The version of Oracle Access Manager installed on the remote host is affected by the following vulnerability as noted in the October 2020 CPU advisory :
  - Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Web Server     Plugin (RSA BSafe)). The supported version that is affected is 11.1.2.3.0. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTPS to compromise     Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle     Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).
  Note that Nessus has not attempted to exploit this issue but has instead relied only on the application's self-reported version number.

The version of Oracle Business Intelligence Publisher or Oracle Analytics Server 5.5 running on the remote host is 11.1.1.9.x prior to 11.1.1.9.201020, 12.2.1.3.x prior to 12.2.1.3.201020, 12.2.1.4.x prior to 12.2.1.4.201020, or 12.2.5.5.x (OAS 5.5) prior to 12.2.5.5.201012. It is, therefore, affected by multiple vulnerabilities as noted in the October 2020 Critical Patch Update advisory:

  - An unspecified vulnerability exists in the BI Publisher product of Oracle Fusion Middleware (component: BI     Publisher Security (jQuery)). An unauthenticated, remote attacker can exploit this, via HTTP, which can     result in unauthorized update, insert or delete access to some of BI Publisher accessible data as well as     unauthorized read access to a subset of BI Publisher accessible data. (CVE-2019-11358)

  - An unspecified vulnerability exists in the BI Publisher product of Oracle Fusion Middleware (component: BI     Publisher Security). An unauthenticated, remote attacker can exploit this, via HTTP, which can result in     unauthorized access to critical data or complete access to all BI Publisher accessible data as well as     unauthorized update, insert or delete access to some of BI Publisher accessible data. (CVE-2020-14780,     CVE-2020-14842)     
  - An unspecified vulnerability exists in the Oracle BI Publisher product of Oracle Fusion Middleware     (component: Mobile Service). An unauthenticated, remote attacker can exploit this, via HTTP, which can     result in unauthorized access to critical data or complete access to all Oracle BI Publisher accessible     data as well as unauthorized update, insert or delete access to some of Oracle BI Publisher accessible     data. (CVE-2020-14784)

  - An unspecified vulnerability exists in the BI Publisher product of Oracle Fusion Middleware (component:
    E-Business Suite - XDO). An unauthenticated, remote attacker can exploit this, via HTTP, which can result     in unauthorized access to critical data or complete access to all BI Publisher accessible data as well as     unauthorized update, insert or delete access to some of BI Publisher accessible data. (CVE-2020-14879,     CVE-2020-14880)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle WebCenter Portal installed on the remote host is missing a security patch from the October 2020 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilities, including the following:

  - dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might     enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the     safe, non-default behavior in any application that uses dom4j. (CVE-2020-10683)

  - A vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching, CacheStore,     Invocation). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle     Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. (CVE-2020-2555)

  - xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the     security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands     when unmarshalling XML or any supported format. e.g. JSON. (CVE-2019-10173)

  - A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows     remote attackers to inject arbitrary web script through a crafted protected comment (with the cke_protected     syntax). (CVE-2020-9281)

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

The version of Oracle HTTP Server installed on the remote host is affected by the following vulnerabilities as referenced in the October 2020 CPU advisory:

  - A denial of service (DoS) vulnerability exists in the SSL Module (OpenSSL). An unauthenticated, remote     attacker with network access via HTTPS, can exploit this issue to cause a hang or frequently repeatable     crash (complete DoS) of Oracle HTTP Server. (CVE-2020-1967)

  - An unspecified vulnerability exists in the Apache HTTP Server Core component.  A authenticated, remote     attacker with network access via HTTP, can exploit this issue to compromise the Oracle HTTP Server.     Successful attacks of this vulnerability can result in takeover of Oracle HTTP Server. (CVE-2019-10097)

  - An unspecified vulnerability exists in Web Listener (cURL). An unauthenticated, remote attacker with     network access via TFTP can exploit this issue to compromise Oracle HTTP Server. Successful attacks of     this vulnerability can result in takeover of Oracle HTTP Server. (CVE-2019-5482)   Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

The version of Oracle Business Process Management Suite installed on the remote host is affected by the following vulnerabilities as referenced in the October 2020 CPU advisory:  

  - Vulnerability in the Runtime Engine (Application Development Framework). An unauthenticated, remote     attacker with network access via HTTP can exploit this issue to compromise the Oracle Business Process     Management Suite. Successful attacks require human interaction from a person other than the attacker and     while the vulnerability is in Oracle Business Process Management Suite, attacks may significantly impact     additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or     delete access to some of Oracle Business Process Management Suite accessible data as well as unauthorized     read access to a subset of Oracle Business Process Management Suite accessible data. (CVE-2019-2904)

  - Vulnerability in the Runtime Engine (Apache Ant). An authenticated, local attacker can exploit this issue     to compromise the Oracle Business Process Management Suite. Successful attacks of this vulnerability can     result in unauthorized creation, deletion or modification access to critical data or all Oracle Business     Process Management Suite accessible data as well as unauthorized access to critical data or complete     access to all Oracle Business Process Management Suite accessible data. (CVE-2020-1945)

  - Vulnerability in the Runtime Engine (jQuery). An unauthenticated, remote attacker with network access via     HTTP can exploit this issue to compromise Oracle Business Process Management Suite. Successful attacks     require human interaction from a person other than the attacker and while the vulnerability is in Oracle     Business Process Management Suite, attacks may significantly impact additional products. Successful     attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle     Business Process Management Suite accessible data as well as unauthorized read access to a subset of     Oracle Business Process Management Suite accessible data. (CVE-2019-11358)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

According to its self-reported version, the MySQL Enterprise Monitor application running on the remote host is 8.0.x prior to 8.0.22.1262. It is, therefore, affected by a denial of service (DoS) vulnerability exists in a bundled component (Apache Tomcat) due to insufficient validation of user input. An unauthenticated, remote attacker can exploit this issue to impose a DoS condition on the application.  

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2020 CPU advisory.

  - Vulnerability in the Core RDBMS (bzip2) component of Oracle Database Server. Supported versions that are   affected are 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c and 19c. Easily exploitable vulnerability allows low   privileged attacker having DBA Level Account privilege with network access via Oracle Net to compromise   Core RDBMS (bzip2). Successful attacks of this vulnerability can result in takeover of Core RDBMS (bzip2).
  (CVE-2019-12900)   
  - Vulnerability in the Core RDBMS (bzip2) component of Oracle Database Server. Supported versions that   are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c and 19c. Easily exploitable vulnerability allows low   privileged attacker having DBA Level Account privilege with network access via Oracle Net to compromise   Core RDBMS (bzip2). Successful attacks of this vulnerability can result in takeover of Core RDBMS (bzip2).
  (CVE-2020-14735)

  - Vulnerability in the Oracle Text component of Oracle Database Server. Supported versions that are affected   are 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c and 19c. Difficult to exploit vulnerability allows unauthenticated   attacker with network access via Oracle Net to compromise Oracle Text. Successful attacks of this   vulnerability can result in takeover of Oracle Text. (CVE-2020-14734)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The 13.3.0.0, 13.3.1.0 and 13.4.0.0 versions of Enterprise Manager Base Platform installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2020 CPU advisory.

  - Vulnerability in the Enterprise Manager for Storage Management product of Oracle Enterprise Manager     (component: Privilege Management (OpenSSL)). Supported versions that are affected are 13.3.0.0 and     13.4.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via     HTTPS to compromise Enterprise Manager for Storage Management. Successful attacks of this     vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash     (complete DOS) of Enterprise Manager for Storage Management. (CVE-2020-1967)

  - Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component:
    Event Management). Supported versions that are affected are 13.3.0.0 and 13.4.0.0. Easily exploitable     vulnerability allows low privileged attacker with network access via HTTP to compromise Enterprise Manager     Base Platform. While the vulnerability is in Enterprise Manager Base Platform, attacks may significantly     impact additional products. Successful attacks of this vulnerability can result in unauthorized update,     insert or delete access to some of Enterprise Manager Base Platform accessible data as well as     unauthorized read access to a subset of Enterprise Manager Base Platform accessible data. (CVE-2019-2897)

  - Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component:
    Connector Framework (Apache CXF)). The supported version that is affected is 13.2.1.0. Difficult to     exploit vulnerability allows unauthenticated attacker with access to the physical communication segment     attached to the hardware where the Enterprise Manager Base Platform executes to compromise Enterprise     Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized access to     critical data or complete access to all Enterprise Manager Base Platform accessible data. (CVE-2020-1954)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The versions of Oracle E-Business Suite installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2020 CPU advisory, including the following:

  - Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work     Provider Administration). The supported version that is affected is 12.1.3. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Universal     Work Queue. Successful attacks of this vulnerability can result in takeover of Oracle Universal Work     Queue. (CVE-2020-14855)

  - Vulnerability in the Oracle E-Business Suite Secure Enterprise Search product of Oracle E-Business Suite     (component: Search Integration Engine). Supported versions that are affected are 12.1.3 and 12.2.3 -     12.2.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to     compromise Oracle E-Business Suite Secure Enterprise Search. Successful attacks of this vulnerability can     result in unauthorized creation, deletion or modification access to critical data or all Oracle E-Business     Suite Secure Enterprise Search accessible data as well as unauthorized access to critical data or complete     access to all Oracle E-Business Suite Secure Enterprise Search accessible data. (CVE-2020-14805)

  - Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing     Administration). Supported versions that are affected are 12.1.1 - 12.1.3 and 12.2.3 - 12.2.10. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Oracle Marketing. Successful attacks of this vulnerability can result in unauthorized creation, deletion     or modification access to critical data or all Oracle Marketing accessible data as well as unauthorized     access to critical data or complete access to all Oracle Marketing accessible data.  (CVE-2020-14875)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of WebLogic Server installed on the remote host is affected by multiple vulnerabilities as referenced in the October 2020 CPU advisory.

  - An unspecified vulnerability exists in the Console component. An unauthenticated, remote attacker with     network access via HTTP can exploit this issue to compromise the server. Successful attacks of this     vulnerability can result in takeover of Oracle WebLogic Server. (CVE-2020-14750, CVE-2020-14882)

  - An unspecified vulnerability exists in the Core component. An unauthenticated, remote attacker can exploit     this issue via the IIOP and T3 protocols to compromise the server. Successful attacks of this     vulnerability can result in takeover of Oracle WebLogic Server. (CVE-2020-14859)

  - An unspecified vulnerability exists in the Core component. An unauthenticated, remote attacker can exploit     this issue via the IIOP protocol to compromise the server. Successful attacks of this vulnerability can     result in takeover of Oracle WebLogic Server. (CVE-2020-14841)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 7 Update 281, 8 Update 271, 11 Update 9, or 15 Update 1. It is, therefore, affected by multiple vulnerabilities related to the following components as referenced in the October 2020 CPU advisory:

  - Vulnerability in the Oracle GraalVM Enterprise Edition product of Oracle GraalVM (component: Java).
    Supported versions that are affected are 19.3.3 and 20.2.0. Easily exploitable vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Oracle GraalVM     Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a     subset of Oracle GraalVM Enterprise Edition accessible data. (CVE-2020-14803)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Hotspot). Supported     versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other     than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or     delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to     a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of     Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java     applets. It can also be exploited by supplying data to APIs in the specified Component without using     sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.
    (CVE-2020-14792)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JNDI). Supported     versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server     deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web     service. (CVE-2020-14781)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 7 Update 281, 8 Update 271, 11 Update 9, or 15 Update 1. It is, therefore, affected by multiple vulnerabilities related to the following components as referenced in the October 2020 CPU advisory:

  - Vulnerability in the Oracle GraalVM Enterprise Edition product of Oracle GraalVM (component: Java).
    Supported versions that are affected are 19.3.3 and 20.2.0. Easily exploitable vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Oracle GraalVM     Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a     subset of Oracle GraalVM Enterprise Edition accessible data. (CVE-2020-14803)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Hotspot). Supported     versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other     than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or     delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to     a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of     Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java     applets. It can also be exploited by supplying data to APIs in the specified Component without using     sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.
    (CVE-2020-14792)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JNDI). Supported     versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server     deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web     service. (CVE-2020-14781)


Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of MySQL running on the remote host is 8.0.x prior to 8.0.22. It is, therefore, affected by multiple vulnerabilities, including the following, as noted in the October 2020 Critical Patch Update advisory:

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: LDAP Auth).   Supported versions that are affected are 8.0.21 and prior. Easily exploitable vulnerability allows   low privileged attacker with access to the physical communication segment attached to the hardware   where the MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability   can result in takeover of MySQL Server (CVE-2020-14878).

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions   that are affected are 8.0.21 and prior. Easily exploitable vulnerability allows high privileged attacker   with network access via multiple protocols to compromise MySQL Server. Successful attacks of this   vulnerability can result in takeover of MySQL Server (CVE-2020-14828)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that   are affected are 5.7.31 and prior and 8.0.21 and prior. Easily exploitable vulnerability allows low   privileged attacker with network access via multiple protocols to compromise MySQL Server.   Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or   frequently repeatable crash (complete DOS) of MySQL Server (CVE-2020-14775). 

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of MySQL running on the remote host is 5.7.x prior to 5.7.32. It is, therefore, affected by multiple vulnerabilities, including the following, as noted in the October 2020 Critical Patch Update advisory:
  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions   that are affected are 5.6.49 and prior, 5.7.31 and prior and 8.0.21 and prior. Easily exploitable   vulnerability allows low privileged attacker with network access via multiple protocols to compromise   MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a   hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2020-14765)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported   versions that are affected are 5.6.49 and prior, 5.7.31 and prior and 8.0.21 and prior. Easily   exploitable vulnerability allows low privileged attacker with network access via multiple protocols   to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized   ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2020-14769)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that   are affected are 5.7.31 and prior and 8.0.21 and prior. Easily exploitable vulnerability allows low   privileged attacker with network access via multiple protocols to compromise MySQL Server.   Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or   frequently repeatable crash (complete DOS) of MySQL Server (CVE-2020-14775). 

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of MySQL running on the remote host is 5.6.x prior to 5.6.50. It is, therefore, affected by multiple vulnerabilities, including the following, as noted in the October 2020 Critical Patch Update advisory:
  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure).   Supported versions that are affected are 5.6.49 and prior, 5.7.31 and prior and 8.0.21 and prior.   Easily exploitable vulnerability allows high privileged attacker with network access via multiple   protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in   unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.   (CVE-2020-14672)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions   that are affected are 5.6.49 and prior, 5.7.31 and prior and 8.0.21 and prior. Easily exploitable   vulnerability allows low privileged attacker with network access via multiple protocols to compromise   MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a   hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2020-14765)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported   versions that are affected are 5.6.49 and prior, 5.7.31 and prior and 8.0.21 and prior. Easily   exploitable vulnerability allows low privileged attacker with network access via multiple protocols   to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized   ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2020-14769)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Primavera Gateway installed on the remote host is affected by a vulnerability as referenced in the October 2020 CPU advisory.

Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: Admin (Swagger UI)).
Supported versions that are affected are 16.2.0-16.2.11 and 17.12.0-17.12.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Gateway. Successful attacks of this vulnerability can result in takeover of Primavera Gateway.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle VM VirtualBox installed on the remote host is affected by multiple vulnerabilities as referenced  in the October 2020 CPU advisory, including the following:

  - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported     versions that is affected are Prior to 6.1.16. Easily exploitable vulnerability allows high privileged     attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM     VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact     additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM     VirtualBox. (CVE-2020-14872)

  - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported     versions that is affected are Prior to 6.1.16. Easily exploitable vulnerability allows high privileged     attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM     VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact     additional products. uccessful attacks of this vulnerability can result in unauthorized access to     critical data or complete access to all Oracle VM VirtualBox accessible data.     (CVE-2020-14881, CVE-2020-14884, CVE-2020-14885, CVE-2020-14886, CVE-2020-14889)

  - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported     versions that is affected are Prior to 6.1.16. Easily exploitable vulnerability allows low privileged     attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM     VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact     additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause     a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. (CVE-2020-14892)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The 16.1-16.2, 17.7-17.12, 18.8, and 19.12 versions of Primavera Unifier installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2020 CPU advisory.

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform     (Apache Derby)). Supported versions that are affected are 16.1-16.2, 17.7-17.12, 18.8 and 19.12. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Primavera Unifier. Successful attacks of this vulnerability can result in unauthorized access to critical     data or complete access to all Primavera Unifier accessible data and unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of Primavera Unifier. (CVE-2015-1832)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform     (iText)). Supported versions that are affected are 16.1-16.2, 17.7-17.12, 18.8 and 19.12. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Primavera Unifier. Successful attacks require human interaction from a person other than the attacker.
    Successful attacks of this vulnerability can result in takeover of Primavera Unifier. (CVE-2017-9096)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform     (Apache Solr)). Supported versions that are affected are 16.1-16.2, 17.7-17.12, 18.8 and 19.12. Difficult     to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise     Primavera Unifier. Successful attacks of this vulnerability can result in takeover of Primavera Unifier.
    (CVE-2019-17558)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
144089	Oracle Access Manager (Oct 2020 CPU)	Nessus	Misc.	2020/12/11	2020/12/14	high
142372	Oracle Business Intelligence Publisher Multiple Vulnerabilities (Oct 2020 CPU)	Nessus	Misc.	2020/11/04	2020/11/05	high
142223	Oracle WebCenter Portal Multiple Vulnerabilities (Oct 2020 CPU)	Nessus	Misc.	2020/11/03	2021/01/15	high
142212	Oracle Fusion Middleware Oracle HTTP Server (Oct 2020 CPU)	Nessus	Web Servers	2020/11/02	2020/11/03	high
142210	Oracle Business Process Management Suite (Oct 2020 CPU)	Nessus	Misc.	2020/11/02	2020/11/03	high
141847	MySQL Enterprise Monitor 8.0.x < 8.0.22.1262 DoS (Oct 2020 CPU)	Nessus	CGI abuses	2020/10/23	2020/10/26	medium
141829	Oracle Database Server Multiple Vulnerabilities (Oct 2020 CPU)	Nessus	Databases	2020/10/23	2020/10/26	high
141809	Oracle Enterprise Manager Cloud Control (Oct 2020 CPU)	Nessus	Misc.	2020/10/22	2020/11/04	medium
141808	Oracle Oracle E-Business Suite (Oct 2020 CPU)	Nessus	Misc.	2020/10/22	2020/10/23	critical
141807	Oracle WebLogic Server Multiple Vulnerabilities (Oct 2020 CPU)	Nessus	Misc.	2020/10/22	2020/11/20	critical
141801	Oracle Java SE 1.7.0_281 / 1.8.0_271 / 1.11.0_9 / 1.15.0_1 Multiple Vulnerabilities (Oct 2020 CPU)	Nessus	Misc.	2020/10/22	2020/10/28	medium
141800	Oracle Java SE 1.7.0_281 / 1.8.0_271 / 1.11.0_9 / 1.15.0_1 Multiple Vulnerabilities (Oct 2020 CPU)	Nessus	Windows	2020/10/22	2020/10/28	medium
141798	MySQL 8.0.x < 8.0.22 Multiple Vulnerabilities (Oct 2020 CPU)	Nessus	Databases	2020/10/22	2020/10/23	high
141797	MySQL 5.7.x < 5.7.32 Multiple Vulnerabilities (Oct 2020 CPU)	Nessus	Databases	2020/10/22	2020/10/23	medium
141796	MySQL 5.6.x < 5.6.50 Multiple Vulnerabilities (Oct 2020 CPU)	Nessus	Databases	2020/10/22	2020/10/28	medium
141785	Oracle Primavera Gateway (Oct 2020 CPU)	Nessus	CGI abuses	2020/10/22	2020/10/23	high
141784	Oracle VM VirtualBox (Oct 2020 CPU)	Nessus	Misc.	2020/10/22	2020/10/27	high
141641	Oracle Primavera Unifier (Oct 2020 CPU)	Nessus	CGI abuses	2020/10/21	2020/10/29	medium

Plugins Search