A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.5 and 3.4.10 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type.

The 5.9.0.0 and 6.4.0.0 versions of Oracle Business Intelligence Enterprise Edition installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2023 CPU advisory.

  - Vulnerability in the BI Publisher product of Oracle Analytics (component: Security (Apache CXF)). The     supported version that is affected is 6.4.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker     with network access via HTTP to compromise BI Publisher. Successful attacks of this vulnerability can result in     takeover of BI Publisher. (CVE-2022-46364)

  - Vulnerability in the BI Publisher product of Oracle Analytics (component: Development Operations (Snowflake     JDBC)). The supported version that is affected is 7.0.0.0.0. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise BI Publisher. Successful attacks require human     interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover     of BI Publisher. (CVE-2023-30535)

  - Vulnerability in the BI Publisher product of Oracle Analytics (component: Web Server (Spring Framework)).
    Supported versions that are affected are 6.4.0.0.0 and 7.0.0.0.0. Easily exploitable vulnerability allows low     privileged attacker with network access via HTTP to compromise BI Publisher. Successful attacks of this     vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of BI     Publisher. (CVE-2023-20861)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle Business Intelligence Enterprise Edition (OAS) 6.4.0.0.0 and 7.0.0.0 installed on the remote host are affected by a vulnerability as referenced in the July 2023 CPU advisory. 

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Analytics Server (Apache Hive)). Supported versions that are affected are 6.4.0.0.0,     7.0.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network     access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of     this vulnerability can result in unauthorized creation, deletion or modification access to critical data     or all Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized access to     critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data.
    (CVE-2018-1282)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Visual Analyzer (jackson-databind)). Supported versions that are affected are 6.4.0.0.0 and     7.0.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of     Oracle Business Intelligence Enterprise Edition. (CVE-2022-33980)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Visual Analyzer (CKEditor)). Supported versions that are affected are 6.4.0.0.0 and     7.0.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks require human     interaction from a person other than the attacker and while the vulnerability is in Oracle Business     Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change).     Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to     some of Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized read     access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. (CVE-2023-28439)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, Zimbra Collaboration Server is affected by multiple vulnerabilities including:

  - Vulnerability in the sfdc_preauth.jsp component. A remote, unauthenticated attacker can exploit this     vulnerability to execute arbitrary code. (CVE-2023-29382)

  - HTTP request smuggling vulnerability in the bundled Apache HTTP Server component. Exploitation of this     vulnerability can result in the bypass of access controls in the proxy server, proxying unintended URLs     to existing origin servers and cache poisoning. (CVE-2023-25690)

  - An server-side request forgery vulnerability in the bundled Apache CXF component. (CVE-2022-46364)

  - A cross-site scripting (XSS) vulnerability in the /h/autoSaveDraft function. A remote authenticated     attacker can executed arbitrary code in the context of another user. (CVE-2023-34192)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, Zimbra Collaboration Server is affected by multiple vulnerabilities including:

  - Vulnerability in the sfdc_preauth.jsp component. A remote, unauthenticated attacker can exploit this     vulnerability to execute arbitrary code. (CVE-2023-29382)

  - HTTP request smuggling vulnerability in the bundled Apache HTTP Server component. Exploitation of this     vulnerability can result in the bypass of access controls in the proxy server, proxying unintended URLs     to existing origin servers and cache poisoning. (CVE-2023-25690)

  - An SSRF vulnerability in the bundled Apache CXF component. (CVE-2022-46364)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle Essbase installed on the remote host is missing a security patch from the April 2023 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilities, including following that are remotely exploitable:

  - Vulnerability in Security and Provisioning component of Oracle Essbase version 21.4. The public API function BIO_new_NDEF is     a helper function used for streaming ASN.1 data via a BIO. Under certain conditions, the BIO chain is not properly cleaned up     and the BIO passed by the caller still retains internal pointers to the previously freed filter BIO. This will most likely     result in a crash. (CVE-2023-0215)

  - Vulnerability in Security and Provisioning component of Oracle Essbase version 21.4. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Oracle Essbase. Successful attacks require human interaction     from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical     data or complete access to all Oracle Essbase accessible data. (CVE-2023-21942, CVE-2023-21943, CVE-2023-21944)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1044 advisory.

  - bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute (CVE-2018-14040)

  - bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip (CVE-2018-14042)

  - jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or     property injection (CVE-2019-11358)

  - jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)

  - jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods     (CVE-2020-11023)

  - glob-parent: Regular Expression Denial of Service (CVE-2021-35065)

  - minimist: prototype pollution (CVE-2021-44906)

  - keycloak: HTML injection in execute-actions-email Admin REST API (CVE-2022-1274)

  - keycloak: XSS on impersonation under specific circumstances (CVE-2022-1438)

  - SnakeYaml: Constructor Deserialization Remote Code Execution (CVE-2022-1471)

  - Undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations     (CVE-2022-2764)

  - keycloak: Session takeover with OIDC offline refreshtokens (CVE-2022-3916)

  - keycloak: reflected XSS attack (CVE-2022-4137)

  - Moment.js: Path traversal  in moment.locale (CVE-2022-24785)

  - snakeyaml: Denial of Service due to missing nested depth limitation for collections (CVE-2022-25857)

  - moment: inefficient parsing algorithm resulting in DoS (CVE-2022-31129)

  - loader-utils:Regular expression denial of service (CVE-2022-37603)

  - snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode (CVE-2022-38749)

  - snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject     (CVE-2022-38750)

  - snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match (CVE-2022-38751)

  - jettison: parser crash by stackoverflow (CVE-2022-40149)

  - jettison: memory exhaustion via user-supplied XML or JSON data (CVE-2022-40150)

  - jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003)

  - jackson-databind: use of deeply nested arrays (CVE-2022-42004)

  - mina-sshd: Java unsafe deserialization vulnerability (CVE-2022-45047)

  - jettison:  If the value in map is the map's self, the new new JSONObject(map) cause StackOverflowError     which may lead to dos (CVE-2022-45693)

  - json5: Prototype Pollution in JSON5 via Parse Method (CVE-2022-46175)

  - Apache CXF: directory listing / code exfiltration (CVE-2022-46363)

  - Apache CXF: SSRF Vulnerability (CVE-2022-46364)

  - keycloak: Client Registration endpoint does not check token revocation (CVE-2023-0091)

  - keycloak: user impersonation via stolen uuid code (CVE-2023-0264)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1043 advisory.

  - bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute (CVE-2018-14040)

  - bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip (CVE-2018-14042)

  - jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or     property injection (CVE-2019-11358)

  - jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)

  - jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods     (CVE-2020-11023)

  - glob-parent: Regular Expression Denial of Service (CVE-2021-35065)

  - minimist: prototype pollution (CVE-2021-44906)

  - keycloak: HTML injection in execute-actions-email Admin REST API (CVE-2022-1274)

  - keycloak: XSS on impersonation under specific circumstances (CVE-2022-1438)

  - SnakeYaml: Constructor Deserialization Remote Code Execution (CVE-2022-1471)

  - Undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations     (CVE-2022-2764)

  - keycloak: Session takeover with OIDC offline refreshtokens (CVE-2022-3916)

  - keycloak: reflected XSS attack (CVE-2022-4137)

  - Moment.js: Path traversal  in moment.locale (CVE-2022-24785)

  - snakeyaml: Denial of Service due to missing nested depth limitation for collections (CVE-2022-25857)

  - moment: inefficient parsing algorithm resulting in DoS (CVE-2022-31129)

  - loader-utils:Regular expression denial of service (CVE-2022-37603)

  - snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode (CVE-2022-38749)

  - snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject     (CVE-2022-38750)

  - snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match (CVE-2022-38751)

  - jettison: parser crash by stackoverflow (CVE-2022-40149)

  - jettison: memory exhaustion via user-supplied XML or JSON data (CVE-2022-40150)

  - jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003)

  - jackson-databind: use of deeply nested arrays (CVE-2022-42004)

  - mina-sshd: Java unsafe deserialization vulnerability (CVE-2022-45047)

  - jettison:  If the value in map is the map's self, the new new JSONObject(map) cause StackOverflowError     which may lead to dos (CVE-2022-45693)

  - json5: Prototype Pollution in JSON5 via Parse Method (CVE-2022-46175)

  - Apache CXF: directory listing / code exfiltration (CVE-2022-46363)

  - Apache CXF: SSRF Vulnerability (CVE-2022-46364)

  - keycloak: Client Registration endpoint does not check token revocation (CVE-2023-0091)

  - keycloak: user impersonation via stolen uuid code (CVE-2023-0264)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1045 advisory.

  - bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute (CVE-2018-14040)

  - bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip (CVE-2018-14042)

  - jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or     property injection (CVE-2019-11358)

  - jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)

  - jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods     (CVE-2020-11023)

  - glob-parent: Regular Expression Denial of Service (CVE-2021-35065)

  - minimist: prototype pollution (CVE-2021-44906)

  - keycloak: HTML injection in execute-actions-email Admin REST API (CVE-2022-1274)

  - keycloak: XSS on impersonation under specific circumstances (CVE-2022-1438)

  - SnakeYaml: Constructor Deserialization Remote Code Execution (CVE-2022-1471)

  - Undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations     (CVE-2022-2764)

  - keycloak: Session takeover with OIDC offline refreshtokens (CVE-2022-3916)

  - keycloak: reflected XSS attack (CVE-2022-4137)

  - Moment.js: Path traversal  in moment.locale (CVE-2022-24785)

  - snakeyaml: Denial of Service due to missing nested depth limitation for collections (CVE-2022-25857)

  - moment: inefficient parsing algorithm resulting in DoS (CVE-2022-31129)

  - loader-utils:Regular expression denial of service (CVE-2022-37603)

  - snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode (CVE-2022-38749)

  - snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject     (CVE-2022-38750)

  - snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match (CVE-2022-38751)

  - jettison: parser crash by stackoverflow (CVE-2022-40149)

  - jettison: memory exhaustion via user-supplied XML or JSON data (CVE-2022-40150)

  - jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003)

  - jackson-databind: use of deeply nested arrays (CVE-2022-42004)

  - mina-sshd: Java unsafe deserialization vulnerability (CVE-2022-45047)

  - jettison:  If the value in map is the map's self, the new new JSONObject(map) cause StackOverflowError     which may lead to dos (CVE-2022-45693)

  - json5: Prototype Pollution in JSON5 via Parse Method (CVE-2022-46175)

  - Apache CXF: directory listing / code exfiltration (CVE-2022-46363)

  - Apache CXF: SSRF Vulnerability (CVE-2022-46364)

  - keycloak: Client Registration endpoint does not check token revocation (CVE-2023-0091)

  - keycloak: user impersonation via stolen uuid code (CVE-2023-0264)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0553 advisory.

  - jquery: Cross-site scripting via cross-domain ajax requests (CVE-2015-9251)

  - bootstrap: XSS in the data-target attribute (CVE-2016-10735)

  - nodejs-moment: Regular expression denial of service (CVE-2017-18214)

  - bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute (CVE-2018-14040)

  - bootstrap: Cross-site Scripting (XSS) in the data-target property of scrollspy (CVE-2018-14041)

  - bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip (CVE-2018-14042)

  - bootstrap: XSS in the tooltip or popover data-template attribute (CVE-2019-8331)

  - jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or     property injection (CVE-2019-11358)

  - jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)

  - jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods     (CVE-2020-11023)

  - wildfly-elytron: possible timing attacks via use of unsafe comparator (CVE-2022-3143)

  - jettison: parser crash by stackoverflow (CVE-2022-40149)

  - jettison: memory exhaustion via user-supplied XML or JSON data (CVE-2022-40150)

  - woodstox-core: woodstox to serialise XML data was vulnerable to Denial of Service attacks (CVE-2022-40152)

  - jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003)

  - jackson-databind: use of deeply nested arrays (CVE-2022-42004)

  - mina-sshd: Java unsafe deserialization vulnerability (CVE-2022-45047)

  - jettison:  If the value in map is the map's self, the new new JSONObject(map) cause StackOverflowError     which may lead to dos (CVE-2022-45693)

  - Apache CXF: SSRF Vulnerability (CVE-2022-46364)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0554 advisory.

