The version of Oracle Application Testing Suite installed on the remote host is affected by multiple vulnerabilities as referenced in the April 2023 CPU advisory:

  - Vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager (component:
    Load Testing for Web Apps (Apache Ant)). The supported version that is affected is 13.3.0.1. Easily     exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle     Application Testing Suite executes to compromise Oracle Application Testing Suite. Successful attacks     require human interaction from a person other than the attacker. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle     Application Testing Suite. (CVE-2021-36374)

  - Vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager (component:
    Load Testing for Web Apps (Apache Santuario XML Security For Java)). The supported version that is     affected is 13.3.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network     access via multiple protocols to compromise Oracle Application Testing Suite. Successful attacks of this     vulnerability can result in unauthorized access to critical data or complete access to all Oracle     Application Testing Suite accessible data. (CVE-2021-40690)

  - Vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager (component:
    Load Testing for Web Apps (Apache Xerces2 Java)). The supported version that is affected is 13.3.0.1.
    Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Oracle Application Testing Suite. Successful attacks require human interaction     from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized     ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Application Testing Suite. (CVE-2022-23437)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0151 advisory.

    Red Hat Single Sign-On 7.5 is a standalone server, based on the Keycloak project, that provides     authentication and standards-based single sign-on capabilities for web and mobile applications.

    This release of Red Hat Single Sign-On 7.5.1 on RHEL 7 serves as a replacement for Red Hat Single Sign-On     7.5.0, and includes bug fixes and enhancements, which are documented in the Release Notes document linked     to in the References.

    Security Fix(es):

    * Keycloak: Incorrect authorization allows unpriviledged users to create other users (CVE-2021-4133)

    * keycloak-server-spi-private: ECP SAML binding bypasses authentication flows (CVE-2021-3827)

    * xml-security: XPath Transform abuse allows for information disclosure (CVE-2021-40690)

    * resteasy: Error message exposes endpoint class information (CVE-2021-20289)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:5151 advisory.

    This release of Red Hat JBoss Enterprise Application Platform 7.3.10 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.3.9, and includes bug fixes and enhancements. See the Red Hat     JBoss Enterprise Application Platform 7.3.10 Release Notes for information about the most significant bug     fixes and enhancements included in this release.

    Security Fix(es):

    * undertow: potential security issue in flow control over HTTP/2 may lead to DOS (CVE-2021-3629)

    * wildfly-elytron: possible timing attack in ScramServer (CVE-2021-3642)

    * wildfly: incorrect JBOSS_LOCAL_USER challenge location may lead to giving access to all the local users     (CVE-2021-3717)

    * jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck (CVE-2021-37714)

    * xml-security: XPath Transform abuse allows for information disclosure (CVE-2021-40690)

    * resteasy: Error message exposes endpoint class information (CVE-2021-20289)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-5525-1 advisory.

    It was discovered that Apache XML Security for Java incorrectly passed a configuration property when     creating specific key elements. This allows an attacker to abuse an XPath Transform to extract sensitive     information.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The versions of Oracle Business Intelligence Enterprise Edition (OBIEE) (OAS) installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2023 CPU advisory.

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Analytics Server (Apache Commons BeanUtils)). The supported version that is affected is     6.4.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability     can result in unauthorized update, insert or delete access to some of Oracle Business Intelligence     Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Business     Intelligence Enterprise Edition accessible data and unauthorized ability to cause a partial denial of     service (partial DOS) of Oracle Business Intelligence Enterprise Edition. (CVE-2019-10086)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Analytics Server (zlib)). The supported version that is affected is 6.4.0.0.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in     takeover of Oracle Business Intelligence Enterprise Edition. (CVE-2022-37434)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: BI Application Archive (Apache Commons Text)). The supported version that is affected is     6.4.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability     can result in takeover of Oracle Business Intelligence Enterprise Edition. (CVE-2022-42889)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:4226 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.1.10 serves as a     replacement for Red Hat JBoss Enterprise Application Platform 7.1.9, and includes bug fixes and     enhancements. See the Red Hat JBoss Enterprise Application Platform 7.1.9 Release Notes for information     about the most significant bug fixes and enhancements included in this release.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
174517	Oracle Application Testing Suite (Apr 2023 CPU)	Nessus	Misc.	2023/4/20	2024/10/23	high
156788	RHEL 7 : Red Hat Single Sign-On 7.5.1 security update on RHEL 7 (Important) (RHSA-2022:0151)	Nessus	Red Hat Local Security Checks	2022/1/18	2024/11/8	high
156111	RHEL 8 : Red Hat JBoss Enterprise Application Platform 7.3.10 security update on RHEL 8 (Moderate) (RHSA-2021:5151)	Nessus	Red Hat Local Security Checks	2021/12/16	2024/11/7	high
163302	Ubuntu 18.04 LTS / 20.04 LTS : Apache XML Security for Java vulnerability (USN-5525-1)	Nessus	Ubuntu Local Security Checks	2022/7/20	2024/8/27	high
174743	Oracle Business Intelligence Enterprise Edition (OAS) (Apr 2023 CPU)	Nessus	Misc.	2023/4/25	2026/2/24	critical
237013	RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.1.10 on RHEL 7 (RHSA-2025:4226)	Nessus	Red Hat Local Security Checks	2025/5/21	2025/6/5	high

检测

插件搜索

high

high

high

high

critical

high