The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:2635 advisory.

    Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss     Application Server.

    This release of Red Hat JBoss Enterprise Application Platform 6.4.17 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 6.4.16, and includes bug fixes and enhancements, which are     documented in the Release Notes document linked to in the References.

    Security Fix(es):

    * It was found that when using remote logging with log4j socket server the log4j server would deserialize     any log event received via TCP or UDP. An attacker could use this flaw to send a specially crafted log     event that, during deserialization, would execute arbitrary code in the context of the logger application.
    (CVE-2017-5645)

    * A vulnerability was discovered in the error page mechanism in Tomcat's DefaultServlet implementation. A     crafted HTTP request could cause undesired side effects, possibly including the removal or replacement of     the custom error page. (CVE-2017-5664)

    * A deserialization flaw was discovered in the jackson-databind which could allow an unauthenticated user     to perform code execution by sending the maliciously crafted input to the readValue method of the     ObjectMapper. (CVE-2017-7525)

    Red Hat would like to thank Liao Xinxi (NSFOCUS) for reporting CVE-2017-7525.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 5 / 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2017:3399 advisory.

    Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss     Application Server.

    This asynchronous patch is a security update for log4j package in Red Hat JBoss Enterprise Application     Platform 5.2.0.

    Security Fix(es):

    * It was found that when using remote logging with log4j socket server the log4j server would deserialize     any log event received via TCP or UDP. An attacker could use this flaw to send a specially crafted log     event that, during deserialization, would execute arbitrary code in the context of the logger application.
    (CVE-2017-5645)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Application Testing Suite installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2020 CPU advisory.

  - Vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager (component: Load     Testing for Web Apps (Log4j)). The supported version that is affected is 13.3.0.1. Easily exploitable     vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise     Oracle Application Testing Suite. Successful attacks of this vulnerability can result in takeover of Oracle     Application Testing Suite. (CVE-2017-5645)

  - Vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager (component: Load     Testing for Web Apps (Eclipse Mojarra). Supported versions that are affected are 13.2.0.1 and 13.3.0.1.
    Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Oracle Application Testing Suite. Successful attacks require human interaction from a person other than the     attacker and while the vulnerability is in Oracle Application Testing Suite, attacks may significantly     impact additional products. Successful attacks of this vulnerability can result in unauthorized update,     insert or delete access to some of Oracle Application Testing Suite accessible data as well as unauthorized     read access to a subset of Oracle Application Testing Suite accessible data. (CVE-2019-17091)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9419 advisory.

    - Fix CVE-2022-23302, CVE-2022-23305, CVE-2022-23307, CVE-2017-5645

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 12.4.0.0 versions of Enterprise Manager Ops Center installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2020 CPU advisory.

  - Vulnerability in the Enterprise Manager Ops Center product of Oracle Enterprise Manager (component:
    Apache Log4j). The supported version that is affected is 12.4.0.0. Easily exploitable vulnerability allows     unauthenticated attacker with network access to compromise Oracle Enterprise Manager Ops Center.
    Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Ops Center.
    (CVE-2017-5645)

  - Vulnerability in the Enterprise Manager Ops Center product of Oracle Enterprise Manager (component:
    Networking (Apache Ant)). The supported version that is affected is 12.4.0.0. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Enterprise     Manager Ops Center. Successful attacks of this vulnerability can result in unauthorized creation,     deletion or modification access to critical data or all Enterprise Manager Ops Center accessible data as     well as unauthorized access to critical data or complete access to all Enterprise Manager Ops Center     accessible data (CVE-2020-1945).

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2017-2271:01 advisory.

    Log4j is a tool to help the programmer output log statements to a     variety of output targets.
    CVE-2017-5645     In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or     UDP socket server to receive serialized log events from another     application, a specially crafted binary payload can be sent that, when     deserialized, can execute arbitrary code.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
103041	RHEL 6 : Red Hat JBoss Enterprise Application Platform 6.4.17 update on RHEL 6 (Important) (RHSA-2017:2635)	Nessus	Red Hat Local Security Checks	9/8/2017	11/24/2025	critical
105209	RHEL 5 / 6 : Red Hat JBoss Enterprise Application Platform 5.2 (RHSA-2017:3399)	Nessus	Red Hat Local Security Checks	12/13/2017	4/29/2025	critical
138610	Oracle Application Testing Suite (Jul 2020 CPU)	Nessus	Misc.	7/20/2020	3/1/2024	critical
161444	Oracle Linux 6 : log4j (ELSA-2022-9419)	Nessus	Oracle Linux Local Security Checks	5/23/2022	10/22/2024	critical
169979	Oracle Enterprise Manager Ops Center UI and Other Patches (Jul 2020 CPU)	Nessus	Misc.	1/12/2023	9/7/2023	critical
288958	MiracleLinux 7 : log4j-1.2.17-16.0.1.el7.AXS7 (AXSA:2017-2271:01)	Nessus	Miracle Linux Local Security Checks	1/16/2026	1/16/2026	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical