The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:0697-1 advisory.

  - Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting     in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note     that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is     not enabled by default and must be explicitly configured. (CVE-2023-24998)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of SAP BusinessObjects Business Intelligence Platform installed on the remote Windows host is using a vulnerable version of commons-fileupload which is vulnerable to Denial of Service due to CVE-2023-24998. 

Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads.

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

The 19c and 21c versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the July CPU advisory.

  - Vulnerability in the Oracle Text (LibExpat) component of Oracle Database Server. Supported versions that     are affected are 19.3-19.19 and 21.3-21.10. Easily exploitable vulnerability allows low privileged     attacker having Create Session, Create Index privilege with network access via Oracle Net to compromise     Oracle Text (LibExpat). Successful attacks of this vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete DOS) of Oracle Text (LibExpat). (CVE-2022-43680)

  - Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions     that are affected are 19.3-19.19 and 21.3-21.10. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via Oracle Net to compromise Advanced Networking Option.
    Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to     some of Advanced Networking Option accessible data. (CVE-2023-21949)

  - Vulnerability in the Unified Audit component of Oracle Database Server. Supported versions that are     affected are 19.3-19.19 and 21.3-21.10. Easily exploitable vulnerability allows high privileged     attacker having SYSDBA privilege with network access via Oracle Net to compromise Unified Audit.
    Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification     access to critical data or all Unified Audit accessible data. (CVE-2023-22034)

  - Security-in-depth updates for CVE-2021-3520, CVE-2022-21189, CVE-2022-45143, CVE-2023-24998, CVE-2023-28708,     CVE-2023-28709, CVE-2023-30533 and CVE-2023-34981

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of IBM Engineering Requirements Management DOORS (formerly IBM Rational DOORS) installed on the remote host is 9.7.2.9 prior to 9.7.2.10. It is, therefore, affected by multiple vulnerabilities as referenced in the 7238992 advisory.

  - CKEditor4 is an open source WYSIWYG HTML editor. In affected version a vulnerability has been discovered in the     core HTML processing module and may affect all plugins used by CKEditor 4. The vulnerability allowed to inject     malformed comments HTML bypassing content sanitization, which could result in executing JavaScript code. It     affects all users using the CKEditor 4 at version < 4.17.0. The problem has been recognized and patched. The     fix will be available in version 4.17.0. (CVE-2021-41165)

  - CKEditor4 is an open source WYSIWYG HTML editor. In affected versions a vulnerability has been discovered in the     Advanced Content Filter (ACF) module and may affect all plugins used by CKEditor 4. The vulnerability allowed to     inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. It affects     all users using the CKEditor 4 at version < 4.17.0. The problem has been recognized and patched. The fix will be     available in version 4.17.0. (CVE-2021-41164)

  - It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted     text into the Styles input of specific dialogs (in the Advanced Tab for Dialogs plugin). (CVE-2021-26271)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4245 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4245-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Markus Koschany     July 22, 2025                                 https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : libcommons-fileupload-java     Version        : 1.4-1+deb11u1     CVE ID         : CVE-2023-24998 CVE-2025-48976     Debian Bug     : 1031733 1108120

    Two security vulnerabilities have been found in libcommons-fileupload-java,     a Java library that adds robust, high-performance, file upload capability     to your servlets and web applications.

    CVE-2023-24998:

        Apache Commons FileUpload does not limit the number of request         parts to be processed resulting in the possibility of an attacker         triggering a DoS with a malicious upload or series of uploads. Note that,         like all of the file upload limits, the new configuration option         (FileUploadBase#setFileCountMax) is not enabled by default and must be         explicitly configured.

    CVE-2025-48976:

        Allocation of resources for multipart headers with insufficient limits         enabled a DoS vulnerability in Apache Commons FileUpload.

    For Debian 11 bullseye, these problems have been fixed in version     1.4-1+deb11u1.

    We recommend that you upgrade your libcommons-fileupload-java packages.

    For the detailed security status of libcommons-fileupload-java please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libcommons-fileupload-java

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of MySQL Enterprise Monitor installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2023 CPU advisory.

