The 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0 versions of Coherence installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2022 CPU advisory.

  - Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported     versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability     allows unauthenticated attacker with network access via T3 to compromise Oracle Coherence. Successful     attacks of this vulnerability can result in takeover of Oracle Coherence. (CVE-2022-21420)

  - Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Elastic     Search (Netty)). Supported versions that are affected are 8.58 and 8.59. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise     PeopleTools. Successful attacks require human interaction from a person other than the attacker.
    Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification     access to critical data or all PeopleSoft Enterprise PeopleTools accessible data. (CVE-2021-43797)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of MySQL Server installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2022, October 2022 and January 2023 CPU advisories.

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Packaging (OpenSSL)).
    Supported versions that are affected are 5.7.37 and prior and 8.0.28 and prior. Easily exploitable vulnerability     allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash     (complete DOS) of MySQL Server. (CVE-2022-0778)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Compiling (protobuf)).
    Supported versions that are affected are 8.0.28 and prior. Easily exploitable vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of MySQL Server. (CVE-2021-22570)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication Plugin).
    Supported versions that are affected are 8.0.28 and prior. Easily exploitable vulnerability allows low     privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of MySQL Server. (CVE-2022-21454)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Primavera Unifier installed on the remote host is affected by multiple vulnerabilities as referenced in the April 2022 CPU advisory.

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform     (dojo)). Supported versions that are affected are 17.7-17.12, 18.8, 19.12, 20.12 and 21.12. Easily     exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise     Primavera Unifier. Successful attacks of this vulnerability can result in unauthorized ability to cause a     hang or frequently repeatable crash (complete DOS) of Primavera Unifier as well as unauthorized update,     insert or delete access to some of Primavera Unifier accessible data and unauthorized read access to a     subset of Primavera Unifier accessible data. (CVE-2021-23450)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console,     Samples (jQueryUI)). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0.
    Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to     compromise Oracle WebLogic Server. Successful attacks require human interaction from a person other than     the attacker and while the vulnerability is in Oracle WebLogic Server, attacks may significantly impact     additional products (scope change). Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Oracle WebLogic Server accessible data as well as unauthorized     read access to a subset of Oracle WebLogic Server accessible data. (CVE-2021-41184)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of VirtualBox installed on the remote host is prior to 6.1.34. It is, therefore, affected by multiple  vulnerabilities as referenced in the April 2022 CPU advisory:

  - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The     supported version that is affected is Prior to 6.1.34. Easily exploitable vulnerability allows low     privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise     Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM     VirtualBox. Note: This vulnerability applies to Windows systems only. (CVE-2022-21491)

  - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The     supported version that is affected is Prior to 6.1.34. Easily exploitable vulnerability allows high     privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise     Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly     impact additional products (scope change). Successful attacks of this vulnerability can result in     unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM     VirtualBox as well as unauthorized update, insert or delete access to some of Oracle VM VirtualBox     accessible data. (CVE-2022-21465)

  - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The     supported version that is affected is Prior to 6.1.34. Easily exploitable vulnerability allows low     privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise     Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly     impact additional products (scope change). Successful attacks of this vulnerability can result in     unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM     VirtualBox. (CVE-2022-21471)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of MySQL Server installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2022 CPU advisory.

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Packaging (OpenSSL)).
    Supported versions that are affected are 5.7.37 and prior and 8.0.28 and prior. Easily exploitable vulnerability     allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash     (complete DOS) of MySQL Server. (CVE-2022-0778)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication Plugin).
    Supported versions that are affected are 5.7.37 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2022-21454)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions     that are affected are 5.7.37 and prior. Easily exploitable vulnerability allows high     privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of MySQL Server. (CVE-2022-21427)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle HTTP Server installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2022 CPU advisory.

  - Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener     (Apache HTTP Server)). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Oracle HTTP Server. Successful attacks of this vulnerability can result in takeover of Oracle HTTP Server.
    CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). (CVE-2021-39275)

  - Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: SSL Module     (cURL)). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Difficult to exploit     vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle HTTP     Server. Successful attacks of this vulnerability can result in takeover of Oracle HTTP Server. CVSS 3.1     Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). (CVE-2021-22901)

  - Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: SSL Module (Apache     HTTP Server)). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle HTTP     Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete     access to some of Oracle HTTP Server accessible data and unauthorized ability to cause a partial denial of     service (partial DOS) of Oracle HTTP Server. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts).
    CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L). (CVE-2021-44224)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 12.2.1.3.0 and 12.2.1.4.0 versions of WebCenter Sites installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2022 CPU advisory.

  - Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter     Sites (Cryptacular)). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Oracle WebCenter Sites. Successful attacks of this vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete DOS) of Oracle WebCenter Sites. (CVE-2020-7226)

  - Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: Advanced UI     (Apache Log4j)). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Difficult to exploit     vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebCenter     Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. (CVE-2021-44832)

  - Security-in-Depth issue in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component:
    WebCenter Sites (Bouncy Castle Java Library)). This vulnerability cannot be exploited in the context of     this product. (CVE-2020-28052)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tuxedo installed on the remote host is missing a security patch. It is, therefore affected by a remote code execution vulnerability in the bundled Apache Log4J component.  Successful exploitation of this vulnerability allow an unauthenticated attacker with network access via HTTP takeover of Oracle Tuxedo.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of MySQL Connectors installed on the remote host are affected by a vulnerability as referenced in the April 2022 CPU advisory.

  - Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/C++ (OpenSSL)).
    Supported versions that are affected are 8.0.28 and prior. Easily exploitable vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this     vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS)     of MySQL Connectors. (CVE-2022-0778)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle Identity Manager installed on the remote host is missing a security patch and is, therefore affected by multiple vulnerabilities as referenced in the April 2022 Critical Patch Update(CPU) advisory.

  - Vulnerability in the Oracle Identity Management Suite  product of Oracle Fusion Middleware (component: Centralized     Third Party Jars (Apache Log4j)). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle     Identity Management Suite. Successful attacks of this vulnerability can result in takeover of Oracle Identity     Management Suite. (CVE-2022-23305)

  - Vulnerability in the Oracle Identity Management Suite product of Oracle Fusion Middleware (component: Advanced UI     (Apache Log4j)). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Difficult to exploit     vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Identity     Management Suite. Successful attacks of this vulnerability can result in takeover of Oracle Identity Management     Suite. (CVE-2021-44832)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle WebLogic Server installed on the remote host is missing a security patch from the April 2020 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilities:

  - A temp directory creation vulnerability in the bundled Guava component that allows a low privileged attacker     with logon access to the infrastructure where Oracle WebLogic Server executes to gain read access to a subset of     data accessible to Oracle WebLogic Server. (CVE-2020-8908)

  - An improper input validation flaw in the bundled JBoss Enterprise Application Platform that allows an     unauthenticated attacker with network access via HTTP update, insert or delete access to a subset of data     accessible to Oracle WebLogic Server. (CVE-2021-28170)

  - A cross-site scripting vulnerability in the bundled JQuery component that allows an unauthenticated attacker with     network access via HTTP, with human interaction from another user, update, insert, delete and read access to a     subset of data accessible to Oracle WebLogic Server. (CVE-2021-41184)

  - A denial of service vulnerability in the core component of Oracle WebLogic Server that allows an unauthenticated     attacker with network access via T3/IIOP to cause a hang or frequently repeatable crash of the Oracle WebLogic     Server. (CVE-2022-21441)

  - A vulnerability in the console component of Oracle WebLogic Server that allows an unauthenticated attacker with     network access via HTTP, with human interaction from another user, update, insert, delete and read access to a     subset of the data accessible to Oracle WebLogic Server. (CVE-2022-21453)

  - A SQL injection vulnerability in the bundled Log4J component that allows an unauthenticated attacker with     network access via HTTP to execute arbitrary code on the Oracle WebLogic Server. (CVE-2022-23305)

  - An XML injection vulnerability in the bundled Apache Xerces Java component that allows an unauthenticated attacker     with network access via HTTP, with human interaction from another user, to cause a hang or frequently repeatable     crash of Oracle WebLogic Server. (CVE-2022-23437)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2022 CPU advisory.

