There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Improper Restriction of XML External Entity Reference ('XXE') vulnerability in Apache XML Graphics FOP.
    This issue affects Apache XML Graphics FOP: 2.9. Users are recommended to upgrade to version 2.10, which
    fixes the issue. (CVE-2024-28168)

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - Apache XML Graphics FOP 中的不當限制 XML 外部實體參照 ('XXE') 弱點。
    此問題會影響 Apache XML Graphics FOP： 2.9。建議使用者升級至 2.10 版，即可修正此問題。(CVE-2024-28168)

請注意，Nessus 依賴供應商報告的套件存在。

远程主机上安装的 Oracle Business Process Management Suite 版本受到 2025 年 4 月 CPU 公告中提及的多个漏洞影响，具体如下所示:

  - Oracle Fusion Middleware 的 Oracle Business Process Management Suite 产品中的漏洞 (组件 : Composer, Common (Apache Commons Compress))。支持的版本中受影响的是 12.2.1.4.0。攻击此漏洞的难度较小，登录执行 Oracle Business Process Management Suite 所在基础架构的未经身份验证的攻击者可利用此漏洞入侵 Oracle Business Process Management Suite。除攻击者以外的他人进行交互是实现成功攻击的必要条件。成功攻击此漏洞可导致在未经授权的情况下造成 Oracle Solaris 挂起或频繁反复崩溃（完全 DOS）。（CVE-2024-25710）

  - Oracle Fusion Middleware 的 Oracle Business Process Management Suite  产品中的漏洞 (组件 : Plugins (Apache FOP)) 支持的版本中受影响的是 12.2.1.4.0 和 14.1.2.0.0。此漏洞较容易攻击，允许未经身份验证的攻击者通过 HTTP 进行网络访问，从而入侵 Oracle Business Process Management Suite。成功利用此漏洞进行攻击可导致在未经授权的情况下访问重要数据，或完整访问所有 Oracle Business Process Management Suite 可访问数据。(CVE-2024-28168)

  - Oracle Fusion Middleware 的 Oracle Business Process Management Suite  产品中的漏洞（组件：
    Composer, Third Party (Apache Avro))。支持的版本中受影响的是 12.2.1.4.0。此漏洞较容易攻击，允许未经身份验证的攻击者通过 HTTP 进行网络访问，从而入侵 Oracle Business Process Management Suite。成功利用此漏洞进行攻击可导致在未经授权的情况下更新、插入或删除某些 Oracle Business Process Management Suite 可访问数据的访问权限，以及对 Oracle Business Process Management Suite 可访问数据子集进行未授权的读取访问，并且可未经授权造成 Oracle Business Process Management Suite 部分拒绝服务 (部分 DoS)。(CVE-2024-47561)

  - Oracle Fusion Middleware 的 Oracle Business Process Management Suite  产品中的漏洞 (组件 : Runtime Engine (Apache Mina))。支持的版本中受影响的是 12.2.1.4.0 和 14.1.2.0.0。此漏洞较容易攻击，允许未经身份验证的攻击者通过 HTTPS 进行网络访问，从而入侵 Oracle Business Process Management Suite 。成功利用此漏洞进行攻击可导致接管 Oracle Business Process Management Suite。(CVE-2024-52046)


请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - Apache XML Graphics FOP 中不当限制 XML 外部实体引用 ('XXE') 漏洞。
    此问题影响 Apache XML Graphics FOP： 2.9。建议用户升级到修复了此问题的版本 2.10。(CVE-2024-28168)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

遠端主機上安裝的 Oracle Business Process Management Suite 版本受到 2025 年 4 月 CPU 公告中提及的多個弱點影響，如下所述：

  - Oracle Fusion Middleware 的 Oracle Business Process Management Suite 產品中的弱點 (元件：Composer、Common (Apache Commons Compress))。受影響的支援版本是 12.2.1.4.0。攻擊此弱點的難度較低，登入 Oracle Business Process Management Suite 執行所在基礎架構的未經驗證的攻擊者可利用此弱點入侵 Oracle Business Process Management Suite。若要成功攻擊，必須有攻擊者以外之他人的互動。若成功攻擊此弱點，可能未經授權即可導致 Oracle Business Process Management Suite 懸置或經常重複性當機 (完全 DOS)。(CVE-2024-25710)

  - Oracle Fusion Middleware 的 Oracle Business Process Management Suite 產品中的弱點 (元件：Plugins (Apache FOP))。受影響的支援版本是 12.2.1.4.0 和 14.1.2.0.0。攻擊此弱點的難度較小，經由 HTTP 存取網路的未經驗證的攻擊者可藉此入侵 Oracle Business Process Management Suite。若成功攻擊此弱點，則可能導致在未經授權的情況下存取重要資料，或完整存取所有可供存取的 Oracle Business Process Management Suite 資料。(CVE-2024-28168)

