The version of Oracle WebLogic Server installed on the remote host is missing a security patch from the January 2023 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilities, including:

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized     Third Party Jars (jackson-databind)). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and     14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of     Oracle WebLogic Server. (CVE-2018-7489)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized     Third Party Jars (XStream)). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and     14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized     ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server.
    (CVE-2022-40150)

  Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:1450 advisory.

    Red Hat JBoss Enterprise Application Platform is a platform for Java     applications based on the JBoss Application Server.

    This release of Red Hat JBoss Enterprise Application Platform 6.4.20 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 6.4.19, and includes bug fixes and enhancements, which are     documented in the Release Notes document linked to in the References.

    Security Fix(es):

    * jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-7525)     (CVE-2017-15095)

    * jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for     CVE-2017-15095) (CVE-2017-17485)

    * slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution     (CVE-2018-8088)

    * Apache ActiveMQ Artemis: Deserialization of untrusted input vulnerability (CVE-2016-4978)

    * solr: Directory traversal via Index Replication HTTP API (CVE-2017-3163)

    * tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure     of resources (CVE-2018-1304)

    * jackson-databind: incomplete fix for CVE-2017-7525 permits unsafe serialization via c3p0 libraries     (CVE-2018-7489)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank Liao Xinxi (NSFOCUS) for reporting CVE-2017-15095; 0c0c0f from     360 for reporting CVE-2017-17485; and Chris McCown for reporting CVE-2018-8088.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Database Server is missing the October 2018 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilities, including remote code execution, as noted in the October 2018 Critical Patch Update advisory. Please consult the CVRF details for the applicable CVEs for additional information.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security fix for CVE-2018-7489

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:1449 advisory.

    Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss     Application Server.

    This release of Red Hat JBoss Enterprise Application Platform 6.4.20 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 6.4.19, and includes bug fixes and enhancements, which are     documented in the Release Notes document linked to in the References.

    Security Fix(es):

    * jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-7525)     (CVE-2017-15095)

    * jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for     CVE-2017-15095) (CVE-2017-17485)

    * slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution     (CVE-2018-8088)

    * Apache ActiveMQ Artemis: Deserialization of untrusted input vulnerability (CVE-2016-4978)

    * solr: Directory traversal via Index Replication HTTP API (CVE-2017-3163)

    * tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure     of resources (CVE-2018-1304)

    * jackson-databind: incomplete fix for CVE-2017-7525 permits unsafe serialization via c3p0 libraries     (CVE-2018-7489)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank Liao Xinxi (NSFOCUS) for reporting CVE-2017-15095; 0c0c0f from     360 for reporting CVE-2017-17485; and Chris McCown for reporting CVE-2018-8088.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Oracle Primavera Gateway installation running on the remote web server is 15.x prior to 15.2.15, 16.x prior to 16.2.8, or 17.x prior to 17.12.3. It is, therefore, affected by multiple vulnerabilities.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2089 advisory.

    Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss     Application Server.

    This release of Red Hat JBoss Enterprise Application Platform 7.1.3 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.1.2, and includes bug fixes and enhancements, which are documented     in the Release Notes document linked to in the References.

    Security Fix(es):

    * jackson-databind: incomplete fix for CVE-2017-7525 permits unsafe serialization via c3p0 libraries     (CVE-2018-7489)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle WebLogic Server installed on the remote host is affected by multiple vulnerabilities:

  - An unspecified vulnerability in the Spring Framework     (Sample Apps) subcomponent in Oracle WebLogic allows     an unauthenticated, remote attacker to takeover a     WebLogic server. (CVE-2018-1275)

  - An unspecified vulnerability in the WLS Core Components     subcomponent in Oracle WebLogic allows an     unauthenticated, remote attacker to takeover a     WebLogic server. (CVE-2018-2893)

  - An unspecified vulnerability in the WLS - Web Services     subcomponent in Oracle WebLogic allows an     unauthenticated, remote attacker with HTTP access to     compromise and takeover a WebLogic server.
    (CVE-2018-2894)

In addition, Oracle WebLogic Server is affected by several other lower scoring vulnerabilities in the WLS Core Components, JSF, SAML, and Console (jackson-databind) subcomponents.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
170165	Oracle WebLogic Server (Jan 2023 CPU)	Nessus	Misc.	2023/1/19	2024/1/16	critical
233045	RHEL 5 : Red Hat JBoss Enterprise Application Platform 6.4.20 (RHSA-2018:1450)	Nessus	Red Hat Local Security Checks	2025/3/20	2025/3/20	critical
118230	Oracle Database Server Multiple Vulnerabilities (October 2018 CPU)	Nessus	Databases	2018/10/19	2022/4/11	critical
120474	Fedora 28 : jackson-databind (2018-633acf0ed6)	Nessus	Fedora Local Security Checks	2019/1/3	2024/7/5	critical
109906	RHEL 6 : Red Hat JBoss Enterprise Application Platform 6.4.20 (RHSA-2018:1449)	Nessus	Red Hat Local Security Checks	2018/5/18	2025/4/29	critical
118714	Oracle Primavera Gateway Multiple Vulnerabilities (Oct 2018 CPU)	Nessus	CGI abuses	2018/11/2	2024/11/4	critical
110797	RHEL 7 : Red Hat JBoss Enterprise Application Platform (RHSA-2018:2089)	Nessus	Red Hat Local Security Checks	2018/6/29	2025/4/29	critical
111209	Oracle WebLogic Server Multiple Vulnerabilities (July 2018 CPU)	Nessus	Misc.	2018/7/20	2024/9/3	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical