The 17.12.11, 18.8.11, 19.12.10, and 20.12.0 versions of Primavera Gateway installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2021 CPU advisory.

  - Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: Admin     (Nimbus JOSE+JWT)). Supported versions that are affected are 18.8.0-18.8.11. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera     Gateway. Successful attacks of this vulnerability can result in takeover of Primavera Gateway.
    (CVE-2019-17195)

  - Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: Admin     (Lodash)). Supported versions that are affected are 17.12.0-17.12.11, 18.8.0-18.8.11, 19.12.0-19.12.10 and     20.12.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Primavera Gateway. Successful attacks of this vulnerability can result in unauthorized     creation, deletion or modification access to critical data or all Primavera Gateway accessible data and     unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Primavera Gateway.
    (CVE-2020-8203)

  - Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: Admin     (Netty)). Supported versions that are affected are 17.12.0-17.12.11, 18.8.0-18.8.11 and 19.12.0-19.12.10.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to     compromise Primavera Gateway. Successful attacks of this vulnerability can result in unauthorized     creation, deletion or modification access to critical data or all Primavera Gateway accessible data.
    (CVE-2021-21409)     
  - Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component:
    jackson-databind). (CVE-2020-36189)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The 8.0.23 and prior versions of MySQL Connectors installed on the remote host are affected by a vulnerability as referenced in the July 2020 CPU advisory. A vulnerability in the MySQL Connectors product of Oracle MySQL (components:
Connector/C++ (OpenSSL) and Connector/ODBC (OpenSSL)). Supported versions that are affected are 8.0.23 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Connectors accessible data as well as unauthorized access to critical data or complete access to all MySQL Connectors accessible data.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The 11.1.2.2.0, 11.1.2.3.0, 12.2.1.3.0, and 12.2.1.4.0 versions of Identity Manager installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2021 CPU advisory.

  - Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: Identity Console).
    Supported versions that are affected are 11.1.2.2.0, 11.1.2.3.0, 12.2.1.3.0 and 12.2.1.4.0. Easily     exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise     Identity Manager. Successful attacks require human interaction from a person other than the attacker and     while the vulnerability is in Identity Manager, attacks may significantly impact additional products.
    Successful attacks of this vulnerability can result in unauthorized access to critical data or complete     access to all Identity Manager accessible data as well as unauthorized update, insert or delete access to     some of Identity Manager accessible data. (CVE-2021-2458)

  - Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: UI Platform     (jQuery)). The supported version that is affected is 12.2.1.3.0. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Identity Manager. Successful attacks     require human interaction from a person other than the attacker and while the vulnerability is in Identity     Manager, attacks may significantly impact additional products. Successful attacks of this vulnerability     can result in unauthorized update, insert or delete access to some of Identity Manager accessible data as     well as unauthorized read access to a subset of Identity Manager accessible data. (CVE-2019-11358)

  - Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: Request Management &     Workflow). The supported version that is affected is 11.1.2.3.0. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Identity Manager. Successful attacks     of this vulnerability can result in unauthorized read access to a subset of Identity Manager accessible     data. (CVE-2021-2457)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The 17.12, 18.8, 19.12, and 20.12 versions of Primavera Unifier installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2021 CPU advisory.

  - Security-in-Depth issue in the Oracle Spatial and Graph Network Data Model (jackson-databind) component of     Oracle Primavera Unifier. (CVE-2020-36189)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Core     (Apache PDFbox)). Supported versions that are affected are 17.7-17.12, 18.8, 19.12 and 20.12. Easily     exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Primavera     Unifier executes to compromise Primavera Unifier. Successful attacks require human interaction from a     person other than the attacker. Successful attacks of this vulnerability can result in unauthorized     ability to cause a hang or frequently repeatable crash (complete DOS) of Primavera Unifier.
    (CVE-2021-27906)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Core UI     (dojo)). Supported versions that are affected are 17.7-17.12, 18.8, 19.12 and 20.12. Easily exploitable     vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera Unifier.
    Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to     some of Primavera Unifier accessible data. (CVE-2020-5258)

  - Security-in-Depth issue in the Oracle Spatial and Graph Network Data Model (jackson-databind) component of     Oracle Database Server. This vulnerability cannot be exploited in the context of this product.
    (CVE-2020-25649)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0 versions of Coherence installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2021 CPU advisory.

  - Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported     versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Difficult to exploit     vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle     Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence.
    (CVE-2021-2428)

  - Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported     versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise     Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized ability to cause a     hang or frequently repeatable crash (complete DOS) of Oracle Coherence. (CVE-2021-2344, CVE-2021-2371)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The 13.3.0.1 versions of Application Testing Suite installed on the remote host are affected by a vulnerability as referenced in the July 2021 CPU advisory.

  - Vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager (component:
    Load Testing for Web Apps (Apache Commons BeanUtils)). The supported version that is affected is 13.3.0.1.
    Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to     compromise Oracle Application Testing Suite. Successful attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of Oracle Application Testing Suite accessible data     as well as unauthorized read access to a subset of Oracle Application Testing Suite accessible data and     unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Application Testing     Suite. (CVE-2019-10086)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle WebCenter Portal installed on the remote host is missing a security patch from the July 2021 Critical Patch Update (CPU). It is, therefore, affected by the following vulnerabilities:

  - Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security   Framework (Bouncy Castle Java Library)). Supported versions that are affected are 11.1.1.9.0, 12.2.1.3.0   and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via   HTTPS to compromise Oracle WebCenter Portal. Successful attacks of this vulnerability can result in   takeover of Oracle WebCenter Portal. (CVE-2020-28052)

  - Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security   Framework (XStream)). Supported versions that are affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0.   Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise   Oracle WebCenter Portal. While the vulnerability is in Oracle WebCenter Portal, attacks may significantly   impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle   WebCenter Portal. (CVE-2021-21345)

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

The 13.4.0.0 versions of Enterprise Manager Base Platform installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2021 CPU advisory.

  - Vulnerability in the StorageTek Tape Analytics SW Tool product of Oracle Systems (component: Software     (dom4j)). The supported version that is affected is 2.3. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise StorageTek Tape Analytics SW Tool.
    Successful attacks of this vulnerability can result in takeover of StorageTek Tape Analytics SW Tool.     (CVE-2020-10683)

  - Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component:
    Application Service Level Mgmt (OpenCV)). The supported version that is affected is 13.4.0.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Enterprise Manager Base Platform. Successful attacks require human interaction from a person other than     the attacker. Successful attacks of this vulnerability can result in takeover of Enterprise Manager Base     Platform. (CVE-2019-5064)

  - Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component:
    Discovery Framework (OpenSSL)). The supported version that is affected is 13.4.0.0. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Enterprise     Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete DOS) of Enterprise Manager Base Platform. (CVE-2020-1971)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2021 CPU advisory.

  - Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions     that are affected are 12.1.0.2 and 19c. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via Oracle Net to compromise Advanced Networking Option. Successful attacks require     human interaction from a person other than the attacker and while the vulnerability is in Advanced     Networking Option, attacks may significantly impact additional products. Successful attacks of this     vulnerability can result in takeover of Advanced Networking Option. (CVE-2021-2351)

  - Vulnerability in the Oracle Text component of Oracle Database Server. Supported versions that are affected     are 12.1.0.2 and 19c. Easily exploitable vulnerability allows high privileged attacker having Create Any     Procedure, Alter Any Table privilege with network access via Oracle Net to compromise Oracle Text.
    Successful   attacks of this vulnerability can result in takeover of Oracle Text. (CVE-2021-2328)

  - Vulnerability in the Oracle XML DB component of Oracle Database Server. Supported versions that are     affected   are 12.1.0.2 and 19c. Easily exploitable vulnerability allows high privileged attacker having     Create Any   Procedure, Create Public Synonym privilege with network access via Oracle Net to compromise     Oracle XML DB.   Successful attacks of this vulnerability can result in takeover of Oracle XML DB.
    (CVE-2021-2329)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle Access Manager installed on the remote host is affected by the following vulnerabilities as noted in the July 2021 CPU advisory :
  - Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Rest interfaces     for Access Mgr). The supported version that is affected is 11.1.2.3.0. Easily exploitable vulnerability     allows high privileged attacker with network access via HTTPS to compromise Oracle Access Manager.
    Successful attacks of this vulnerability can result in unauthorized access to critical data or complete     access to all Oracle Access Manager accessible data. (CVE-2021-2358)

  - Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Installation     Component (Oracle Coherence)). The supported version that is affected is 11.1.2.3.0. Difficult to exploit     vulnerability allows high privileged attacker with access to the physical communication segment attached     to the hardware where the Oracle Access Manager executes to compromise Oracle Access Manager. Successful     attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle     Access Manager accessible data as well as unauthorized read access to a subset of Oracle Access Manager     accessible data. (CVE-2020-2555)


Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

The version of MySQL running on the remote host is 8.0.x prior to 8.0.26. It is, therefore, affected by multiple vulnerabilities, including the following, as noted in the July 2021 Critical Patch Update advisory:

  - curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being   used when a TLS 1.3 session ticket arrives over a connection. A malicious server can use this in rare unfortunate   circumstances to potentially reach remote code execution in the client. (CVE-2021-22901)

  - LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting   applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.)   (CVE-2019-17543)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected   are 5.7.34 and prior and 8.0.25 and prior. Difficult to exploit vulnerability allows high privileged attacker with   network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result   in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.
  (CVE-2021-2372)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of MySQL running on the remote host is 5.7.x prior to 5.7.35. It is, therefore, affected by multiple vulnerabilities, including the following, as noted in the July 2021 Critical Patch Update advisory:

  - curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being   used when a TLS 1.3 session ticket arrives over a connection. A malicious server can use this in rare unfortunate   circumstances to potentially reach remote code execution in the client. (CVE-2021-22901)

  - LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting   applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.)   (CVE-2019-17543)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected   are 5.7.34 and prior and 8.0.25 and prior. Difficult to exploit vulnerability allows high privileged attacker with   network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result   in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.
  (CVE-2021-2372)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle Business Intelligence Publisher or Oracle Analytics Server 5.5 running on the remote host is 11.1.1.9.x prior to 11.1.1.9.210720, 12.2.1.3.x prior to 12.2.1.3.210405, 12.2.1.4.x prior to 12.2.1.4.210402, or 12.2.5.5.x (OAS 5.5) prior to 12.2.5.5.210331. It is, therefore, affected by multiple vulnerabilities as noted in the July 2021 Critical Patch Update advisory, including the following:

  - Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: Scheduler). Easily     exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle     BI Publisher. Successful attacks of this vulnerability can result in takeover of Oracle BI Publisher.
    (CVE-2021-2392)

  - Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: E-Business Suite - XDO).
    Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle     BI Publisher. Successful attacks of this vulnerability can result in takeover of Oracle BI Publisher.
    (CVE-2021-2396)

  - Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: E-Business Suite - XDO).
    Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle     BI Publisher. Successful attacks of this vulnerability can result in unauthorized access to critical data or     complete access to all Oracle BI Publisher accessible data.  (CVE-2021-2400)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 17.12, 18.8, 19.12, and 20.12 versions of Primavera P6 Enterprise Project Portfolio Management installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2021 CPU advisory.

  - Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction     and Engineering (component: Web Access). Supported versions that are affected are 17.12.0-17.12.20,     18.8.0-18.8.23, 19.12.0-19.12.14 and 20.12.0-20.12.3. Easily exploitable vulnerability allows low     privileged attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio     Management. While the vulnerability is in Primavera P6 Enterprise Project Portfolio Management, attacks     may significantly impact additional products. Successful attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of Primavera P6 Enterprise Project Portfolio     Management accessible data as well as unauthorized read access to a subset of Primavera P6 Enterprise     Project Portfolio Management accessible data. (CVE-2021-2366)

  - Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction     and Engineering (component: Web Access). Supported versions that are affected are 20.12.0-20.12.3. Easily     exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise     Primavera P6 Enterprise Project Portfolio Management. Successful attacks of this vulnerability can result     in unauthorized read access to a subset of Primavera P6 Enterprise Project Portfolio Management accessible     data. (CVE-2021-2386)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
151974	Oracle Primavera Gateway (Jul 2021 CPU)	Nessus	CGI abuses	7/22/2021	12/7/2023	critical
151906	Oracle MySQL Connectors (Jul 2021 CPU)	Nessus	Misc.	7/21/2021	12/7/2023	high
152034	Oracle Identity Manager (Jul 2021 CPU)	Nessus	Misc.	7/23/2021	12/6/2023	high
151973	Oracle Primavera Unifier (Jul 2021 CPU)	Nessus	CGI abuses	7/22/2021	12/7/2023	high
151904	Oracle Coherence Multiple Vulnerabilities (Jul 2021 CPU)	Nessus	Misc.	7/21/2021	12/7/2023	high
152043	Oracle Application Testing Suite (Jul 2021 CPU)	Nessus	Misc.	7/23/2021	12/6/2023	high
152030	Oracle WebCenter Portal Multiple Vulnerabilities (Jul 2021 CPU)	Nessus	Misc.	7/23/2021	12/6/2023	critical
151903	Oracle Enterprise Manager Cloud Control (Jul 2021 CPU)	Nessus	Misc.	7/21/2021	12/7/2023	critical
152026	Oracle Database Server Multiple Vulnerabilities (Jul 2021 CPU)	Nessus	Databases	7/23/2021	12/6/2023	critical
151978	Oracle Access Manager Multiple Vulnerabilities (Jul 2021 CPU)	Nessus	Misc.	7/22/2021	4/25/2023	critical
151968	MySQL 8.0.x < 8.0.26 Multiple Vulnerabilities (Jul 2021 CPU)	Nessus	Databases	7/22/2021	12/7/2023	high
151969	MySQL 5.7.x < 5.7.35 Multiple Vulnerabilities (Jul 2021 CPU)	Nessus	Databases	7/22/2021	12/7/2023	high
152027	Oracle Business Intelligence Publisher Multiple Vulnerabilities (Jul 2021 CPU)	Nessus	Misc.	7/23/2021	12/6/2023	high
151892	Oracle Primavera P6 Enterprise Project Portfolio Management (Jul 2021 CPU)	Nessus	CGI abuses	7/21/2021	12/7/2023	medium

Detections

Analytics

Plugins Search

critical

high

high

high

high

high

critical

critical

critical

critical

high

high

high

medium