Improper Restriction of XML External Entity Reference in GitHub repository liquibase/liquibase prior to 4.8.0.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Improper Restriction of XML External Entity Reference in GitHub repository liquibase/liquibase prior to
    4.8.0. (CVE-2022-0839)

The 12.1.0.2, 19c, 21c, All Supported Versions, and None versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2022 CPU advisory.

  - Vulnerability in the Oracle Database - Enterprise Edition Sharding component of Oracle Database Server.
    For supported versions that are affected see note. Easily exploitable vulnerability allows low privileged     attacker having Local Logon privilege with logon to the infrastructure where Oracle Database - Enterprise     Edition Sharding executes to compromise Oracle Database - Enterprise Edition Sharding. While the     vulnerability is in Oracle Database - Enterprise Edition Sharding, attacks may significantly impact     additional products (scope change). Successful attacks of this vulnerability can result in takeover of     Oracle Database - Enterprise Edition Sharding. (CVE-2022-21510)

  - Vulnerability in the Oracle Database - Enterprise Edition Recovery component of Oracle Database Server. For     supported versions that are affected see note. Easily exploitable vulnerability allows high privileged     attacker having EXECUTE ON DBMS_IR.EXECUTESQLSCRIPT privilege with network access via Oracle Net to compromise Oracle     Database - Enterprise Edition Recovery. Successful attacks of this vulnerability can result in takeover of     Oracle Database - Enterprise Edition Recovery. Note: None of the supported versions are affected. (CVE-2022-21511)

  - Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are     12.1.0.2, 19c and 21c. Easily exploitable vulnerability allows low privileged attacker having Create Procedure     privilege with network access via Oracle Net to compromise Java VM. Successful attacks of this vulnerability     can result in unauthorized creation, deletion or modification access to critical data or all Java VM accessible     data. (CVE-2022-21565)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
416587	SCA: security update for org.liquibase:liquibase-core (GHSA-jvfv-hrrc-6q72)	Tenable Cloud Security	SCA Checks	critical
416587	SCA: security update for org.liquibase:liquibase-core (GHSA-jvfv-hrrc-6q72)	Tenable Self-Hosted Container Security	SCA Checks	critical
163408	Oracle Database Server (Jul 2022 CPU)	Nessus	Databases	critical

Detections

Analytics

CVE-2022-0839

critical

Tenable Plugins

critical

critical

critical