  - Vulnerability in the Oracle Database - Enterprise Edition Sharding component of Oracle Database Server.
    The supported version that is affected is 19c. Easily exploitable vulnerability allows high privileged     attacker having Create Any Procedure privilege with network access via Oracle Net to compromise Oracle     Database - Enterprise Edition Sharding. Successful attacks of this vulnerability can result in takeover of     Oracle Database - Enterprise Edition Sharding. (CVE-2022-21410)

  - Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are     12.1.0.2, 19c and 21c. Easily exploitable vulnerability allows low privileged attacker having Create     Procedure privilege with network access via multiple protocols to compromise Java VM. Successful attacks     of this vulnerability can result in unauthorized creation, deletion or modification access to critical     data or all Java VM accessible data. (CVE-2022-21498)

  - Vulnerability in the RDBMS Gateway / Generic ODBC Connectivity component of Oracle Database Server.
    Supported versions that are affected are 12.1.0.2, 19c and 21c. Easily exploitable vulnerability allows     low privileged attacker having Create Session privilege with network access via Oracle Net to compromise     RDBMS Gateway / Generic ODBC Connectivity. Successful attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of RDBMS Gateway / Generic ODBC Connectivity     accessible data as well as unauthorized read access to a subset of RDBMS Gateway / Generic ODBC     Connectivity accessible data. (CVE-2022-21411)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle Application Testing Suite installed on the remote host is affected by a vulnerability as referenced in the April 2022 CPU advisory.

  - Vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager (component:
    Load Testing for Web Apps (Apache log4net)). The supported version that is affected is 13.3.0.1. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Oracle Application Testing Suite. Successful attacks of this vulnerability can result in takeover of     Oracle Application Testing Suite. (CVE-2018-1285)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The versions of Oracle E-Business Suite installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2022 CPU advisory.

  - Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Popups).
    Supported versions that are affected are 12.2.4-12.2.11. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Oracle Applications Framework.
    Successful attacks require human interaction from a person other than the attacker and while the     vulnerability is in Oracle Applications Framework, attacks may significantly impact additional products     (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or     delete access to some of Oracle Applications Framework accessible data as well as unauthorized read access     to a subset of Oracle Applications Framework accessible data. (CVE-2022-21468)

  - Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component:
    Attachments, File Upload). Supported versions that are affected are 12.2.6-12.2.11. Easily exploitable     vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle     Applications Framework. Successful attacks require human interaction from a person other than the attacker     and while the vulnerability is in Oracle Applications Framework, attacks may significantly impact     additional products (scope change). Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Oracle Applications Framework accessible data as well as     unauthorized read access to a subset of Oracle Applications Framework accessible data.     (CVE-2022-21477)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of MySQL Enterprise Monitor installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2022 CPU advisory.

  - Vulnerability in the MySQL Enterprise Monitor product of Oracle MySQL (component: Monitoring: General     (Apache Log4j)). Supported versions that are affected are 8.0.29 and prior. Easily exploitable     vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise     MySQL Enterprise Monitor. Successful attacks of this vulnerability can result in takeover of MySQL     Enterprise Monitor. (CVE-2022-23305)

  - Vulnerability in the MySQL Enterprise Monitor product of Oracle MySQL (component: Monitoring: General     (Spring Framework)). Supported versions that are affected are 8.0.29 and prior. Easily exploitable     vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise     MySQL Enterprise Monitor. Successful attacks of this vulnerability can result in takeover of MySQL     Enterprise Monitor. (CVE-2022-22965)

  - Vulnerability in the MySQL Enterprise Monitor product of Oracle MySQL (component: Monitoring: General     (Apache Tomcat)). Supported versions that are affected are 8.0.29 and prior. Easily exploitable     vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise     MySQL Enterprise Monitor. Successful attacks of this vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete DOS) of MySQL Enterprise Monitor. (CVE-2021-42340)

  - Vulnerability in the MySQL Enterprise Monitor product of Oracle MySQL (component: Monitoring: General     (Spring Framework)). Supported versions that are affected are 8.0.29 and prior. The patterns for     disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is     listed with both upper and lower case for the first character of the field, including upper and lower case for the      first character of all nested fields within the property path. (CVE-2022-22968)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 13.4.0.0 and 13.5.0.0 versions of Enterprise Manager Base Platform installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2022 CPU advisory.

