The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0873 advisory.

  - CVE-2021-20220 undertow: Possible regression in fix for (CVE-2020-10687)

  - bouncycastle: password bypass in OpenBSDBCrypt.checkPassword utility possible (CVE-2020-28052)

  - jboss-remoting: Threads hold up forever in the EJB server by suppressing the ack from an EJB client     (CVE-2020-35510)

  - guava: local information disclosure via temporary directory created with unsafe permissions     (CVE-2020-8908)

  - undertow: Possible regression in fix for CVE-2020-10687 (CVE-2021-20220)

  - wildfly: Information disclosure due to publicly accessible privileged actions in JBoss EJB Client     (CVE-2021-20250)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:4702 advisory.

  - python-ecdsa: Unexpected and  undocumented exceptions during signature decoding (CVE-2019-14853)

  - python-ecdsa: DER encoding is not being verified in signatures (CVE-2019-14859)

  - rubygem-activerecord-session_store: hijack sessions by using timing attacks targeting the session id     (CVE-2019-25025)

  - PyYAML: incomplete fix for CVE-2020-1747 (CVE-2020-14343)

  - rubygem-nokogiri: XML external entity injection via Nokogiri::XML::Schema (CVE-2020-26247)

  - rake: OS Command Injection via egrep in Rake::FileList (CVE-2020-8130)

  - guava: local information disclosure via temporary directory created with unsafe permissions     (CVE-2020-8908)

  - Satellite: BMC controller credential leak via API (CVE-2021-20256)

  - python-aiohttp: Open redirect in aiohttp.web_middlewares.normalize_path_middleware (CVE-2021-21330)

  - rubygem-actionpack: Possible Information Disclosure / Unintended Method Execution in Action Pack     (CVE-2021-22885)

  - rails: Possible Denial of Service vulnerability in Action Dispatch (CVE-2021-22902)

  - rails: Possible DoS Vulnerability in Action Controller Token Authentication (CVE-2021-22904)

  - django: potential directory-traversal via uploaded files (CVE-2021-28658)

  - rubygem-puma: incomplete fix for CVE-2019-16770 allows Denial of Service (DoS) (CVE-2021-29509)

  - django: Potential directory-traversal via uploaded files (CVE-2021-31542)

  - rubygem-addressable: ReDoS in templates (CVE-2021-32740)

  - django: Potential directory traversal via ``admindocs`` (CVE-2021-33203)

  - python-urllib3: ReDoS in the parsing of authority part of URL (CVE-2021-33503)

  - django: Possible indeterminate SSRF, RFI, and LFI attacks since validators accepted leading zeros in IPv4     addresses (CVE-2021-33571)

  - Satellite: Azure compute resource secret_key leak to authenticated users (CVE-2021-3413)

  - foreman: possible man-in-the-middle in smart_proxy realm_freeipa (CVE-2021-3494)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0874 advisory.

  - CVE-2021-20220 undertow: Possible regression in fix for (CVE-2020-10687)

  - bouncycastle: password bypass in OpenBSDBCrypt.checkPassword utility possible (CVE-2020-28052)

  - jboss-remoting: Threads hold up forever in the EJB server by suppressing the ack from an EJB client     (CVE-2020-35510)

  - guava: local information disclosure via temporary directory created with unsafe permissions     (CVE-2020-8908)

  - undertow: Possible regression in fix for CVE-2020-10687 (CVE-2021-20220)

  - wildfly: Information disclosure due to publicly accessible privileged actions in JBoss EJB Client     (CVE-2021-20250)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2021 CPU advisory.

  - Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions     that are affected are 12.1.0.2 and 19c. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via Oracle Net to compromise Advanced Networking Option. Successful attacks require     human interaction from a person other than the attacker and while the vulnerability is in Advanced     Networking Option, attacks may significantly impact additional products. Successful attacks of this     vulnerability can result in takeover of Advanced Networking Option. (CVE-2021-2351)

  - Vulnerability in the Oracle Text component of Oracle Database Server. Supported versions that are affected     are 12.1.0.2 and 19c. Easily exploitable vulnerability allows high privileged attacker having Create Any     Procedure, Alter Any Table privilege with network access via Oracle Net to compromise Oracle Text.
    Successful   attacks of this vulnerability can result in takeover of Oracle Text. (CVE-2021-2328)

  - Vulnerability in the Oracle XML DB component of Oracle Database Server. Supported versions that are     affected   are 12.1.0.2 and 19c. Easily exploitable vulnerability allows high privileged attacker having     Create Any   Procedure, Create Public Synonym privilege with network access via Oracle Net to compromise     Oracle XML DB.   Successful attacks of this vulnerability can result in takeover of Oracle XML DB.
    (CVE-2021-2329)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle WebLogic Server installed on the remote host is missing a security patch from the April 2020 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilities:

  - A temp directory creation vulnerability in the bundled Guava component that allows a low privileged attacker     with logon access to the infrastructure where Oracle WebLogic Server executes to gain read access to a subset of     data accessible to Oracle WebLogic Server. (CVE-2020-8908)

  - An improper input validation flaw in the bundled JBoss Enterprise Application Platform that allows an     unauthenticated attacker with network access via HTTP update, insert or delete access to a subset of data     accessible to Oracle WebLogic Server. (CVE-2021-28170)

  - A cross-site scripting vulnerability in the bundled JQuery component that allows an unauthenticated attacker with     network access via HTTP, with human interaction from another user, update, insert, delete and read access to a     subset of data accessible to Oracle WebLogic Server. (CVE-2021-41184)

  - A denial of service vulnerability in the core component of Oracle WebLogic Server that allows an unauthenticated     attacker with network access via T3/IIOP to cause a hang or frequently repeatable crash of the Oracle WebLogic     Server. (CVE-2022-21441)

  - A vulnerability in the console component of Oracle WebLogic Server that allows an unauthenticated attacker with     network access via HTTP, with human interaction from another user, update, insert, delete and read access to a     subset of the data accessible to Oracle WebLogic Server. (CVE-2022-21453)

  - A SQL injection vulnerability in the bundled Log4J component that allows an unauthenticated attacker with     network access via HTTP to execute arbitrary code on the Oracle WebLogic Server. (CVE-2022-23305)

  - An XML injection vulnerability in the bundled Apache Xerces Java component that allows an unauthenticated attacker     with network access via HTTP, with human interaction from another user, to cause a hang or frequently repeatable     crash of Oracle WebLogic Server. (CVE-2022-23437)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The All Supported Versions versions of GoldenGate installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2021 CPU advisory.

  - Vulnerability in Oracle GoldenGate (component: Install (Dell BSAFE Crypto-J)). The supported version that is     affected is Prior to 19.1.0.0.0.210420. Easily exploitable vulnerability allows unauthenticated attacker with     network access via Oracle Net to compromise Oracle GoldenGate. Successful attacks require human interaction     from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized     access to critical data or complete access to all Oracle GoldenGate accessible data. (CVE-2019-3740)

  - Security-in-Depth issue in Oracle GoldenGate (component: Install (jQuery)). This vulnerability cannot be     exploited in the context of this product. (CVE-2020-11023)   
  - Security-in-Depth issue in Oracle GoldenGate (component: General (Apache Batik)). This vulnerability cannot     be exploited in the context of this product. (CVE-2020-11987)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0872 advisory.

  - CVE-2021-20220 undertow: Possible regression in fix for (CVE-2020-10687)

  - bouncycastle: password bypass in OpenBSDBCrypt.checkPassword utility possible (CVE-2020-28052)

  - jboss-remoting: Threads hold up forever in the EJB server by suppressing the ack from an EJB client     (CVE-2020-35510)

  - guava: local information disclosure via temporary directory created with unsafe permissions     (CVE-2020-8908)

  - undertow: Possible regression in fix for CVE-2020-10687 (CVE-2021-20220)

  - wildfly: Information disclosure due to publicly accessible privileged actions in JBoss EJB Client     (CVE-2021-20250)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Primavera Unifier installed on the remote host is affected by multiple vulnerabilities as referenced in the January 2022 CPU advisory.

