RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Information Exposure Through Timing Discrepancy vulnerabilities during DSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover DSA keys.

The All Supported Versions versions of GoldenGate installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2021 CPU advisory.

  - Vulnerability in Oracle GoldenGate (component: Install (Dell BSAFE Crypto-J)). The supported version that is     affected is Prior to 19.1.0.0.0.210420. Easily exploitable vulnerability allows unauthenticated attacker with     network access via Oracle Net to compromise Oracle GoldenGate. Successful attacks require human interaction     from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized     access to critical data or complete access to all Oracle GoldenGate accessible data. (CVE-2019-3740)

  - Security-in-Depth issue in Oracle GoldenGate (component: Install (jQuery)). This vulnerability cannot be     exploited in the context of this product. (CVE-2020-11023)   
  - Security-in-Depth issue in Oracle GoldenGate (component: General (Apache Batik)). This vulnerability cannot     be exploited in the context of this product. (CVE-2020-11987)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of WebLogic Server installed on the remote host is affected by multiple vulnerabilities as referenced in the April 2021 CPU advisory.

  - An unspecified vulnerability exists in the Coherence Container component. Easily exploitable vulnerability     allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server.
    Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. (CVE-2021-2135)

  - An unspecified vulnerability exists in the Core component. Easily exploitable vulnerability allows     unauthenticated attacker with network access via IIOP to compromise Oracle WebLogic Server. Successful     attacks of this vulnerability can result in takeover of Oracle WebLogic Server. (CVE-2021-2136)     
  - An unspecified vulnerability exists in the TopLink Integration component. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.
    Successful attacks of this vulnerability can result in unauthorized access to critical data or complete     access to all Oracle WebLogic Server accessible data. (CVE-2021-2157)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2021 CPU advisory. 

  - Vulnerability in the Oracle Database - Enterprise Edition Security (Dell BSAFE Micro Edition Suite)   component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c   and 19c. Easily exploitable vulnerability allows unauthenticated attacker with network access via   multiple protocols to compromise Oracle Database - Enterprise Edition Security (Dell BSAFE Micro Edition Suite).   Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently   repeatable crash (complete DOS) of Oracle Database - Enterprise Edition Security (Dell BSAFE Micro Edition Suite)   (CVE-2020-5360).

  - Vulnerability in the Workload Manager (Apache Tomcat) component of Oracle Database Server. Supported versions   that are affected are 18c and 19c. Easily exploitable vulnerability allows unauthenticated attacker with network   access via HTTP to compromise Workload Manager (Apache Tomcat). Successful attacks of this vulnerability can   result in unauthorized access to critical data or complete access to all Workload Manager (Apache Tomcat)   accessible data (CVE-2020-17527).

  - Vulnerability in the Oracle Database - Enterprise Edition (Dell BSAFE Crypto-J) component of Oracle Database   Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Easily exploitable vulnerability   allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Database - Enterprise   Edition (Dell BSAFE Crypto-J). Successful attacks require human interaction from a person other than the attacker.   Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to   all Oracle Database - Enterprise Edition (Dell BSAFE Crypto-J) accessible data (CVE-2019-3740). 

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
154342	Oracle GoldenGate (Oct 2021 CPU)	Nessus	Misc.	Local	high
148924	Oracle WebLogic Server Multiple Vulnerabilities (Apr 2021 CPU)	Nessus	Misc.	Local	high
148894	Oracle Database Server Multiple Vulnerabilities (Apr 2021 CPU)	Nessus	Databases	Local	high

Detections

Analytics

CVE-2019-3740

medium

Tenable Plugins

high

high

high