Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.21 before 1.26. Users are recommended to upgrade to version 1.26, which fixes the issue.

The version of Oracle JDeveloper installed on the remote host is missing a security patch. It is, therefore, affected by denial of service vulnerability as referenced in the July 2025 CPU advisory. 

  - Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: ADF (Apache Commons     Compress)). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability     allows unauthenticated attacker with logon to the infrastructure where Oracle JDeveloper executes to     compromise Oracle JDeveloper. Successful attacks require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of Oracle JDeveloper. (CVE-2024-26308)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version   number.

The version of Oracle Business Process Management Suite installed on the remote host is affected by multiple vulnerabilities, as referenced in the April 2025 CPU advisory, as follows:

  - Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware     (component: Composer, Common (Apache Commons Compress)). The supported version that is affected     is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the     infrastructure where Oracle Business Process Management Suite executes to compromise Oracle Business     Process Management Suite. Successful attacks require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of Oracle Business Process Management Suite. (CVE-2024-25710)

  - Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware     (component: Plugins (Apache FOP)). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle     Business Process Management Suite. Successful attacks of this vulnerability can result in unauthorized     access to critical data or complete access to all Oracle Business Process Management Suite accessible     data. (CVE-2024-28168)

  - Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component:
    Composer, Third Party (Apache Avro)). The supported version that is affected is 12.2.1.4.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle     Business Process Management Suite. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Oracle Business Process Management Suite accessible data as     well as unauthorized read access to a subset of Oracle Business Process Management Suite accessible data     and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Business Process     Management Suite. (CVE-2024-47561)

  - Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware     (component: Runtime Engine (Apache Mina)). Supported versions that are affected are 12.2.1.4.0 and     14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via     HTTP to compromise Oracle Business Process Management Suite. Successful attacks of this vulnerability     can result in takeover of Oracle Business Process Management Suite. (CVE-2024-52046)


Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue     affects Apache Commons Compress: from 1.21 before 1.26. Users are recommended to upgrade to version 1.26,     which fixes the issue. (CVE-2024-26308)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue
    affects Apache Commons Compress: from 1.21 before 1.26. Users are recommended to upgrade to version 1.26,
    which fixes the issue. (CVE-2024-26308)

The version of Oracle Business Intelligence Enterprise Edition (OAS) 7.0.0.0 installed on the remote host is affected by multiple vulnerabilities as referenced in the October 2024 CPU advisory, including the following:

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Analytics Server (OpenSSL)). Supported versions that are affected are 7.0.0.0.0 and     7.6.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS     to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability     can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Business     Intelligence Enterprise Edition. (CVE-2023-5678)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Analytics Server (curl)). Supported versions that are affected are 7.0.0.0.0, 7.6.0.0.0     and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via     SOCKS5 to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this     vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. (CVE-2023-38545)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: BI Platform Security, Analytics Web Answers (RequireJS)). Supported versions that are     affected are 7.0.0.0.0, 7.6.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated     attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.     Successful attacks of this vulnerability can result in unauthorized access to critical data or complete     access to all Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized     update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible     data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Business     Intelligence Enterprise Edition. (CVE-2024-38999)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Oracle Application Testing Suite installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2024 CPU advisory.

  - Vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager (component:
    Load Testing for Web Apps (Apache Commons Compress)). The supported version that is affected is 13.3.0.1.
    Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where     Oracle Application Testing Suite executes to compromise Oracle Application Testing Suite. Successful     attacks require human interaction from a person other than the attacker. Successful attacks of this     vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete     DOS) of Oracle Application Testing Suite. (CVE-2023-42503, CVE-2024-26308, CVE-2024-25710)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 13.5.0.0 versions of Enterprise Manager Base Platform installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2024 CPU advisory.

  - Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager     (component: Agent Next Gen (BSAFE Crypto-J)). The supported version that is affected is 13.5.0.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in takeover     of Oracle Enterprise Manager Base Platform. (CVE-2022-34381)

  - Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager     (component: Agent Next Gen (Eclipse Jetty)). The supported version that is affected is 13.5.0.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise     Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in     unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Enterprise     Manager Base Platform. (CVE-2024-22201)

  - Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager     (component: Job System (Netty)). The supported version that is affected is 13.5.0.0. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Enterprise     Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized ability to     cause a partial denial of service (partial DOS) of Oracle Enterprise Manager Base Platform.
    (CVE-2024-29025)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 12.2.1.4.0 and 14.1.1.0.0 versions of WebLogic Server installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2024 CPU advisory:

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported     versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated     attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this     vulnerability can result in takeover of Oracle WebLogic Server. (CVE-2024-21181) 

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported     versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated     attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this     vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle     WebLogic Server accessible data. (CVE-2024-21175)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported     versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated     attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this     vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server     accessible data. (CVE-2024-21182)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle Essbase installed on the remote host is missing a security patch from the July 2024 Critical Patch Update (CPU). It is, therefore, affected by:

  - Vulnerability in Oracle Essbase (component: Essbase Web Platform (Apache Xerces-C++)). The supported version that     is affected is 21.5.6. Easily exploitable vulnerability allows high privileged attacker with logon to the     infrastructure where Oracle Essbase executes to compromise Oracle Essbase. Successful attacks of this     vulnerability can result in takeover of Oracle Essbase. (CVE-2023-37536)

  - Vulnerability in Oracle Essbase (component: Essbase Web Platform (Apache Commons Compress)). The supported version     that is affected is 21.5.6. Easily exploitable vulnerability allows unauthenticated attacker with logon to the     infrastructure where Oracle Essbase executes to compromise Oracle Essbase. Successful attacks require human     interaction from a person other than the attacker. Successful attacks of this vulnerability can result in     unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Essbase.
    (CVE-2024-26308)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 12.2.1.4.0 versions of WebCenter Portal installed on the remote host are affected by a vulnerability as referenced in the July 2024 CPU advisory.

  - Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portal Core (Apache     SOAP)). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal. Successful attacks of     this vulnerability can result in takeover of Oracle WebCenter Portal. (CVE-2022-45378)

  - Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Discussion Forums     (JSON-java)). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal. Successful attacks     of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete     DOS) of Oracle WebCenter Portal. (CVE-2023-5072)

  - Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework     (Apache Commons Compress)). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability     allows unauthenticated attacker with logon to the infrastructure where Oracle WebCenter Portal executes to     compromise Oracle WebCenter Portal. Successful attacks require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of Oracle WebCenter Portal. (CVE-2024-26308) 

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The versions of Primavera Gateway installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2024 CPU advisory.

  - Denial of Service in JSON-Java versions up to and including 20230618. A bug in the parser means that an     input string of modest size can lead to indefinite amounts of memory being used. (CVE-2023-5072)

  - Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress. This issue     affects Apache Commons Compress: from 1.21 before 1.26. Users are recommended to upgrade to version 1.26,     which fixes the issue. (CVE-2024-26308)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Primavera Unifier installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2024 CPU advisory.

  - The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation     can reset many streams quickly, as exploited in the wild in August through October 2023. (CVE-2023-44487)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Document     Management (Apache Solr)). Supported versions that are affected are 19.12.0-19.12.16, 20.12.0-20.12.16,     21.12.0-21.12.17, 22.12.0-22.12.12 and 23.12.0-23.12.3. Easily exploitable vulnerability allows low     privileged attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks of     this vulnerability can result in unauthorized update, insert or delete access to some of Primavera     Unifier accessible data as well as unauthorized read access to a subset of Primavera Unifier accessible     data and unauthorized ability to cause a partial denial of service (partial DOS) of Primavera Unifier.
    (CVE-2023-50298)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Document     Management (Apache Solr)). Supported versions that are affected are 19.12.0-19.12.16, 20.12.0-20.12.16,     21.12.0-21.12.17, 22.12.0-22.12.12 and  23.12.0-23.12.3. Easily exploitable vulnerability allows low     privileged attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks of     this vulnerability can result in unauthorized update, insert or delete access to some of Primavera     Unifier accessible data as well as unauthorized read access to a subset of Primavera Unifier accessible     data and unauthorized ability to cause a partial denial of service (partial DOS) of Primavera Unifier.
    (CVE-2023-50386)

  - Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress. This     issue affects Apache Commons Compress: from 1.3 through 1.25.0. Users are recommended to upgrade to     version 1.26.0 which fixes the issue. (CVE-2024-25710)

  - Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress. This issue     affects Apache Commons Compress: from 1.21 before 1.26. Users are recommended to upgrade to version 1.26,     which fixes the issue. (CVE-2024-26308)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 12.2.1.4.0 and 14.1.1.0.0 versions of WebLogic Server installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2024 CPU advisory:

