The version of Oracle Enterprise Manager Cloud Control installed on the remote host is affected by multiple vulnerabilities in Enterprise Manager Base Platform component:

  - A deserialization vulnerability in Apache Commons     FileUpload allows for remote code execution.
    (CVE-2016-1000031)

  - An information disclosure vulnerability exists in OpenSSL     due to the potential for a side-channel timing attack.
    An unauthenticated attacker can exploit this to disclose     potentially sensitive information. (CVE-2018-0734)

  - A denial of service (DoS) vulnerability exists in Apache     HTTP Server 2.4.17 to 2.4.34, due to a design error. An     unauthenticated, remote attacker can exploit this issue     by sending continuous, large SETTINGS frames to cause a     client to occupy a connection, server thread and CPU     time without any connection timeout coming to effect.
    This affects only HTTP/2 connections. A possible     mitigation is to not enable the h2 protocol.
    (CVE-2018-11763).

  - Networking component of Enterprise Manager Base Platform     (Spring Framework) is easily exploited and may allow an     unauthenticated, remote attacker to takeover the     Enterprise Manager Base Platform. (CVE-2018-1258)

According to the version of the compat-openssl10 package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A microprocessor side-channel vulnerability was found     on SMT (e.g, Hyper-Threading) architectures. An     attacker running a malicious process on the same core     of the processor as the victim process can extract     certain secret information.(CVE-2018-5407)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Oracle Tuxedo installed on the remote host is missing a security patch. It is, therefore, affected by multiple vulnerabilities:
  - An information disclosure vulnerability exists in OpenSSL     due to the potential for a side-channel timing attack.     An unauthenticated attacker can exploit this to disclose     potentially sensitive information.     (CVE-2018-0734, CVE-2018-0735, CVE-2018-5407)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has ovmf packages installed that are affected by multiple vulnerabilities:

  - Buffer overflow in system firmware for EDK II may allow unauthenticated user to potentially enable     escalation of privilege and/or denial of service via network access. (CVE-2019-0160)

  - Bounds checking in Tianocompress before November 7, 2017 may allow an authenticated user to potentially     enable an escalation of privilege via local access. (CVE-2017-5731)

  - Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA     pool that was not assigned to any issues during 2017. Notes: none (CVE-2017-5732, CVE-2017-5733,     CVE-2017-5735)

  - Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn     by its CNA. Notes: none (CVE-2017-5734)

  - Stack overflow in corrupted bmp for EDK II may allow unprivileged user to potentially enable denial of     service or elevation of privilege via local access. (CVE-2018-12181)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has ovmf packages installed that are affected by multiple vulnerabilities:

  - Buffer overflow in system firmware for EDK II may allow unauthenticated user to potentially enable     escalation of privilege and/or denial of service via network access. (CVE-2019-0160)

  - Bounds checking in Tianocompress before November 7, 2017 may allow an authenticated user to potentially     enable an escalation of privilege via local access. (CVE-2017-5731)

  - Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA     pool that was not assigned to any issues during 2017. Notes: none (CVE-2017-5732, CVE-2017-5733,     CVE-2017-5735)

  - Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn     by its CNA. Notes: none (CVE-2017-5734)

  - Stack overflow in corrupted bmp for EDK II may allow unprivileged user to potentially enable denial of     service or elevation of privilege via local access. (CVE-2018-12181)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for nodejs4 fixes the following issues :

Security issues fixed :

  - CVE-2018-0734: Fixed a timing vulnerability in the DSA     signature generation (bsc#1113652)

  - CVE-2018-5407: Fixed a hyperthread port content side     channel attack (aka 'PortSmash') (bsc#1113534)

  - CVE-2018-12120: Fixed that the debugger listens on any     interface by default (bsc#1117625)

  - CVE-2018-12121: Fixed a denial of Service with large     HTTP headers (bsc#1117626)

  - CVE-2018-12122: Fixed the 'Slowloris' HTTP Denial of     Service (bsc#1117627)

  - CVE-2018-12116: Fixed HTTP request splitting     (bsc#1117630)

  - CVE-2018-12123: Fixed hostname spoofing in URL parser     for JavaScript protocol (bsc#1117629)

This update was imported from the SUSE:SLE-12:Update update project.

According to its self-reported version number, the Oracle Primavera P6 Enterprise Project Portfolio Management (EPPM) installation running on the remote web server is 8.4 prior to 8.4.15.10, 15.x prior to 15.2.18.4, 16.x prior to 16.2.17.2, 17.x prior to 17.12.12.0, or 18.x prior to 18.8.8.0. It is, therefore, affected by multiple vulnerabilities:

  - A deserialization vulnerability in Apache Commons     FileUpload allows for remote code execution.
    (CVE-2016-1000031)

  - A denial of service vulnerability in the bundled     third-party component OpenSSL library's DSA signature     algorithm that renders it vulnerable to a timing side     channel attack. An attacker could leverage this     vulnerability to recover the private key.
    (CVE-2018-0734)

  - A deserialization vulnerability in jackson-databind, a     fast and powerful JSON library for Java, allows an     unauthenticated user to perform code execution. The     issue was resolved by extending the blacklist and     blocking more classes from polymorphic deserialization.
    (CVE-2018-19362)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for openssl fixes the following issues :

CVE-2018-0732: Reject excessively large primes in DH key generation (bsc#1097158)

CVE-2018-0734: Timing vulnerability in DSA signature generation (bsc#1113652)

CVE-2018-0737: Cache timing vulnerability in RSA Key Generation (bsc#1089039)

CVE-2018-5407: Elliptic curve scalar multiplication timing attack defenses (fixes 'PortSmash') (bsc#1113534)

CVE-2019-1559: Fix 0-byte record padding oracle via SSL_shutdown (bsc#1127080)

Fix One&Done side-channel attack on RSA (bsc#1104789)

Reject invalid EC point coordinates (bsc#1131291)

The 9 Lives of Bleichenbacher's CAT: Cache ATtacks on TLS Implementations (bsc#1117951)

Add missing error string to CVE-2016-8610 fix (bsc#1110018#c9)

blinding enhancements for ECDSA and DSA (bsc#1097624, bsc#1098592)

Non security fixes: correct the error detection in the fips patch (bsc#1106197)

Add openssl(cli) Provide so the packages that require the openssl binary can require this instead of the new openssl meta package (bsc#1101470)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
125147	Oracle Enterprise Manager Ops Center (Apr 2019 CPU)	Nessus	Misc.	5/15/2019	4/25/2023	critical
128197	EulerOS 2.0 SP8 : compat-openssl10 (EulerOS-SA-2019-1828)	Nessus	Huawei Local Security Checks	8/27/2019	5/1/2024	medium
124171	Oracle Tuxedo Multiple Vulnerabilities (Apr 2019 CPU)	Nessus	Misc.	4/19/2019	5/31/2024	medium
131425	NewStart CGSL CORE 5.04 / MAIN 5.04 : ovmf Multiple Vulnerabilities (NS-SA-2019-0218)	Nessus	NewStart CGSL Local Security Checks	12/2/2019	8/29/2025	critical
132479	NewStart CGSL CORE 5.05 / MAIN 5.05 : ovmf Multiple Vulnerabilities (NS-SA-2019-0239)	Nessus	NewStart CGSL Local Security Checks	12/31/2019	8/29/2025	critical
154459	NewStart CGSL CORE 5.05 / MAIN 5.05 : ovmf Multiple Vulnerabilities (NS-SA-2021-0180)	Nessus	NewStart CGSL Local Security Checks	10/27/2021	8/29/2025	critical
121415	openSUSE Security Update : nodejs4 (openSUSE-2019-88)	Nessus	SuSE Local Security Checks	1/28/2019	6/25/2024	high
124169	Oracle Primavera P6 Enterprise Project Portfolio Management (EPPM) Multiple Vulnerabilities (Apr 2019 CPU)	Nessus	CGI abuses	4/19/2019	5/31/2024	critical
126046	SUSE SLES12 Security Update : openssl (SUSE-SU-2019:1553-1)	Nessus	SuSE Local Security Checks	6/19/2019	12/5/2022	medium

Detections

Analytics

Plugins Search

critical

medium

medium

critical

critical

critical

high

critical

medium