  - Oracle Fusion Middleware 的 Oracle Business Process Management Suite 產品中的弱點 (元件：
    Composer，Third Party (Apache Avro))。受影響的支援版本是 12.2.1.4.0。攻擊此弱點的難度較小，經由 HTTP 存取網路的未經驗證的攻擊者可藉此入侵 Oracle Business Process Management Suite。成功攻擊此弱點可能導致在未經授權的情況下更新、插入或刪除某些 Oracle Business Process Management Suite 可存取資料的存取權限，同時可在未經授權的情況下讀取 Oracle Business Process Management Suite 的可存取資料，以及在未經授權的情況下造成 Oracle Business Process Management Suite 部分拒絕服務 (部分 DOS)。(CVE-2024-47561)

  - Oracle Fusion Middleware 的 Oracle Business Process Management Suite 產品中的弱點 (元件：Runtime Engine (Apache Mina))。受影響的支援版本是 12.2.1.4.0 和 14.1.2.0.0。攻擊此弱點的難度較小，經由 HTTP 存取網路的未經驗證攻擊者可藉此入侵  Oracle Business Process Management Suite。若攻擊成功，則導致 Oracle Access Manager 被接管。(CVE-2024-52046)


請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - Apache XML Graphics FOP での XML 外部エンティティ参照の不適切な制限（「XXE」）の脆弱性。
    この問題はApache XML Graphics FOPに影響します： 2.9。ユーザーには、この問題を修正したバージョンであるバージョン 2.10 へのアップグレードをお勧めします。(CVE-2024-28168)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

リモートホストにインストールされている Oracle Business Process Management Suite のバージョンは、2025 年 4 月の CPU アドバイザリに記載されている複数の脆弱性の影響を受けます。次のようなものがあります。

  - Oracle Fusion Middleware の Oracle Business Process Management Suite 製品の脆弱性 (コンポーネント: コンポーザー、共通 (Apache Commons Compress))。サポートされているバージョンで影響を受けるのは 12.2.1.4.0 です。簡単に悪用可能な脆弱性によって、認証されていない攻撃者が、Oracle Business Process Management Suite が実行されているインフラストラクチャにログオンし、Oracle Business Process Management Suite を侵害する可能性があります。この攻撃が成功するには、攻撃者以外の人物の関与が必要です。この脆弱性を利用した攻撃に成功すると、権限がなくても、Oracle Business Process Management Suite をハングアップさせたり、頻繁に繰り返しクラッシュ (完全な DOS) させたりすることができるようになります。(CVE-2024-25710)

  - Oracle Fusion Middleware の Oracle Business Process Management Suite 製品の脆弱性 (コンポーネント: プラグイン (Apache FOP)) サポートされているバージョンで影響を受けるのは、12.2.1.4.0 および 14.1.2.0.0です。容易に悪用可能な脆弱性があり、認証されていない攻撃者が HTTP を介してネットワークにアクセスし、Oracle Business Process Management Suite を侵害する可能性があります。この脆弱性に対する攻撃が成功すると、重要なデータに権限なしにアクセスしたり、Oracle Business Process Management Suite がアクセスできるすべてのデータに完全にアクセスしたりする可能性があります。(CVE-2024-28168)

  - Oracle Fusion Middleware の Oracle Business Process Management Suite 製品の脆弱性 (component:
    コンポーザー、サードパーティ (Apache Avro))。サポートされているバージョンで影響を受けるのは 12.2.1.4.0 です。容易に悪用可能な脆弱性があり、認証されていない攻撃者が HTTP を介してネットワークにアクセスし、Oracle Business Process Management Suite を侵害する可能性があります。この脆弱性を利用した攻撃が成功すると、Oracle Business Process Management Suite のアクセス可能な一部のデータへの不正な更新、挿入、削除アクセスおよび Oracle Business Process Management Suite のアクセス可能なデータのサブセットへの読み取りアクセスおよび認証されていない権限により Oracle Business Process Management Suite の部分的なサービス拒否 (部分 DOS) が引き起こされる可能性があります。(CVE-2024-47561)

  - Oracle Fusion Middleware の Oracle Business Process Management Suite 製品の脆弱性 (コンポーネント: Runtime Engine (Apache Mina))。サポートされているバージョンで影響を受けるのは、12.2.1.4.0 および 14.1.2.0.0です。容易に悪用可能な脆弱性があり、認証されていない攻撃者が HTTP を介してネットワークにアクセスし、Oracle Business Process Management Suite を侵害する可能性があります。この脆弱性に対する攻撃が成功すると、Oracle Business Process Management Suite の乗っ取りが発生する可能性があります。(CVE-2024-52046)


Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:4054-1 advisory.

    xmlgraphics-fop was updated from version 2.8 to 2.10:

    - Security issues fixed:

      * CVE-2024-28168: Fixed improper restriction of XML External Entity (XXE) reference (bsc#1231428)

    - Upstream changes and bugs fixed:

      * Version 2.10:

        - footnote-body ignores rl-tb writing mode
        - SVG tspan content is displayed out of place
        - Added new schema to handle pdf/a and pdfa/ua
        - Correct fop version at runtime
        - NoSuchElementException when using font with no family name
        - Resolve classpath for binary distribution
        - Switch to spotbugs
        - Set an automatic module name
        - Rename packages to avoid conflicts with modules
        - Resize table only for multicolumn page
        - Missing jars in servlet
        - Optimise performance of PNG with alpha using raw loader
        - basic-link not navigating to corresponding footnote
        - Added option to sign PDF
        - Added secure processing for XSL input
        - Allow sections which need security permissions to be run when AllPermission denied in caller code
        - Remove unused PDFStructElem
        - Remove space generated by fo:wrapper
        - Reset content length for table changing ipd
        - Added alt text to PDF signature
        - Allow change of resource level for SVG in AFP
        - Exclude shape not in clipping path for AFP
        - Only support 1 column for redo of layout without page pos only
        - Switch to Jakarta servlet API         + NPE when list item is split alongside an ipd change         + Added mandatory MODCA triplet to AFP         + Redo layout for multipage columns         + Added image mask option for AFP         + Skip written block ipds inside float         + Allow curly braces for src url         + Missing content for last page with change ipd         + Added warning when different pdf languages are used         + Only restart line manager when there is a linebreak for blocklayout

      * Version 2.9:

        + Values in PDF Number Trees must be indirect references         + Do not delete files on syntax errors using command line         + Surrogate pair edge-case causes Exception         + Reset character spacing         + SVG text containing certain glyphs isn't rendered         + Remove duplicate classes from maven classpath         + Allow use of page position only on redo of layout         + Failure to render multi-block itemBody alongside float         + Update to PDFBox 2.0.27         + NPE if link destination is missing with accessibility         + Make property cache thread safe         + Font size was rounded to 0 for AFP TTF         + Cannot process a SVG using mvn jars         + Remove serializer jar         + Allow creating a PDF 2.0 document         + Text missing after page break inside table inline         + IllegalArgumentException for list in a table         + Table width may be too wide when layout width changes         + NPE when using broken link and PDF 1.5         + Allow XMP at PDF page level         + Symbol font was not being mapped to unicode         + Correct font differences table for Chrome         + Link against Java 8 API         + Added support for font-selection-strategy=character-by-character         + Merge form fields in external PDFs         + Fixed test for Java 11

    xmlgraphics-batik was updated from version 1.17 to 1.18:

    - PNG transcoder references nonexistent class
    - Set offset to 0 if missing in stop tag
    - Validate throws NPE
    - Fixed missing arabic characters
    - Animated rotate tranform ignores y-origin at exactly 270 degrees
    - Set an automatic module name
    - Ignore inkscape properties
    - Switch to spotbugs
    - Allow source and target resolution configuration

    xmlgraphics-commons was updated from version 2.8 to 2.10:

    - Fixed test for Java 11
    - Allow XMP at PDF page level
    - Allow source resolution configuration
    - Added new schema to handle pdf/a and pdfa/ua
    - Set an automatic module name
    - Switch to spotbugs
    - Do not use a singleton for ImageImplRegistry

    javapackages-tools was updated from version 6.3.0 to 6.3.4:

    - Version 6.3.4:

      * A corner case when which is not present
      * Remove dependency on which
      * Simplify after the which -> type -p change
      * jpackage_script: Remove pointless assignment when %java_home is unset
      * Don't export JAVA_HOME (bsc#1231347)

    - Version 6.3.2:

      * Search for JAVACMD under JAVA_HOME only if it's set
      * Obsolete set_jvm and set_jvm_dirs functions
      * Drop unneeded _set_java_home function
      * Remove JAVA_HOME check from check_java_env function
      * Bump codecov/codecov-action from 2.0.2 to 4.6.0
      * Bump actions/setup-python from 4 to 5
      * Bump actions/checkout from 2 to 4
      * Added custom dependabot config
      * Remove the test for JAVA_HOME and error if it is not set
      * java-functions: Remove unneeded local variables
      * Fixed build status shield

