The version of Oracle Business Process Management Suite installed on the remote host is affected by multiple vulnerabilities, as referenced in the July 2023 CPU advisory, including:

  - Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware     (component: Runtime Engine (Apache Xerces2 Java)). The supported version that is affected is     12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via     HTTP to compromise Oracle Business Process Management Suite. Successful attacks require human interaction     from a person other than the attacker. Successful attacks of this vulnerability can result in     unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Business     Process Management Suite. (CVE-2022-23437)

  - Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware     (component: BPM Studio (jQueryUI)). The supported version that is affected is 12.2.1.4.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Oracle Business Process Management Suite. Successful attacks require human interaction from a person     other than the attacker and while the vulnerability is in Oracle Business Process Management Suite,     attacks may significantly impact additional products (scope change). Successful attacks of this     vulnerability can result in unauthorized update, insert or delete access to some of Oracle Business     Process Management Suite accessible data as well as unauthorized read access to a subset of Oracle     Business Process Management Suite accessible data. (CVE-2021-41184)

  - Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware     (component: Installer (Apache Ant)). The supported version that is affected is 12.2.1.4.0. Easily     exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle     Business Process Management Suite executes to compromise Oracle Business Process Management Suite.
    Successful attacks require human interaction from a person other than the attacker. Successful attacks of     this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash     (complete DOS) of Oracle Business Process Management Suite. (CVE-2021-36374)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Primavera Unifier installed on the remote host is affected by multiple vulnerabilities as referenced in the October 2021 CPU advisory, including the following:

  - An easily exploitable vulnerability in the File Management component of Primavera Unifier that allows an     unauthenticated, remote attacker to compromise availability. (CVE-2021-36090)

  - An easily exploitable vulnerability in the Platform, UI (Lodash) component of Primavera Unifier that     allows a remote, high privileged attacker to compromise confidentiality, integrity, and availability.
    (CVE-2021-23337)

  - An easily exploitable vulnerability in the Platform (Apache Tika) component of Primavera unifier that     allows an unauthenticated attacker to compromise availability. (CVE-2021-28657)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the ant package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of     memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt     builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected. (CVE-2021-36373)

  - When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to     allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be     used to disrupt builds using Apache Ant. Commonly used derived formats from ZIP archives are for instance     JAR files and many office files. Apache Ant prior to 1.9.16 and 1.10.11 were affected. (CVE-2021-36374)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to     allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be     used to disrupt builds using Apache Ant. Commonly used derived formats from ZIP archives are for instance     JAR files and many office files. Apache Ant prior to 1.9.16 and 1.10.11 were affected. (CVE-2021-36374)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of ant / javapackages-bootstrap installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2021-36374 advisory.

  - When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to     allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be     used to disrupt builds using Apache Ant. Commonly used derived formats from ZIP archives are for instance     JAR files and many office files. Apache Ant prior to 1.9.16 and 1.10.11 were affected. (CVE-2021-36374)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21891-1 advisory.

    - CVE-2021-36374: excessive memory allocation when reading a specially crafted ZIP archive or a derived     formats       (bsc#1188469).
    - CVE-2025-7962: jakarta: improper neutralization of \r and \n UTF-8 characters can lead to SMTP injection       (bsc#1246873).
    - CVE-2026-78254: path traversal in ftp and scp tasks allows for arbitrary file writes (bsc#1280015).

    Changes for ant:

    - Upgrade to version 1.10.18
     * Breaking changes:
     + the default value for <ftp>'s useSecureDataChannel has been      changed to true which means using ftps now also tries to use      an encrypted data channel by default.
     + the <ftp> and <scp> tasks have new allowFilesToEscapeDest      attributes. When set to false - which is the default - the      tasks will not download files or create directories outside      the designated destination directory when downloading from the      remote server. In the unlikely case you need the old bahaviour      of writing outside the destination directory you must set the      value to true explicitly.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle WebLogic Server installed on the remote host is missing a security patch from the October 2023 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilities, including:

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core (Apache     Commons BCEL)). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic     Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server     (CVE-2022-42920)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized     Thirdparty Jars (Apache Maven Shared Utils)). The supported version that is affected is 14.1.1.0.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of     Oracle WebLogic Server. (CVE-2022-29599)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).
    Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability     allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server.
    Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.
    (CVE-2023-22069)

  Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
178625	Oracle Business Process Management Suite (Jul 2023 CPU)	Nessus	Misc.	2023/7/20	2023/10/24	medium
154262	Oracle Primavera Unifier (Oct 2021 CPU)	Nessus	CGI abuses	2021/10/20	2023/11/28	high
161561	EulerOS 2.0 SP3 : ant (EulerOS-SA-2022-1703)	Nessus	Huawei Local Security Checks	2022/5/26	2023/10/26	medium
223940	Linux Distros Unpatched Vulnerability : CVE-2021-36374	Nessus	Misc.	2025/3/5	2026/9/2	medium
217097	CBL Mariner 2.0 Security Update: ant / javapackages-bootstrap (CVE-2021-36374)	Nessus	MarinerOS Local Security Checks	2025/3/3	2025/3/3	medium
350151	openSUSE 16: ant / ant-antlr / ant-apache-bcel / ant-apache-bsf / etc (openSUSE-SU-2026:21891-1)	Nessus	SuSE Local Security Checks	2026/9/25	2026/9/25	medium
183311	Oracle WebLogic Server (October 2023 CPU)	Nessus	Misc.	2023/10/18	2026/2/24	critical

检测

插件搜索

medium

high

medium

medium

medium

medium

critical