This update for dom4j fixes the following issues :

  - CVE-2018-1000632: Prevent XML injection that could have     resulted in an attacker tampering with XML documents     (bsc#1105443).

This update was imported from the SUSE:SLE-15:Update update project.

According to the version of the dom4j package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - dom4j version prior to version 2.1.1 contains a CWE-91:
    XML Injection vulnerability in Class: Element. Methods:
    addElement, addAttribute that can result in an attacker     tampering with XML documents through XML injection.
    This attack appear to be exploitable via an attacker     specifying attributes or elements in the XML document.
    This vulnerability appears to have been fixed in 2.1.1     or later.(CVE-2018-1000632)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4619-1 advisory.

    Mrio Areias discovered that dom4j did not properly validate XML document elements. An attacker could     exploit this with a crafted XML file to cause dom4j to crash, resulting in a denial of service, or     possibly execute arbitrary code. (CVE-2018-1000632)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1159 advisory.

    Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss     Application Server.

    This release of Red Hat JBoss Enterprise Application Platform 6.4.22 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 6.4.21, and includes bug fixes and enhancements, which are     documented in the Release Notes document linked to in the References.

    Security Fix(es):

    * admin-cli: wildfly-core: Cross-site scripting (XSS) in JBoss Management Console (CVE-2018-10934)

    * dom4j: XML Injection in Class: Element. Methods: addElement, addAttribute which can impact the integrity     of XML documents (CVE-2018-1000632)

    * jbossweb: tomcat: host name verification missing in WebSocket client (CVE-2018-8034)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    All users of Red Hat JBoss Enterprise Application Platform 6.4 on Red Hat Enterprise Linux 5 are advised     to upgrade to these updated packages. The JBoss server process must be restarted for the update to take     effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Oracle Siebel CRM installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2026 CPU advisory.

  - Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Application Interface     (JDOM)). Supported versions that are affected are 17.0-25.11. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of Siebel CRM Deployment. (CVE-2018-1000632, CVE-2020-10683, CVE-2021-33813)

  - Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure     (OpenSSL)). Supported versions that are affected are 17.0-25.11. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTPS to compromise Siebel CRM Deployment. Successful     attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Siebel     CRM Deployment accessible data and unauthorized ability to cause a partial denial of service (partial DOS)     of Siebel CRM Deployment. (CVE-2025-4575)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
123387	openSUSE Security Update : dom4j (openSUSE-2019-958)	Nessus	SuSE Local Security Checks	2019/3/27	2024/6/7	high
132286	EulerOS 2.0 SP3 : dom4j (EulerOS-SA-2019-2569)	Nessus	Huawei Local Security Checks	2019/12/19	2024/4/3	high
142499	Ubuntu 16.04 LTS : dom4j vulnerability (USN-4619-1)	Nessus	Ubuntu Local Security Checks	2020/11/6	2024/8/27	high
194177	RHEL 5 : Red Hat JBoss Enterprise Application Platform 6.4.22 (RHSA-2019:1159)	Nessus	Red Hat Local Security Checks	2024/4/28	2024/11/7	high
294867	Oracle Siebel Server <= 25.11 (January 2026 CPU)	Nessus	Misc.	2026/1/21	2026/1/22	critical

检测

插件搜索

high

high

high

high

critical