  - Vulnerability in the MySQL Enterprise Monitor product of Oracle MySQL (component: Monitoring: General     (OpenSSL)). Supported versions that are affected are 8.0.34 and prior. Easily exploitable vulnerability     allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Enterprise     Monitor. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of MySQL Enterprise Monitor. (CVE-2023-2650)

  - Vulnerability in the MySQL Enterprise Monitor product of Oracle MySQL (component: Monitoring: General     (Spring Security)). Supported versions that are affected are 8.0.34 and prior. Easily exploitable     vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise     MySQL Enterprise Monitor. Successful attacks of this vulnerability can result in takeover of MySQL     Enterprise Monitor. (CVE-2023-20862)

  - Vulnerability in the MySQL Enterprise Monitor product of Oracle MySQL (component: Monitoring: General     (Apache Commons FileUpload)). Supported versions that are affected are 8.0.34 and prior. Easily     exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise MySQL Enterprise Monitor. Successful attacks of this vulnerability can result in unauthorized     ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Enterprise Monitor.
    (CVE-2023-24998)

  - Vulnerability in the MySQL Enterprise Monitor product of Oracle MySQL (component: Monitoring: General     (Apache Tomcat)). Supported versions that are affected are 8.0.34 and prior. Easily exploitable     vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise     MySQL Enterprise Monitor. Successful attacks of this vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete DOS) of MySQL Enterprise Monitor. (CVE-2023-28709)

  - Vulnerability in the MySQL Enterprise Monitor product of Oracle MySQL (component: Monitoring: General     (Apache Ivy)). Supported versions that are affected are 8.0.34 and prior. Easily exploitable vulnerability     allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Enterprise     Monitor. Successful attacks of this vulnerability can result in unauthorized creation, deletion or     modification access to critical data or all MySQL Enterprise Monitor accessible data and unauthorized     ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Enterprise Monitor.
    (CVE-2022-37865)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Oracle Siebel CRM installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2023 CPU advisory.

  - Vulnerability in the Siebel CRM product of Oracle Siebel CRM (component: EAI (SnakeYAML)). Supported     versions that are affected are 23.4 and prior. Easily exploitable vulnerability allows unauthenticated     attacker with network access via HTTP to compromise Siebel CRM. Successful attacks of this vulnerability     can result in takeover of Siebel CRM. (CVE-2022-1471)

  - Vulnerability in the Siebel Apps product of Oracle Siebel CRM (component: Marketing (Apache Commons     FileUpload)). Supported versions that are affected are 23.4 and prior. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps. Successful attacks     of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash     (complete DOS) of Siebel Apps. (CVE-2023-24998)

  - Vulnerability in the Siebel CRM product of Oracle Siebel CRM (component: EAI (Jettison)). Supported     versions that are affected are 23.4 and prior. Easily exploitable vulnerability allows unauthenticated     attacker with network access via HTTP to compromise Siebel CRM. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Siebel     CRM. (CVE-2022-40150)

  - Vulnerability in the Siebel CRM product of Oracle Siebel CRM (component: EAI (Apache Tomcat)). Supported     versions that are affected are 23.4 and prior. Easily exploitable vulnerability allows unauthenticated     attacker with network access via HTTP to compromise Siebel CRM. Successful attacks require human     interaction from a person other than the attacker. Successful attacks of this vulnerability can result in     unauthorized read access to a subset of Siebel CRM accessible data. (CVE-2022-45143, CVE-2023-28708)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
172477	SUSE SLES15 Security Update : tomcat (SUSE-SU-2023:0697-1)	Nessus	SuSE Local Security Checks	3/11/2023	7/14/2023	high
179661	SAP BusinessObjects Business Intelligence Platform DoS (3312047)	Nessus	Windows	8/10/2023	9/25/2023	high
178468	Oracle Database Server (Jul 2023 CPU)	Nessus	Databases	7/19/2023	2/13/2024	critical
242323	IBM Engineering Requirements Management DOORS 9.7.2.9 < 9.7.2.10 Multiple Vulnerabilities (7238992)	Nessus	Windows	7/18/2025	7/22/2025	medium
242492	Debian dla-4245 : libcommons-fileupload-java - security update	Nessus	Debian Local Security Checks	7/22/2025	7/22/2025	high
178719	Oracle MySQL Enterprise Monitor (Jul 2023 CPU)	Nessus	CGI abuses	7/21/2023	10/20/2023	critical
212436	Oracle Siebel Server <= 23.4 (July 2023 CPU)	Nessus	Misc.	12/11/2024	12/12/2024	critical

Detections

Analytics

Plugins Search

high

high

critical

medium

high

critical

critical