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Samples (handlebars)).     Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows \     unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of     this vulnerability can result in takeover of Oracle WebLogic Server. (CVE-2021-23369)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized Thirdparty     Jars (Bouncy Castle Java Library)). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise     Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset     of Oracle WebLogic Server accessible data. (CVE-2023-2976)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). The     supported version that is affected is 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker     with network access via HTTP/2 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can     result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic     Server. (CVE-2023-44487)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0726-1 advisory.

    apache-commons-codec was updated to version 1.16.1:

    - Changes in version 1.16.1:

      * New features:

        - Added Maven property project.build.outputTimestamp for build reproducibility

      * Bugs fixed:

        - Correct error in Base64 Javadoc
        - Added minimum Java version in changes.xml
        - Documentation update for the org.apache.commons.codec.digest.* package
        - Precompile regular expression in UnixCrypt.crypt(byte[], String)
        - Fixed possible IndexOutOfBoundException in PhoneticEngine.encode method
        - Fixed possible ArrayIndexOutOfBoundsException in QuotedPrintableCodec.encodeQuotedPrintable() method
        - Fixed possible StringIndexOutOfBoundException in MatchRatingApproachEncoder.encode() method
        - Fixed possible ArrayIndexOutOfBoundException in RefinedSoundex.getMappingCode()
        - Fixed possible IndexOutOfBoundsException in PercentCodec.insertAlwaysEncodeChars() method
        - Deprecated UnixCrypt 0-argument constructor
        - Deprecated Md5Crypt 0-argument constructor
        - Deprecated Crypt 0-argument constructor
        - Deprecated StringUtils 0-argument constructor
        - Deprecated Resources 0-argument constructor
        - Deprecated Charsets 0-argument constructor
        - Deprecated CharEncoding 0-argument constructor

    - Changes in version 1.16.0:

      * Remove duplicated words from Javadocs
      * Use Standard Charset object
      * Use String.contains() functions
      * Avoid use toString() or substring() in favor of a simplified expression
      * Fixed byte-skipping in Base16 decoding
      * Fixed several typos, improve writing in some javadocs
      * BaseNCodecOutputStream.eof() should not throw IOException.
      * Javadoc improvements and cleanups.
      * Deprecated BaseNCodec.isWhiteSpace(byte) and use Character.isWhitespace(int).
      * Added support for Blake3 family of hashes
      * Added github/codeql-action
      * Bump actions/cache from v2 to v3.0.10
      * Bump actions/setup-java from v1.4.1 to 3.5.1
      * Bump actions/checkout from 2.3.2 to 3.1.0
      * Bump commons-parent from 52 to 58
      * Bump junit from 4.13.1 to 5.9.1
      * Bump Java 7 to 8.
      * Bump japicmp-maven-plugin from 0.14.3 to 0.17.1.
      * Bump jacoco-maven-plugin from 0.8.5 to 0.8.8 (Fixes Java 15 builds).
      * Bump maven-surefire-plugin from 2.22.2 to 3.0.0-M7
      * Bump maven-javadoc-plugin from 3.2.0 to 3.4.1.
      * Bump animal-sniffer-maven-plugin from 1.19 to 1.22.
      * Bump maven-pmd-plugin from 3.13.0 to 3.19.0
      * Bump pmd from 6.47.0 to 6.52.0.
      * Bump maven-checkstyle-plugin from 2.17 to 3.2.0
      * Bump checkstyle from 8.45.1 to 9.3
      * Bump taglist-maven-plugin from 2.4 to 3.0.0
      * Bump jacoco-maven-plugin from 0.8.7 to 0.8.8.

    apache-commons-compress was updated to version 1.26:

    - Changes in version 1.26:

      * Security issues fixed:

        - CVE-2024-26308: Fixed allocation of Resources Without Limits or Throttling vulnerability in           Apache Commons Compress (bsc#1220068)
        - CVE-2024-25710: Fixed loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in           Apache Commons Compress (bsc#1220070)

      * New Features:

        - Added and use ZipFile.builder(), ZipFile.Builder, and deprecate constructors
        - Added and use SevenZFile.builder(), SevenZFile.Builder, and deprecate constructors
        - Added and use ArchiveInputStream.getCharset()
        - Added and use ArchiveEntry.resolveIn(Path)
        - Added Maven property project.build.outputTimestamp for build reproducibility

      * Bugs fixed:

        + Check for invalid PAX values in TarArchiveEntry         + Fixed zero size headers in ArjInputStream         + Fixes and tests for ArInputStream         + Fixes for dump file parsing         + Improved CPIO exception detection and handling         + Deprecated SkipShieldingInputStream without replacement (nolonger used)         + Reuse commons-codec, don't duplicate class PureJavaCrc32C (removed package-private class)         + Reuse commons-codec, don't duplicate class XXHash32 (deprecated class)         + Reuse commons-io, don't duplicate class Charsets (deprecated class)         + Reuse commons-io, don't duplicate class IOUtils (deprecated methods)         + Reuse commons-io, don't duplicate class BoundedInputStream (deprecated class)         + Reuse commons-io, don't duplicate class FileTimes (deprecated TimeUtils methods)         + Reuse Arrays.equals(byte[], byte[]) and deprecate ArchiveUtils.isEqual(byte[], byte[])         + Added a null-check for the class loader of OsgiUtils         + Added a null-check in Pack200.newInstance(String, String)         + Deprecated ChecksumCalculatingInputStream in favor of java.util.zip.CheckedInputStream         + Deprecated CRC32VerifyingInputStream.CRC32VerifyingInputStream(InputStream, long, int)         + FramedSnappyCompressorOutputStream produces incorrect output when writing a large buffer         + Fixed TAR directory entries being misinterpreted as files         + Deprecated unused method FileNameUtils.getBaseName(String)         + Deprecated unused method FileNameUtils.getExtension(String)         + ArchiveInputStream.BoundedInputStream.read() incorrectly adds 1 for EOF to the bytes read count         + Deprecated IOUtils.read(File, byte[])         + Deprecated IOUtils.copyRange(InputStream, long, OutputStream, int)         + ZipArchiveOutputStream multi archive updates metadata in incorrect file         + Deprecated ByteUtils.InputStreamByteSupplier         + Deprecated ByteUtils.fromLittleEndian(InputStream, int)         + Deprecated ByteUtils.toLittleEndian(DataOutput, long, int)         + Reduce duplication by having ArchiveInputStream extend FilterInputStream         + Support preamble garbage in ZipArchiveInputStream         + Fixed formatting the lowest expressable DOS time         + Dropped  reflection from ExtraFieldUtils static initialization         + Preserve exception causation in ExtraFieldUtils.register(Class)

    - Changes in version 1.25:

      * For the full list of changes please consult:
        https://commons.apache.org/proper/commons-compress/changes-report.html#a1.25.0

    - Changes in version 1.24:

      * For the full list of changes please consult:
        https://commons.apache.org/proper/commons-compress/changes-report.html#a1.24.0

    - Changes in version 1.23:

      * For the full list of changes please consult:
        https://commons.apache.org/proper/commons-compress/changes-report.html#a1.23.0

    - Changes in version 1.22:

      * For the full list of changes please consult:
        https://commons.apache.org/proper/commons-compress/changes-report.html#a1.22

    apache-commons-io was updated to version 2.15.1:

    - Changes in version 2.15.1:

      * For the full list of changes please consult:
        https://commons.apache.org/proper/commons-io/changes-report.html#a2.15.1

    - Changes in version 2.15.0:

      * For the full list of changes please consult:
        https://commons.apache.org/proper/commons-io/changes-report.html#a2.15.0

    - Changes in version 2.14.0:

      * For the full list of changes please consult:
        https://commons.apache.org/proper/commons-io/changes-report.html#a2.14.0

    javapackages-meta:

    - Syncing the version with javapackages-tools 6.2.0
    - Remove unnecessary dependencies

    maven was updated to version 3.9.6:

    - Changes in version 3.9.6:

      * Bugs fixed:

        + Error message when modelVersion is 4.0 is confusing

      * Improvements:

        + Colorize transfer messages         + Support ${project.basedir} in file profile activation         + Allow to exclude plugins from validation

      * Tasks:

        + Maven Resolver Provider classes ctor change         + Undeprecate wrongly deprecated repository metadata         + Deprecated `org.apache.maven.repository.internal.MavenResolverModule`         + maven-resolver-provider: introduce NAME constants.