  - Vulnerability in the Oracle Management Service component (Apache Log4j) of the Enterprise Manager     Base Platform. Easily exploitable vulnerability allows unauthenticated attacker with network access     via HTTP to compromise and take over the Enterprise Manager Base Platform. (CVE-2022-23305)

  - Vulnerability in the Enterprise Manager Install component (libxml2) of the Enterprise Manager     Base Platform. Easily exploitable vulnerability allows unauthenticated attacker with network access     via HTTP to compromise and take over the Enterprise Manager Base Platform. (CVE-2021-3518)

  - Vulnerability in the Enterprise Manager Install component (Apache Log4j) of the Enterprise Manager     Base Platform. Difficult to exploit vulnerability allows high privileged attacker with network access     via HTTP to compromise and take over the Enterprise Manager Base Platform. (CVE-2021-44832)

  - Vulnerability in the UI Framework component of the Enterprise Manager Base Platform. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     the Enterprise Manager Base Platform. Successful attacks require human interaction from a person other     than the attacker and while the vulnerability is in Enterprise Manager Base Platform, attacks may     significantly impact additional products (scope change). Successful attacks of this vulnerability     can result in unauthorized update, insert or delete access to some of Enterprise Manager Base Platform     accessible data. (CVE-2022-21469)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 12.4.0.0 versions of Enterprise Manager Ops Center installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2022 CPU advisory.

  - Vulnerability in the Oracle Secure Global Desktop product of Oracle Virtualization (component: Web Server     (Apache HTTP Server)). The supported version that is affected is 5.6. Difficult to exploit vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Oracle Secure Global Desktop.
    While the vulnerability is in Oracle Secure Global Desktop, attacks may significantly impact additional     products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Secure     Global Desktop. (CVE-2021-40438)

  - Vulnerability in the Oracle StorageTek ACSLS product of Oracle Systems (component: Software (JDBC)). The     supported version that is affected is 8.5.1. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via Oracle Net to compromise Oracle StorageTek ACSLS. Successful attacks     require human interaction from a person other than the attacker and while the vulnerability is in Oracle     StorageTek ACSLS, attacks may significantly impact additional products (scope change). Successful attacks     of this vulnerability can result in takeover of Oracle StorageTek ACSLS. (CVE-2021-2351)

  - Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: Advanced UI     (Apache Log4j)). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Difficult to exploit     vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebCenter     Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1     Base Score 6.6 (Confidentiality, Integrity and Availability impacts). (CVE-2021-44832)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle Business Process Management Suite installed on the remote host is affected by multiple vulnerabilities, as referenced in the April 2022 CPU advisory. Specifically:

  - Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware     (component: BPM Studio (Apache Groovy)). Supported versions that are affected are 12.2.1.3.0 and     12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the     infrastructure where Oracle Business Process Management Suite executes to compromise Oracle Business     Process Management Suite. Successful attacks of this vulnerability can result in unauthorized access to     critical data or complete access to all Oracle Business Process Management Suite accessible data.
    (CVE-2020-17521)

  - Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware     (component: Installer (jsoup)). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Oracle Business Process Management Suite. Successful attacks of this vulnerability can result in     unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Business     Process Management Suite. (CVE-2021-37714)

  - Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware     (component: Runtime Engine (JBoss Enterprise Application Platform)). Supported versions that are affected     are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with     network access via HTTP to compromise Oracle Business Process Management Suite. Successful attacks of this     vulnerability can result in takeover of Oracle Business Process Management Suite. (CVE-2022-23305)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

The version of Oracle WebCenter Portal installed on the remote host is missing a security patch from the April 2022 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilities:

  - An XML external entity vulnerability in the bundled jackson-databind component which allows an unauthenticated     attacker with network access via HTTP to access, create or delete all data accessible to Oracle WebCenter     Portal. (CVE-2020-25649)

  - Denial of service vulnerabilities in the bundled Apache Tika, jsoup, Netty and Apache Commons Compress components which     allow an unauthenticated attacker with network access via HTTP to cause a hang or frequently repeatable crash     of the Oracle WebCenter Portal. (CVE-2020-28657, CVE-2021-36090, CVE-2021-37137, CVE-2021-37714)

  - A path traversal vulnerability in the bundled Apache Commons IO component which allows an unauthenticated attacker     with network access via HTTP to read, update or delete a subset of data accessible to Oracle WebCenter Portal.
    (CVE-2021-29425)

  - A Denial of service vulnerability in the bundled Apache PDFBox component which allows an unauthenticated attacker     with logon to the infrastructure where Oracle WebCenter Portal executes, with human interaction from another user     to cause a hang or frequently repeatable crash of the Oracle WebCenter Portal. (CVE-2021-31912)

  - A cross-site scripting vulnerability in the bundled CKEditor component which allows a low privileged attacker     with network access via HTTP, with human interaction from another user, to read, update or delete a subset of     data accessible to Oracle WebCenter Portal. (CVE-2021-41165)

  - A remote code execution vulnerability in the bundled Apache Log4J component which allows a high privileged     attacker with network access via HTTP to execute arbitrary code on the Oracle WebCenter Portal. (CVE-2021-44832)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
159966	Oracle Coherence (Apr 2022 CPU)	Nessus	Misc.	2022/4/20	2024/11/27	medium
159977	Oracle MySQL Server (Apr 2022 CPU)	Nessus	Databases	2022/4/20	2025/4/18	medium
159919	Oracle Primavera Unifier (Apr 2022 CPU)	Nessus	CGI abuses	2022/4/20	2024/10/23	critical
159985	Oracle VM VirtualBox (Apr 2022 CPU)	Nessus	Misc.	2022/4/20	2022/4/26	high
159976	Oracle MySQL Server (Apr 2022 CPU)	Nessus	Databases	2022/4/20	2024/11/27	high
159947	Oracle HTTP Server (Apr 2022 CPU)	Nessus	Web Servers	2022/4/20	2023/11/1	critical
160034	Oracle WebCenter Sites (Apr 2022 CPU)	Nessus	Windows	2022/4/21	2023/10/31	high
160161	Oracle Tuxedo RCE (Apr 2022 CPU)	Nessus	Misc.	2022/4/25	2023/10/31	critical
160049	Oracle MySQL Connectors (Apr 2022 CPU)	Nessus	Misc.	2022/4/21	2023/4/20	high
160180	Oracle Identity Manager (Apr 2022 CPU)	Nessus	Misc.	2022/4/25	2023/10/31	critical
160036	Oracle WebLogic Server (Apr 2022 CPU)	Nessus	Misc.	2022/4/21	2024/1/4	critical
160079	Oracle Database Server (Apr 2022 CPU)	Nessus	Databases	2022/4/22	2024/11/27	medium
160053	Oracle Application Testing Suite (Apr 2022 CPU)	Nessus	Misc.	2022/4/21	2023/10/31	critical
160080	Oracle E-Business Suite (Apr 2022 CPU)	Nessus	Misc.	2022/4/22	2022/12/30	medium
159917	Oracle MySQL Enterprise Monitor (Apr 2022 CPU)	Nessus	CGI abuses	2022/4/20	2024/10/23	critical
160377	Oracle Enterprise Manager Cloud Control (Apr 2022 CPU)	Nessus	Misc.	2022/4/29	2023/10/31	critical
159930	Oracle Enterprise Manager Ops Center (Apr 2022 CPU)	Nessus	Misc.	2022/4/20	2023/4/25	critical
159978	Oracle Business Process Management Suite (Apr 2022 CPU)	Nessus	Misc.	2022/4/20	2023/11/1	critical
159954	Oracle WebCenter Portal Multiple Vulnerabilities (Apr 2022 CPU)	Nessus	Misc.	2022/4/20	2023/10/24	high

检测

插件搜索

medium

medium

critical

high

high

critical

high

critical

high

critical

critical

medium

critical

medium

critical

critical

critical

critical

high