    - Version 6.3.1:

      * Allow missing components with abs2rel
      * Fixed tests with python 3.4
      * Sync spec file from Fedora
      * Drop default JRE/JDK
      * Fixed the use of java-functions in scripts
      * Test that we don't bomb on <relativePath/>
      * Test variable expansion in artifactId
      * Interpolate properties also in the current artifact
      * Rewrite abs2rel in shell
      * Use asciidoctor instead of asciidoc
      * Fixed incompatibility with RPM 4.20
      * Reproducible exclusions order in maven metadata
      * Do not bomb on <relativePath/> construct
      * Make maven_depmap order of aliases reproducible

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Improper Restriction of XML External Entity Reference ('XXE') vulnerability in Apache XML Graphics FOP.
    This issue affects Apache XML Graphics FOP: 2.9. Users are recommended to upgrade to version 2.10, which     fixes the issue. (CVE-2024-28168)

Note that Nessus relies on the presence of the package as reported by the vendor.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-675885 advisory.

    Improper Restriction of XML External Entity Reference ('XXE') vulnerability in Apache XML Graphics FOP.

    This issue affects Apache XML Graphics FOP: 2.9.

    Users are recommended to upgrade to version 2.10, which fixes the issue.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle Business Process Management Suite installed on the remote host is affected by multiple vulnerabilities, as referenced in the April 2025 CPU advisory, as follows:

  - Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware     (component: Composer, Common (Apache Commons Compress)). The supported version that is affected     is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the     infrastructure where Oracle Business Process Management Suite executes to compromise Oracle Business     Process Management Suite. Successful attacks require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of Oracle Business Process Management Suite. (CVE-2024-25710)

  - Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware     (component: Plugins (Apache FOP)). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle     Business Process Management Suite. Successful attacks of this vulnerability can result in unauthorized     access to critical data or complete access to all Oracle Business Process Management Suite accessible     data. (CVE-2024-28168)

  - Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component:
    Composer, Third Party (Apache Avro)). The supported version that is affected is 12.2.1.4.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle     Business Process Management Suite. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Oracle Business Process Management Suite accessible data as     well as unauthorized read access to a subset of Oracle Business Process Management Suite accessible data     and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Business Process     Management Suite. (CVE-2024-47561)

  - Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware     (component: Runtime Engine (Apache Mina)). Supported versions that are affected are 12.2.1.4.0 and     14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via     HTTP to compromise Oracle Business Process Management Suite. Successful attacks of this vulnerability     can result in takeover of Oracle Business Process Management Suite. (CVE-2024-52046)


Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
416525	SCA: security update for org.apache.xmlgraphics:fop-core (GHSA-jqfv-jrvq-95jm)	Tenable Cloud Security	SCA Checks	2025/1/23	2026/7/2	medium
416525	SCA: security update for org.apache.xmlgraphics:fop-core (GHSA-jqfv-jrvq-95jm)	Tenable Self-Hosted Container Security	SCA Checks	2025/1/23	2026/7/2	medium
227944	Linux Distros 未修補弱點：CVE-2024-28168	Nessus	Misc.	2025/3/5	2026/7/12	high
234503	Oracle Business Process Management Suite (2025 年 4 月 CPU)	Nessus	Misc.	2025/4/16	2025/6/20	critical
227944	Linux Distros 未修补的漏洞: CVE-2024-28168	Nessus	Misc.	2025/3/5	2026/7/12	high
234503	Oracle Business Process Management Suite (2025 年 4 月 CPU)	Nessus	Misc.	2025/4/16	2025/6/20	critical
227944	Linux Distros のパッチ未適用の脆弱性: CVE-2024-28168	Nessus	Misc.	2025/3/5	2026/7/12	high
234503	Oracle Business Process Management Suite (2025 年 4 月 CPU)	Nessus	Misc.	2025/4/16	2025/6/20	critical
212526	SUSE SLED15: javapackages-filesystem / javapackages-gradle / javapackages-ivy / etc (SUSE-SU-2024:4054-1)	Nessus	SuSE Local Security Checks	2024/12/12	2026/6/26	medium
227944	Linux Distros Unpatched Vulnerability : CVE-2024-28168	Nessus	Misc.	2025/3/5	2026/7/12	high
267408	Unity Linux 20.1070e Security Update: fop (UTSA-2025-675885)	Nessus	Unity Linux Local Security Checks	2025/10/7	2025/10/10	medium
234503	Oracle Business Process Management Suite (April 2025 CPU)	Nessus	Misc.	2025/4/16	2025/6/20	critical

检测

插件搜索

medium

medium

high

critical

high

critical

high

critical

medium

high

medium

critical