      * Dependency upgrade:

        + Updated  to Resolver 1.9.16         + Upgraded Sisu version to 0.9.0.M2         + Upgraded Resolver version to 1.9.18         + Upgraded to parent POM 41         + Upgraded default plugin bindings

    maven-assembly-plugin:

    - Explicitely require commons-io:commons-io and commons-codec:common-codes artifacts that are optional in       apache-commons-compress

    maven-doxia was updated to version 1.12.0:

      * Changes in version 1.12.0:

        + Upgraded to FOP 2.2         + Fixed rendering links and paragraphs inside tables         + Rewrite .md and .markdown links to .html         + Upgraded HttpComponents: httpclient to 4.5.8 and httpcore to 4.4.11         + Escape links to xml based figureGraphics image elements         + SECURITY: Use HTTPS to resolve dependencies in Maven Build         + Removed old Maven 1 and 2 info         + Updated commons-lang to 3.8.1         + Dropped  dependency to outdated Log4j         + Fixed Java 7 compatibility that was broken         + Import tests from maven-site-plugin         + Fixed crosslinks starting with a dot in markdown files         + Replace deprecated class from commons-lang         + Fill in some generic types

    maven-doxia-sitetools was updated to version 1.11.1:

    - Changes in version 1.11.1:

      * Bugs fixed:

        + CLIRR can't find previous version

      * Improvements:

        + Removed all  in default-site-macros.vm and replace by a space         + Improved documentation on site.xml inheritance vs interpolation

      * Tasks:

        + Deprecated Doxia Sitetools Doc Renderer

      * Dependency upgrade:

        + Fixed javadoc issues with JDK 8 when generating documentation         + Wrong coordinates for jai_core: hyphen should be underscore         + Use latest JUnit version 4.13.2         + Upgraded Plexus Utils to 3.3.0         + Upgraded Plexus Interpolation to 1.26         + Upgraded Maven Doxia to 1.10         + Upgraded Maven Doxia to 1.11.1

    maven-jar-plugin was updated to version 3.3.0:

    - Changes in version 3.3.0:

      * Bugs fixed:

        + outputTimestamp not applied to module-info; breaks reproducible builds

      * Task:

        + Updated plugin (requires Maven 3.2.5+)         + Java 8 as minimum

      * Dependency upgrade:

        + Upgraded Plexus Utils to 3.3.1         + Removed override for Plexus Archiver to fix order of META-INF/ and META-INF/MANIFEST.MF entries         + Upgraded Parent to 36         + Updated Plexus Utils to 3.4.2         + Upgraded Parent to 37

    maven-jar-plugin was updated to version 3.6.0:

    - Changes from version 3.6.0:

      * Bugs fixed:

        + Setting maven.javadoc.isoffline seems to have no effect         + javadoc site is broken for projects that contain modules         + Alternative doclet page points to an SEO spammy page         + [REGRESSION] Transitive dependencies of docletArtifact missing         + Unresolvable link in javadoc tag with value ResourcesBundleMojo#getAttachmentClassifier() found in           ResourcesBundleMojo         + IOException --> NullPointerException in JavadocUtil.copyResource         + JavadocReportTest.testExceptions is broken         + javadoc creates invalid --patch-module statements         + javadoc plugin can not deal with transitive filename based modules

      * Improvements:

        + Clean up deprecated and unpreferred methods in JavadocUtil         + Cleanup dependency declarations as best possible         + Allow building javadoc 'the old fashioned way' after Java 8

      * Tasks:

        + Dropped  use of deprecated localRepository mojo           parameter         + Make build pass with Java 20         + Refresh download page

      * Dependency upgrade:

        + Updated  to commons-io 2.13.0         + Updated  plexus-archiver from 4.7.1 to 4.8.0         + Upgraded Parent to 40

    - Changes from version 3.5.0:

      * Bugs fixed:

        + Invalid anchors in Javadoc and plugin mojo         + Plugin duplicates classes in Java 8 all-classes lists         + javadoc site creation ignores configuration parameters

      * Improvements:

        + Deprecated parameter 'stylesheet'         + Parse stderr output and suppress informational lines         + Link to Javadoc references from JDK 17         + Migrate components to JSR 330, get rid of maven-artifact-transfer, update to parent 37

      * Tasks:

        + Removed remains of org.codehaus.doxia.sink.Sink

      * Dependency upgrades:

        + Upgraded plugins in ITs         + Upgraded to Maven 3.2.5         + Updated  Maven Archiver to 3.6.0         + Upgraded Maven Reporting API to 3.1.1/Complete           with Maven Reporting Impl 3.2.0         + Upgraded commons-text to 1.10.0         + Upgraded Parent to 39         + Upgraded plugins and components

    maven-reporting-api was updated to version 3.1.1:

    - Restore binary compat for MavenReport

    maven-reporting-impl was updated to version 3.2.0:

    - Changes in version 3.2.0:

      * Improvement:

        + Render with a skin when report is run in standalone mode

      * Dependency upgrades:

        + Upgraded Maven Reporting API to 3.1.1         + Upgraded plugins and components in project and ITs

    maven-resolver was updated to version 1.9.18:

    - Changes in version 1.9.18:

      * Bugs fixed:

        + Sporadic AccessDeniedEx on Windows         + Undo FileUtils changes that altered non-Windows execution path

      * Improvements:

        + Native transport should retry on HTTP 429 (Retry-After)

      * Task:

        + Deprecated Guice modules         + Get rid of component name string literals, make them constants and reusable         + Expose configuration for inhibiting Expect-Continue handshake in 1.x         + Refresh download page         + Resolver should not override given HTTP transport default use of expect-continue handshake

    maven-resources-plugin was updated to version 3.3.1:

    - Changes in version 3.3.1:

      * Bugs fixed:

        + Resource plugin's handling of symbolic links changed in 3.0.x, broke existing behavior         + Resource copying not using specified encoding         + java.nio.charset.MalformedInputException: Input length = 1         + Filtering of Maven properties with long names is not working after transition from 2.6 to 3.2.0         + Valid location for directory parameter is always required         + Symlinks cause copying resources to fail         + FileUtils.copyFile() fails with source file having `lastModified = 0`

      * New Features:

        + Added ability to flatten folder structure into target directory when copying resources

      * Improvements:

        + Make tests jar reproducible         + Describe from and to in 'Copying xresources' info message

      * Task:

        + Dropped  plexus legacy         + Updated  to parent POM 39, reformat sources         + Updated  plugin (requires Maven 3.2.5+)         + Require Java 8

      * Dependency upgrade:

        + Upgraded maven-plugin parent to 36         + Upgraded Maven Filtering to 3.3.0         + Upgraded plexus-utils to 3.5.1         + Upgraded to maven-filtering 3.3.1

    sbt:

    - Fixed RPM package build with maven 3.9.6 and maven-resolver 1.9.18

    xmvn:

    - Modify the xmvn-install script to work with new apache-commons-compress
    - Recompiling RPM package to resolve package building issues with maven-lib

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
242627	Oracle JDeveloper DoS (July 2025 CPU)	Nessus	Misc.	Local	medium
234503	Oracle Business Process Management Suite (April 2025 CPU)	Nessus	Misc.	Local	critical
227888	Linux Distros Unpatched Vulnerability : CVE-2024-26308	Nessus	Misc.	Local	medium
409805	SCA: security update for org.apache.commons:commons-compress (GHSA-4265-ccf5-phj5)	Tenable Cloud Security	SCA Checks	Local	medium
409805	SCA: security update for org.apache.commons:commons-compress (GHSA-4265-ccf5-phj5)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
210338	Oracle Business Intelligence Enterprise Edition (OAS 7.0) (October 2024 CPU)	Nessus	Misc.	Local	critical
209387	Oracle Application Testing Suite (October 2024 CPU)	Nessus	Misc.	Local	medium
209256	Oracle Enterprise Manager Cloud Control (October 2024 CPU)	Nessus	Misc.	Local	critical
202722	Oracle WebLogic Server (July 2024 CPU)	Nessus	Misc.	Local	critical
202719	Oracle Essbase Multiple Vulnerabilities (July 2024 CPU)	Nessus	Misc.	Local	high
202598	Oracle WebCenter Portal (July 2024 CPU)	Nessus	Misc.	Local	critical
193486	Oracle Primavera Gateway (April 2024 CPU)	Nessus	CGI abuses	Remote	high
193436	Oracle Primavera Unifier (April 2024 CPU)	Nessus	CGI abuses	Remote	high
193425	Oracle WebLogic Server (April 2024 CPU)	Nessus	Misc.	Local	critical
191447	SUSE SLED15: apache-commons-codec / apache-commons-codec-javadoc / etc (SUSE-SU-2024:0726-1)	Nessus	SuSE Local Security Checks	Local	medium

Detections

Analytics

CVE-2024-26308

medium

Tenable Plugins

medium

critical

medium

medium

medium

critical

medium

critical

critical

high

critical

high

high

critical

medium