The version of Oracle WebLogic Server installed on the remote host is affected by multiple vulnerabilities :

  - The Sites subcomponent is affected by a security bypass     vulnerability in the Apache Xalan-Java library due to a     failure to properly restrict access to certain     properties when FEATURE_SECURE_PROCESSING is enabled. A     remote attacker can exploit this to bypass restrictions     and load arbitrary classes or access external resources.
    (CVE-2014-0107)

  - The WLS Security component is affected by a remote code     execution vulnerability due to unsafe deserialize calls     of unauthenticated Java objects to the Apache Commons     Collections (ACC) library. A remote attacker, via a     crafted serialized Java object in T3 protocol traffic to     TCP port 7001, can exploit this to execute arbitrary     commands. (CVE-2015-4852)

  - An unspecified vulnerability exists in the WLS-Console     subcomponent that allows a remote attacker to affect     the integrity of the system. No other details are     available. (CVE-2016-0464)

  - An unspecified vulnerability exists in the Coherence     Container subcomponent that allows a remote attacker to     affect the confidentiality, integrity, and availability     of the system. No other details are available.
    (CVE-2016-0572)

  - An unspecified vulnerability exists in the WLS Java     Messaging Service subcomponent that allows a remote     attacker to affect the confidentiality, integrity, and     availability of the system. No other details are     available. (CVE-2016-0573)

  - Multiple unspecified vulnerabilities exist in the WLS     Core Components subcomponent that allow a remote     attacker to affect the confidentiality, integrity, and     availability of the system. No other details are     available. (CVE-2016-0574, CVE-2016-0577)

Detections

Analytics

Oracle WebLogic Server Multiple Vulnerabilities (January 2016 CPU)

high Nessus Plugin ID 88053

Version 1.536