  - jquery: Cross-site scripting via cross-domain ajax requests (CVE-2015-9251)

  - bootstrap: XSS in the data-target attribute (CVE-2016-10735)

  - nodejs-moment: Regular expression denial of service (CVE-2017-18214)

  - bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute (CVE-2018-14040)

  - bootstrap: Cross-site Scripting (XSS) in the data-target property of scrollspy (CVE-2018-14041)

  - bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip (CVE-2018-14042)

  - bootstrap: XSS in the tooltip or popover data-template attribute (CVE-2019-8331)

  - jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or     property injection (CVE-2019-11358)

  - jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)

  - jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods     (CVE-2020-11023)

  - wildfly-elytron: possible timing attacks via use of unsafe comparator (CVE-2022-3143)

  - jettison: parser crash by stackoverflow (CVE-2022-40149)

  - jettison: memory exhaustion via user-supplied XML or JSON data (CVE-2022-40150)

  - woodstox-core: woodstox to serialise XML data was vulnerable to Denial of Service attacks (CVE-2022-40152)

  - jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003)

  - jackson-databind: use of deeply nested arrays (CVE-2022-42004)

  - mina-sshd: Java unsafe deserialization vulnerability (CVE-2022-45047)

  - jettison:  If the value in map is the map's self, the new new JSONObject(map) cause StackOverflowError     which may lead to dos (CVE-2022-45693)

  - Apache CXF: SSRF Vulnerability (CVE-2022-46364)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0552 advisory.

  - jquery: Cross-site scripting via cross-domain ajax requests (CVE-2015-9251)

  - bootstrap: XSS in the data-target attribute (CVE-2016-10735)

  - nodejs-moment: Regular expression denial of service (CVE-2017-18214)

  - bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute (CVE-2018-14040)

  - bootstrap: Cross-site Scripting (XSS) in the data-target property of scrollspy (CVE-2018-14041)

  - bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip (CVE-2018-14042)

  - bootstrap: XSS in the tooltip or popover data-template attribute (CVE-2019-8331)

  - jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or     property injection (CVE-2019-11358)

  - jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)

  - jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods     (CVE-2020-11023)

  - wildfly-elytron: possible timing attacks via use of unsafe comparator (CVE-2022-3143)

  - jettison: parser crash by stackoverflow (CVE-2022-40149)

  - jettison: memory exhaustion via user-supplied XML or JSON data (CVE-2022-40150)

  - woodstox-core: woodstox to serialise XML data was vulnerable to Denial of Service attacks (CVE-2022-40152)

  - jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003)

  - jackson-databind: use of deeply nested arrays (CVE-2022-42004)

  - mina-sshd: Java unsafe deserialization vulnerability (CVE-2022-45047)

  - jettison:  If the value in map is the map's self, the new new JSONObject(map) cause StackOverflowError     which may lead to dos (CVE-2022-45693)

  - Apache CXF: SSRF Vulnerability (CVE-2022-46364)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 / 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:0163 advisory.

  - Apache CXF: SSRF Vulnerability (CVE-2022-46364)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
178712	Oracle Business Intelligence Publisher (OBIEE) (July 2023 CPU)	Nessus	Windows	critical
178710	Oracle Business Intelligence Enterprise Edition (OAS) (July 2023 CPU)	Nessus	Misc.	critical
178617	Zimbra Collaboration Server 8.8.x < 8.8.15 Patch 40 Multiple Vulnerabilities	Nessus	CGI abuses	critical
178616	Zimbra Collaboration Server 9.0.0 < 9.0.0 Patch 33 Multiple Vulnerabilities	Nessus	CGI abuses	critical
174567	Oracle Essbase (April 2023 CPU)	Nessus	Misc.	critical
172042	RHEL 8 : Red Hat Single Sign-On 7.6.2 security update on RHEL 8 (Important) (RHSA-2023:1044)	Nessus	Red Hat Local Security Checks	critical
172041	RHEL 7 : Red Hat Single Sign-On 7.6.2 security update on RHEL 7 (Important) (RHSA-2023:1043)	Nessus	Red Hat Local Security Checks	critical
172039	RHEL 9 : Red Hat Single Sign-On 7.6.2 security update on RHEL 9 (Important) (RHSA-2023:1045)	Nessus	Red Hat Local Security Checks	critical
170914	RHEL 8 : Red Hat JBoss Enterprise Application Platform 7.4.9 Security update (Important) (RHSA-2023:0553)	Nessus	Red Hat Local Security Checks	critical
170911	RHEL 9 : Red Hat JBoss Enterprise Application Platform 7.4.9 Security update (Important) (RHSA-2023:0554)	Nessus	Red Hat Local Security Checks	critical
170909	RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.4.9 Security update (Important) (RHSA-2023:0552)	Nessus	Red Hat Local Security Checks	critical
170027	RHEL 7 / 8 / 9 : Red Hat JBoss Enterprise Application Platform 7.4 (RHSA-2023:0163)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2022-46364

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical