The version of Oracle Secure Global Desktop installed on the remote host is 5.3 / 5.4 and is missing a security patch from the July 2018 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilities:

 - curl version curl 7.54.1 to and including curl 7.59.0 contains a  Heap-based Buffer Overflow vulnerability in FTP connection closing  down functionality which can lead to DoS and RCE conditions. This  vulnerability appears to have been fixed in curl < 7.54.1 and  curl >= 7.60.0. (CVE-2018-1000300)

 - Security constraints defined by annotations of Servlets in Apache  Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and  7.0.0 to 7.0.84 were only applied once a Servlet had been loaded.  It was possible - depending on the order Servlets were loaded - for  some security constraints not to be applied. This could have exposed  resources to unauthorized users. (CVE-2018-1305)

 - ASN.1 types with a recursive definition could exceed the stack  given malicious input with excessive recursion. This could result  in a Denial Of Service attack. Fixed in OpenSSL 1.1.0h (Affected  1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n).
 (CVE-2018-0739)

The version of Oracle HTTP Server installed on the remote host is affected by vulnerabilities as noted in the October 2018 CPU advisory:

  - A vulnerability exists in the Oracle HTTP Server component     of Oracle Fusion Middleware (subcomponent: Web Listener     (curl)). The affected version is 12.2.1.3. This is a     difficult to exploit vulnerability that allows an     unauthenticated attacker with network access via HTTP to     compromise Oracle HTTP Server. A successful attacks     requires human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in takeover of Oracle HTTP Server. (CVE-2018-1000300)     
  - A denial of service (DoS) vulnerability exists in curl due     to Buffer Over-read. Affected versions are from curl version     7.20.0 to curl 7.59.0. The vulnerable component can be     tricked into reading data beyond the end of the heap.
    An unauthenticated attacked with network access can exploit     this issue to cause the application to stop responding.
    (CVE-2018-1000301)

  - A buffer over-read vulnerability exists in curl that could lead to     information leakage. Affected versions are from  7.20.0 to     curl 7.58.0. A vulnerability in the RTSP+RTP handling code     could allows an attacker to cause a denial of service or     information leakage. An unauthenticated attacked with     network access can exploit this vulnerability to cause     a denial of service (DoS) or to leak information     from the vulnerable application.
    (CVE-2018-1000122)

The version of Oracle Application Testing Suite installed on the remote host is affected by multiple vulnerabilities : 

  - Enterprise Manager Base Platform Agent Next Gen (Jython)     component of Oracle Enterprise Manager Products Suite is easily     exploited and can allow an unauthenticated attacker the ability     to takeover the Enterprise Manager Base Platform. (CVE-2016-4000)

  - Enterprise Manager Base Platform Discovery Framework (OpenSSL)     component of Oracle Enterprise Manager Products Suite is easily     exploited and can allow an unauthenticated attacker the ability     to cause a frequent crash (DoS) of the Enterprise Manager Base     Platform. (CVE-2018-0732)

  - Enterprise Manager Ops Center Networking (OpenSSL) component of     Oracle Enterprise Manager Products Suite is easily exploited     and can allow an unauthenticated attacker the ability to cause a     frequent crash (DoS) of the Enterprise Manager Ops Center     Platform. (CVE-2018-0732)

  - Oracle Application Testing Suite Load Testing for Web Apps     (Spring Framework) component of Oracle Enterprise Manager     Products Suite is easily exploited and can allow an     unauthenticated attacker the ability to takeover the Enterprise     Manager Base Platform. (CVE-2018-1258)

  - Enterprise Manager Base Platform EM Console component is easily     exploited by an unauthenticated attacker. Successful attacks     can result in unauthorized update, insert, or delete access.     (CVE-2018-3303)

  - Oracle Application Testing Suite Load Testing for Web Apps     component is easily exploited by an unauthenticated attacker.     Successful attacks can result in unauthorized update, insert, or     delete access and a partial denial of service. (CVE-2018-3304)

  - Oracle Application Testing Suite Load Testing for Web Apps     component is easily exploited by an unauthenticated attacker.     Successful attacks can result in unauthorized update, insert, or     delete access and a partial denial of service. (CVE-2018-3305)

  - Enterprise Manager for Virtualization Plug-In Lifecycle     (jackson-databind) component of Oracle Enterprise Manager     allows an unauthenticated attacker the ability to takeover      Enterprise Manager for Virtualization. (CVE-2018-12023)

  - Enterprise Manager for Virtualization Plug-In Lifecycle     (jackson-databind) component of Oracle Enterprise Manager     allows an unauthenticated attacker the ability to takeover      Enterprise Manager for Virtualization. (CVE-2018-14718)

  - Enterprise Manager Ops Center Networking (cURL) component of     Oracle Enterprise Manager allows an unauthenticated attacker the     ability to takeover Enterprise Manager Ops Center.     (CVE-2018-1000300)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1401 advisory.

    This advisory aggregates security fixes for the curl SRPM in CIQ LTS 9.6. It addresses 148 CVEs:
    CVE-2023-32001, CVE-2022-27775, CVE-2018-1000005, CVE-2022-27774, CVE-2022-32221, and 143 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Curl version curl 7.54.1 to and including curl 7.59.0 contains a CWE-122: Heap-based Buffer Overflow vulnerability in denial of service and more that can result in curl might overflow a heap based memory buffer when closing down an FTP connection with very long server command replies.(CVE-2018-1000300)

Curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded RTSP content.(CVE-2018-1000301)

An update of the curl package has been released.

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0030 advisory.

    This advisory aggregates security fixes for the curl SRPM in CIQ LTS 8.6. It addresses 89 CVEs:
    CVE-2019-5481, CVE-2015-3148, CVE-2021-22922, CVE-2016-5420, CVE-2021-22924, and 84 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle Enterprise Manager Cloud Control installed on the remote host is affected by multiple vulnerabilities in Enterprise Manager Base Platform component:

  - An unspecified vulnerability in the subcomponent Networking     (jQuery) of Enterprise Manager Ops Center. Supported versions     that are affected are 12.2.2 and 12.3.3. An easy to exploit     vulnerability could allow an unauthenticated attacker with     network access via HTTP to compromise Enterprise Manager Ops     Center. A successful attacks requires human interaction and     can result in unauthorized update, insert or delete access     to some of Enterprise Manager Ops Center accessible data.
    (CVE-2015-9251)

  - An unspecified vulnerability in the subcomponent Networking     (OpenSSL) of the Enterprise Manager Ops Center. Supported     versions that are affected are 12.2.2 and 12.3.3. An easy     to exploit vulnerability could allow an unauthenticated     attacker with network access via HTTPS to compromise     Enterprise Manager Ops Center. A successful attack of this     vulnerability could result in unauthorized ability to cause     a hang or frequently repeatable crash (complete DOS) of     Enterprise Manager Ops Center. (CVE-2018-0732)

  - An unspecified vulnerability in the subcomponent Networking     (cURL) of Enterprise Manager Ops Center. Supported versions     that are affected are 12.2.2 and 12.3.3. Difficult to exploit     vulnerability allows unauthenticated attacker with network     access via HTTP to compromise Enterprise Manager Ops Center.
    A successful attack requires human interaction from a person     other than the attacker and can result in takeover of     Enterprise Manager Ops Center. (CVE-2018-1000300)

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0406 advisory.

    This advisory aggregates security fixes for the curl SRPM in CIQ LTS 9.2. It addresses 105 CVEs:
    CVE-2022-27775, CVE-2022-32221, CVE-2019-5481, CVE-2015-3148, CVE-2018-14618, and 100 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
111333	Oracle Secure Global Desktop Multiple Vulnerabilities (July 2018 CPU)	Nessus	Misc.	2018/7/25	2021/10/25	critical
124090	Oracle Fusion Middleware Oracle HTTP Server Multiple Vulnerabilities (October 2018 CPU)	Nessus	Web Servers	2019/4/16	2024/6/19	critical
121257	Oracle Application Testing Suite Multiple Vulnerabilities (Jan 2019 CPU)	Nessus	Misc.	2019/1/21	2024/11/4	critical
353701	Rocky Linux 9.6 [CIQ] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (ciqsa-2026_1401)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/13	critical
110446	Amazon Linux 2 : curl (ALAS-2018-1029)	Nessus	Amazon Linux Local Security Checks	2018/6/12	2024/9/24	critical
121963	Photon OS 2.0: Curl PHSA-2018-2.0-0068	Nessus	PhotonOS Local Security Checks	2019/2/7	2024/7/22	critical
359305	Rocky Linux 8.6 [CIQ] Security Update: curl / curl-debuginfo / curl-debugsource / curl-minimal / etc Multiple Vulnerabilities (ciqsa-2026_0030)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/12	critical
131184	Oracle Enterprise Manager Ops Center (Jan 2019 CPU)	Nessus	Misc.	2019/11/21	2024/11/4	critical
356987	Rocky Linux 9.2 [CIQ] Security Update: curl / curl-debuginfo / curl-debugsource / curl-minimal / etc Multiple Vulnerabilities (ciqsa-2026_0406)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/13	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical