel)). The supported version that is affected is 13.4.0.0. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Enterprise Manager Base Platform.     Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access     to all Enterprise Manager Base Platform accessible data. (CVE-2020-11994)

  - Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: UI Framework).
    The supported version that is affected is 13.4.0.0. Easily exploitable vulnerability allows unauthenticated attacker     with network access via HTTP to compromise Enterprise Manager Base Platform. Successful attacks require human     interaction from a person other than the attacker and while the vulnerability is in Enterprise Manager Base Platform,     attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Enterprise Manager Base Platform accessible data as well as unauthorized     read access to a subset of Enterprise Manager Base Platform accessible data. (CVE-2021-2053)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of WebLogic Server installed on the remote host is affected by multiple vulnerabilities as referenced in the January 2021 CPU advisory.

  - An unspecified vulnerability exists in the Core component. An unauthenticated, remote attacker with     network access via IIOP, T3 can exploit this issue to compromise the server. Successful attacks of this     vulnerability can result in takeover of Oracle WebLogic Server. (CVE-2021-2108)

  - An unspecified vulnerability exists in the Console component. An authenticated, remote attacker with     network access via HTTP can exploit this issue to compromise the server. Successful attacks of this     vulnerability can result in takeover of Oracle WebLogic Server. (CVE-2021-2109)

  - An unspecified vulnerability exists in the Samples component. An unauthenticated, remote attacker with     network access via IIOP, T3 can exploit this issue to compromise the server. Successful attacks of this     vulnerability can result in takeover of Oracle WebLogic Server. (CVE-2021-2075)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by the following vulnerabilities as referenced in the April 2020 CPU advisory:

  - In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows     suppressing the ability for an attacker to access the classloader via the class property available on all     Java objects. However, this characteristic of the PropertyUtilsBean was not used by default.
    (CVE-2019-10086)

  - The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an     infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an     attacker can choose the file names inside of an archive created by Compress. (CVE-2019-12402)

  - A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default     Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and     the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint     to access, it is possible to make the service execute a malicious payload. This issue exists because of     com.p6spy.engine.spy.P6DataSource mishandling. (CVE-2019-16943)

  - Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which     could result in an application crash (potential information disclosure) or a potential authentication     bypass. (CVE-2019-17195)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1308 advisory.

    The org.ovirt.engine-root is a core component of oVirt.

    The following packages have been upgraded to a later upstream version: org.ovirt.engine-root (4.3.8.2),     ovirt-engine-dwh (4.3.8), ovirt-engine-metrics (1.3.6.1), ovirt-fast-forward-upgrade (1.0.0), ovirt-     imageio-common (1.5.3), ovirt-imageio-proxy (1.5.3), ovirt-web-ui (1.6.0), rhv-log-collector-analyzer     (0.2.15), v2v-conversion-host (1.16.0). (BZ#1767333, BZ#1776722, BZ#1779587, BZ#1779631)

    Security Fix(es):

    * CVE-2019-17195
    * CVE-2019-10086

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * [downstream clone - 4.4.0] Upgrade from 4.3 to 4.4 will fail if there are versioned templates in     database (BZ#1688781)

    * [ovirt-fast-forward-upgrade] Error: ovirt-engine-setup-plugin-ovirt-engine conflicts with ovirt-     engine-4.2.5.2-0.1.el7ev.noarch (BZ#1754979)

    * Users immediately logged out from User portal due to negative UserSessionTimeOutInterval (BZ#1757423)

    * Fluentd error when stopping metrics services through playbook on 4.3 (BZ#1772506)

    * [downstream clone - 4.3.8] From  VM Portal, users cannot create Operating System Windows VM.
    (BZ#1773580)

    * MERGE_STATUS fails with 'Invalid UUID string: mapper' when Direct LUN that already exists is hot-plugged     [RHV clone - 4.3.8] (BZ#1779664)

    * Metric Store reports all hosts in Default cluster regardless of cluster assignment. (BZ#1780234)

    Enhancement(s):

    * RFE for offline installation  of RHV Metrics Store (BZ#1711873)

    * [RFE] Compare storage with database for discrepancies (BZ#1739106)

    * [RFE] RHV+Metrics Store - Support a Flat DNS environment without subdomains (BZ#1782412)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
423552	SCA: security update for com.nimbusds:nimbus-jose-jwt (GHSA-f6vf-pq8c-69m4)	Tenable Cloud Security	SCA Checks	critical
423552	SCA: security update for com.nimbusds:nimbus-jose-jwt (GHSA-f6vf-pq8c-69m4)	Tenable Self-Hosted Container Security	SCA Checks	critical
151974	Oracle Primavera Gateway (Jul 2021 CPU)	Nessus	CGI abuses	critical
148895	Oracle Enterprise Manager Cloud Control (Apr 2021 CPU)	Nessus	Misc.	critical
145264	Oracle WebLogic Server Multiple Vulnerabilities (Jan 2021 CPU)	Nessus	Misc.	critical
135583	Oracle Primavera Gateway (Apr 2020 CPU)	Nessus	CGI abuses	critical
135185	RHEL 7 : Red Hat Virtualization Engine security, 4.3.9 (Low) (RHSA-2020:1308)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2019-17195

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical