The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:5149 advisory.

    This release of Red Hat JBoss Enterprise Application Platform 7.3.10 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.3.9, and includes bug fixes and enhancements. See the Red Hat     JBoss Enterprise Application Platform 7.3.10 Release Notes for information about the most significant bug     fixes and enhancements included in this release.

    Security Fix(es):

    * undertow: potential security issue in flow control over HTTP/2 may lead to DOS (CVE-2021-3629)

    * wildfly-elytron: possible timing attack in ScramServer (CVE-2021-3642)

    * wildfly: incorrect JBOSS_LOCAL_USER challenge location may lead to giving access to all the local users     (CVE-2021-3717)

    * jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck (CVE-2021-37714)

    * xml-security: XPath Transform abuse allows for information disclosure (CVE-2021-40690)

    * resteasy: Error message exposes endpoint class information (CVE-2021-20289)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an     issue where the secureValidation property is not passed correctly when creating a KeyInfo from a     KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml     files in a RetrievalMethod element. (CVE-2021-40690)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0152 advisory.

    Red Hat Single Sign-On 7.5 is a standalone server, based on the Keycloak project, that provides     authentication and standards-based single sign-on capabilities for web and mobile applications.

    This release of Red Hat Single Sign-On 7.5.1 on RHEL 8 serves as a replacement for Red Hat Single Sign-On     7.5.0, and includes bug fixes and enhancements, which are documented in the Release Notes document linked     to in the References.

    Security Fix(es):

    * Keycloak: Incorrect authorization allows unpriviledged users to create other users (CVE-2021-4133)

    * keycloak-server-spi-private: ECP SAML binding bypasses authentication flows (CVE-2021-3827)

    * xml-security: XPath Transform abuse allows for information disclosure (CVE-2021-40690)

    * resteasy: Error message exposes endpoint class information (CVE-2021-20289)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle WebLogic Server installed on the remote host is missing a security patch from the July 2022 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilities, including:

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Third Party     Tools, Samples (Spring Framework)). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and     14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of     Oracle WebLogic Server. (CVE-2022-22965)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized     Third Party Jars (OWASP Enterprise Security API)). Supported versions that are affected are 12.2.1.3.0,     12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network     access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result     in takeover of Oracle WebLogic Server. (CVE-2022-23457)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized     Third Party Jars (Apache Maven)). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0.
    Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to     compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized     creation, deletion or modification access to critical data or all Oracle WebLogic Server accessible data     as well as unauthorized access to critical data or complete access to all Oracle WebLogic Server     accessible data. (CVE-2021-26291)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0151 advisory.

    Red Hat Single Sign-On 7.5 is a standalone server, based on the Keycloak project, that provides     authentication and standards-based single sign-on capabilities for web and mobile applications.

    This release of Red Hat Single Sign-On 7.5.1 on RHEL 7 serves as a replacement for Red Hat Single Sign-On     7.5.0, and includes bug fixes and enhancements, which are documented in the Release Notes document linked     to in the References.

    Security Fix(es):

    * Keycloak: Incorrect authorization allows unpriviledged users to create other users (CVE-2021-4133)

    * keycloak-server-spi-private: ECP SAML binding bypasses authentication flows (CVE-2021-3827)

    * xml-security: XPath Transform abuse allows for information disclosure (CVE-2021-40690)

    * resteasy: Error message exposes endpoint class information (CVE-2021-20289)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:5151 advisory.

    This release of Red Hat JBoss Enterprise Application Platform 7.3.10 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.3.9, and includes bug fixes and enhancements. See the Red Hat     JBoss Enterprise Application Platform 7.3.10 Release Notes for information about the most significant bug     fixes and enhancements included in this release.

    Security Fix(es):

    * undertow: potential security issue in flow control over HTTP/2 may lead to DOS (CVE-2021-3629)

    * wildfly-elytron: possible timing attack in ScramServer (CVE-2021-3642)

    * wildfly: incorrect JBOSS_LOCAL_USER challenge location may lead to giving access to all the local users     (CVE-2021-3717)

    * jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck (CVE-2021-37714)

    * xml-security: XPath Transform abuse allows for information disclosure (CVE-2021-40690)

    * resteasy: Error message exposes endpoint class information (CVE-2021-20289)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle Application Testing Suite installed on the remote host is affected by multiple vulnerabilities as referenced in the April 2023 CPU advisory:

  - Vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager (component:
    Load Testing for Web Apps (Apache Ant)). The supported version that is affected is 13.3.0.1. Easily     exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle     Application Testing Suite executes to compromise Oracle Application Testing Suite. Successful attacks     require human interaction from a person other than the attacker. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle     Application Testing Suite. (CVE-2021-36374)

  - Vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager (component:
    Load Testing for Web Apps (Apache Santuario XML Security For Java)). The supported version that is     affected is 13.3.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network     access via multiple protocols to compromise Oracle Application Testing Suite. Successful attacks of this     vulnerability can result in unauthorized access to critical data or complete access to all Oracle     Application Testing Suite accessible data. (CVE-2021-40690)

  - Vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager (component:
    Load Testing for Web Apps (Apache Xerces2 Java)). The supported version that is affected is 13.3.0.1.
    Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Oracle Application Testing Suite. Successful attacks require human interaction     from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized     ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Application Testing Suite. (CVE-2022-23437)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle WebCenter Portal installed on the remote host is missing a security patch from the Oct 2022 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilites:

  - Vulnerability in the Oracle Communications Convergence product of Oracle Communications Applications (component:     Framework (dojo)). The supported version that is affected is 3.0.3.0. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Oracle Communications Convergence. Successful     attacks of this vulnerability can result in takeover of Oracle Communications Convergence. (CVE-2021-23450)

  - Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework     (jackson-databind)). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal.     Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of Oracle WebCenter Portal. (CVE-2020-36518)

  - Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework     (Apache Santuario XML Security For Java)). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0.     Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle     WebCenter Portal. Successful attacks of this vulnerability can result in unauthorized access to critical data or     complete access to all Oracle WebCenter Portal accessible data. (CVE-2021-40690)

Note that Nessus has not attempted to exploit this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
156109	RHEL 6 : Red Hat JBoss Enterprise Application Platform 7.3.10 security update on RHEL 6 (Moderate) (RHSA-2021:5149)	Nessus	Red Hat Local Security Checks	2021/12/15	2024/11/7	high
256959	Linux Distros Unpatched Vulnerability : CVE-2021-40690	Nessus	Misc.	2025/8/27	2025/8/27	high
156792	RHEL 8 : Red Hat Single Sign-On 7.5.1 security update on RHEL 8 (Important) (RHSA-2022:0152)	Nessus	Red Hat Local Security Checks	2022/1/18	2024/11/7	high
163298	Oracle WebLogic Server (Jul 2022 CPU)	Nessus	Misc.	2022/7/20	2024/1/4	critical
156788	RHEL 7 : Red Hat Single Sign-On 7.5.1 security update on RHEL 7 (Important) (RHSA-2022:0151)	Nessus	Red Hat Local Security Checks	2022/1/18	2024/11/8	high
156111	RHEL 8 : Red Hat JBoss Enterprise Application Platform 7.3.10 security update on RHEL 8 (Moderate) (RHSA-2021:5151)	Nessus	Red Hat Local Security Checks	2021/12/16	2024/11/7	high
174517	Oracle Application Testing Suite (Apr 2023 CPU)	Nessus	Misc.	2023/4/20	2024/10/23	high
166335	Oracle WebCenter Portal Multiple Vulnerabilities (Oct 2022 CPU)	Nessus	Misc.	2022/10/20	2023/10/24	critical

检测

插件搜索

high

high

high

critical

high

high

high

critical