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component:
    Platform, Data Persistence (OWASP Java HTML Sanitizer)). Supported versions that are affected are     17.7-17.12, 18.8, 19.12, 20.12 and 21.12. Easily exploitable vulnerability allows unauthenticated attacker     with network access via HTTP to compromise Primavera Unifier. Successful attacks of this vulnerability can     result in takeover of Primavera Unifier. (CVE-2021-42575)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component:
    Platform,Data Parsing (jsoup)). Supported versions that are affected are 20.12 and 21.12. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Primavera Unifier. Successful attacks of this vulnerability can result in unauthorized ability to cause a     hang or frequently repeatable crash (complete DOS) of Primavera Unifier. (CVE-2021-37714)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized     Thirdparty Jars (Apache Log4j)). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and     14.1.1.0.0. Difficult to exploit vulnerability allows high privileged attacker with network access via     HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover     of Oracle WebLogic Server. (CVE-2021-44832)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle NoSQL Database Enterprise running on the remote host is prior to 20.3.17. It is, therefore, affected by multiple vulnerabilities as referenced in the April 2021 CPU advisory.

  - Vulnerability in Oracle NoSQL Database (component: Administration (Node.js)). The supported     version that is affected is Prior to 20.3. Easily exploitable vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle NoSQL Database.
    Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of Oracle NoSQL Database. (CVE-2021-22883)

  - Security-in-Depth issue in Oracle NoSQL Database (component: Administration (jackson-databind)).
    This vulnerability cannot be exploited in the context of this product. (CVE-2019-14379)

  - Vulnerability in Oracle NoSQL Database (component: Administration (Google Guava)). The supported     version that is affected is Prior to 20.3. Easily exploitable vulnerability allows low privileged     attacker with logon to the infrastructure where Oracle NoSQL Database executes to compromise     Oracle NoSQL Database. Successful attacks of this vulnerability can result in unauthorized read     access to a subset of Oracle NoSQL Database accessible data. (CVE-2020-8908)   
  - Vulnerability in Oracle NoSQL Database (component: Administration (Netty)). The supported version     that is affected is Prior to 20.3. Easily exploitable vulnerability allows unauthenticated attacker     with network access via HTTP to compromise Oracle NoSQL Database. Successful attacks of this     vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash     (complete DOS) of Oracle NoSQL Database. (CVE-2020-11612)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
147837	RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.3.6 (RHSA-2021:0873)	Nessus	Red Hat Local Security Checks	3/17/2021	10/7/2021	high
155377	RHEL 7 : Satellite 6.10 Release (Moderate) (RHSA-2021:4702)	Nessus	Red Hat Local Security Checks	11/17/2021	11/17/2021	critical
147838	RHEL 8 : Red Hat JBoss Enterprise Application Platform 7.3.6 (RHSA-2021:0874)	Nessus	Red Hat Local Security Checks	3/17/2021	10/7/2021	high
152026	Oracle Database Server Multiple Vulnerabilities (Jul 2021 CPU)	Nessus	Databases	7/23/2021	5/9/2022	critical
160036	Oracle WebLogic Server (Apr 2022 CPU)	Nessus	Misc.	4/21/2022	4/26/2022	critical
154342	Oracle GoldenGate (Oct 2021 CPU)	Nessus	Misc.	10/22/2021	4/11/2022	high
147831	RHEL 6 : Red Hat JBoss Enterprise Application Platform 7.3.6 (RHSA-2021:0872)	Nessus	Red Hat Local Security Checks	3/17/2021	10/7/2021	high
156832	Oracle Primavera Unifier (Jan 2022 CPU)	Nessus	CGI abuses	1/19/2022	4/11/2022	critical
148977	Oracle NoSQL Database Multiple Vulnerabilities (Apr 2021 CPU)	Nessus	Databases	4/23/2021	4/11/2022	critical

Plugins Search

high

critical

high

critical

critical

high

high

critical

critical