The version of Oracle Application Testing Suite installed on the remote host is affected by multiple vulnerabilities as referenced in the April 2023 CPU advisory:

  - Vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager (component:
    Load Testing for Web Apps (Apache Ant)). The supported version that is affected is 13.3.0.1. Easily     exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle     Application Testing Suite executes to compromise Oracle Application Testing Suite. Successful attacks     require human interaction from a person other than the attacker. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle     Application Testing Suite. (CVE-2021-36374)

  - Vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager (component:
    Load Testing for Web Apps (Apache Santuario XML Security For Java)). The supported version that is     affected is 13.3.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network     access via multiple protocols to compromise Oracle Application Testing Suite. Successful attacks of this     vulnerability can result in unauthorized access to critical data or complete access to all Oracle     Application Testing Suite accessible data. (CVE-2021-40690)

  - Vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager (component:
    Load Testing for Web Apps (Apache Xerces2 Java)). The supported version that is affected is 13.3.0.1.
    Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Oracle Application Testing Suite. Successful attacks require human interaction     from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized     ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Application Testing Suite. (CVE-2022-23437)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of IBM Engineering Requirements Management DOORS (formerly IBM Rational DOORS) installed on the remote host is 9.7.2.9 prior to 9.7.2.10. It is, therefore, affected by multiple vulnerabilities as referenced in the 7238992 advisory.

  - CKEditor4 is an open source WYSIWYG HTML editor. In affected version a vulnerability has been discovered in the     core HTML processing module and may affect all plugins used by CKEditor 4. The vulnerability allowed to inject     malformed comments HTML bypassing content sanitization, which could result in executing JavaScript code. It     affects all users using the CKEditor 4 at version < 4.17.0. The problem has been recognized and patched. The     fix will be available in version 4.17.0. (CVE-2021-41165)

  - CKEditor4 is an open source WYSIWYG HTML editor. In affected versions a vulnerability has been discovered in the     Advanced Content Filter (ACF) module and may affect all plugins used by CKEditor 4. The vulnerability allowed to     inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. It affects     all users using the CKEditor 4 at version < 4.17.0. The problem has been recognized and patched. The fix will be     available in version 4.17.0. (CVE-2021-41164)

  - It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted     text into the Styles input of specific dialogs (in the Advanced Tab for Dialogs plugin). (CVE-2021-26271)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2022:0503-1 advisory.

  - There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted     XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may     sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ     version 2.12.1 and the previous versions. (CVE-2022-23437)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES11 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2022:14889-1 advisory.

  - There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted     XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may     sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ     version 2.12.1 and the previous versions. (CVE-2022-23437)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2022:0503-1 advisory.

  - There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted     XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may     sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ     version 2.12.1 and the previous versions. (CVE-2022-23437)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle WebLogic Server installed on the remote host is missing a security patch from the October 2022 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilities, including:

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized Thirdparty     Jars (Bouncy Castle Java Library)). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle     WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.
    (CVE-2020-28052)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized Thirdparty     Jars (Apache Xerces-J)). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic     Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of     this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS)     of Oracle WebLogic Server. (CVE-2022-23437)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized Thirdparty     Jars (Apache Groovy)). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable     vulnerability allows low privileged attacker with logon to the infrastructure where Oracle WebLogic Server executes     to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to     critical data or complete access to all Oracle WebLogic Server accessible data. (CVE-2020-17521) )

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:4918 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime.

    This release of Red Hat JBoss Enterprise Application Platform 7.4.5 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.4.4 and includes bug fixes and enhancements. See the Red Hat JBoss     Enterprise Application Platform 7.4.5 Release Notes for information about the most significant bug fixes     and enhancements included in this release.

    Security Fix(es):

    * h2: Loading of custom classes from remote servers through JNDI (CVE-2022-23221)

    * jackson-databind: denial of service via a large depth of nested objects (CVE-2020-36518)

    * netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data (CVE-2021-37136)

    * netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an     unnecessary way (CVE-2021-37137)

    * h2: Remote Code Execution in Console (CVE-2021-42392)

    * netty: control chars in header names may lead to HTTP request smuggling (CVE-2021-43797)

    * xnio: org.xnio.StreamConnection.notifyReadClosed log to debug instead of stderr (CVE-2022-0084)

    * wildfly: Wildfly management of EJB Session context returns wrong caller principal with Elytron Security     enabled (CVE-2022-0866)

    * undertow: Double AJP response for 400 from EAP 7 results in CPING failures (CVE-2022-1319)

    * OpenJDK: Infinite loop related to incorrect handling of newlines in XMLEntityScanner (JAXP, 8270646)     (CVE-2022-21299)

    * mysql-connector-java: Difficult to exploit vulnerability allows high privileged attacker with network     access via multiple protocols to compromise MySQL Connectors (CVE-2022-21363)

    * xerces-j2: infinite loop when handling specially crafted XML document payloads (CVE-2022-23437)

    * artemis-commons: Apache ActiveMQ Artemis DoS (CVE-2022-23913)

    * Moment.js: Path traversal in moment.locale (CVE-2022-24785)

    * jboss-client: memory leakage in remote client transaction (CVE-2022-0853)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Primavera Gateway installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2022 CPU advisory.

  - Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component:
    Admin (jackson-databind)). Supported versions that are affected are 17.12.0-17.12.11, 18.8.0-18.8.14,     19.12.0-19.12.13, 20.12.0-20.12.8 and 21.12.0-21.12.1. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Primavera Gateway. Successful attacks     of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash     (complete DOS) of Primavera Gateway. (CVE-2020-36518)

  - Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component:
    Admin (Apache Xerces-J)). Supported versions that are affected are 17.12.0-17.12.11, 18.8.0-18.8.14,     19.12.0-19.12.13 and 20.12.0-20.12.8. Easily exploitable vulnerability allows unauthenticated attacker     with network access via HTTP to compromise Primavera Gateway. Successful attacks require human interaction     from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized     ability to cause a hang or frequently repeatable crash (complete DOS) of Primavera Gateway.
    (CVE-2022-23437)

  - Security-in-Depth issue in the Primavera Gateway product of Oracle Construction and Engineering     (component: Admin (Spring Framework)). This vulnerability cannot be exploited in the context of this     product. (CVE-2022-22965)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:0542-1 advisory.

  - There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted     XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may     sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ     version 2.12.1 and the previous versions. (CVE-2022-23437)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle WebLogic Server installed on the remote host is missing a security patch from the October 2022 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilities, including:

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized Thirdparty     Jars (Bouncy Castle Java Library)). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle     WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.
    (CVE-2020-28052)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized Thirdparty     Jars (Apache Xerces-J)). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic     Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of     this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS)     of Oracle WebLogic Server. (CVE-2022-23437)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container).
    Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Difficult to exploit vulnerability     allows high privileged attacker with logon to the infrastructure where Oracle WebLogic Server executes to     compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server as well as unauthorized update,     insert or delete access to some of Oracle WebLogic Server accessible data and unauthorized read access to a subset     of Oracle WebLogic Server accessible data. (CVE-2022-21616)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle Business Process Management Suite installed on the remote host is affected by multiple vulnerabilities, as referenced in the July 2023 CPU advisory, including:

  - Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware     (component: Runtime Engine (Apache Xerces2 Java)). The supported version that is affected is     12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via     HTTP to compromise Oracle Business Process Management Suite. Successful attacks require human interaction     from a person other than the attacker. Successful attacks of this vulnerability can result in     unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Business     Process Management Suite. (CVE-2022-23437)

  - Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware     (component: BPM Studio (jQueryUI)). The supported version that is affected is 12.2.1.4.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Oracle Business Process Management Suite. Successful attacks require human interaction from a person     other than the attacker and while the vulnerability is in Oracle Business Process Management Suite,     attacks may significantly impact additional products (scope change). Successful attacks of this     vulnerability can result in unauthorized update, insert or delete access to some of Oracle Business     Process Management Suite accessible data as well as unauthorized read access to a subset of Oracle     Business Process Management Suite accessible data. (CVE-2021-41184)

  - Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware     (component: Installer (Apache Ant)). The supported version that is affected is 12.2.1.4.0. Easily     exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle     Business Process Management Suite executes to compromise Oracle Business Process Management Suite.
    Successful attacks require human interaction from a person other than the attacker. Successful attacks of     this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash     (complete DOS) of Oracle Business Process Management Suite. (CVE-2021-36374)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted     XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may     sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ     version 2.12.1 and the previous versions. (CVE-2022-23437)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:0500-1 advisory.

  - There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted     XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may     sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ     version 2.12.1 and the previous versions. (CVE-2022-23437)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2022:0500-1 advisory.

  - There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted     XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may     sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ     version 2.12.1 and the previous versions. (CVE-2022-23437)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the xerces-j2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted     XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may     sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ     version 2.12.1 and the previous versions. (CVE-2022-23437)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of GoldenGate installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2022 CPU advisory.

  - Vulnerability in Oracle GoldenGate (component: Oracle GoldenGate Microservices (Dell BSAFE Micro Edition     Suite)).   The supported version that is affected is 19c. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTPS to compromise Oracle GoldenGate.  Successful     attacks of this vulnerability can result in takeover of Oracle GoldenGate. (CVE-2020-35169)

  - Vulnerability in the Oracle Goldengate product of Oracle GoldenGate (component: Stream Analytics     (JinJava)). The supported version that is affected is 19c. Easily exploitable vulnerability allows low     privileged attacker with network access via HTTP to compromise Oracle Goldengate.  Successful attacks of     this vulnerability can result in  unauthorized read access to a subset of Oracle Goldengate accessible     data. (CVE-2018-18893)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:4919 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime.

    This release of Red Hat JBoss Enterprise Application Platform 7.4.5 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.4.4 and includes bug fixes and enhancements. See the Red Hat JBoss     Enterprise Application Platform 7.4.5 Release Notes for information about the most significant bug fixes     and enhancements included in this release.

    Security Fix(es):

    * h2: Loading of custom classes from remote servers through JNDI (CVE-2022-23221)

    * jackson-databind: denial of service via a large depth of nested objects (CVE-2020-36518)

    * netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data (CVE-2021-37136)

    * netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an     unnecessary way (CVE-2021-37137)

    * h2: Remote Code Execution in Console (CVE-2021-42392)

    * netty: control chars in header names may lead to HTTP request smuggling (CVE-2021-43797)

    * xnio: org.xnio.StreamConnection.notifyReadClosed log to debug instead of stderr (CVE-2022-0084)

    * wildfly: Wildfly management of EJB Session context returns wrong caller principal with Elytron Security     enabled (CVE-2022-0866)

    * undertow: Double AJP response for 400 from EAP 7 results in CPING failures (CVE-2022-1319)

    * OpenJDK: Infinite loop related to incorrect handling of newlines in XMLEntityScanner (JAXP, 8270646)     (CVE-2022-21299)

    * mysql-connector-java: Difficult to exploit vulnerability allows high privileged attacker with network     access via multiple protocols to compromise MySQL Connectors (CVE-2022-21363)

    * xerces-j2: infinite loop when handling specially crafted XML document payloads (CVE-2022-23437)

    * artemis-commons: Apache ActiveMQ Artemis DoS (CVE-2022-23913)

    * Moment.js: Path traversal in moment.locale (CVE-2022-24785)

    * jboss-client: memory leakage in remote client transaction (CVE-2022-0853)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
174517	Oracle Application Testing Suite (Apr 2023 CPU)	Nessus	Misc.	2023/4/20	2024/10/23	high
242323	IBM Engineering Requirements Management DOORS 9.7.2.9 < 9.7.2.10 Multiple Vulnerabilities (7238992)	Nessus	Windows	2025/7/18	2026/3/27	medium
158176	SUSE SLED15 / SLES15 Security Update : xerces-j2 (SUSE-SU-2022:0503-1)	Nessus	SuSE Local Security Checks	2022/2/19	2023/7/13	medium
158194	SUSE SLES11 Security Update : xerces-j2 (SUSE-SU-2022:14889-1)	Nessus	SuSE Local Security Checks	2022/2/19	2023/7/13	medium
158239	openSUSE 15 Security Update : xerces-j2 (openSUSE-SU-2022:0503-1)	Nessus	SuSE Local Security Checks	2022/2/22	2023/11/7	medium
166313	Oracle WebLogic Server (Oct 2022 CPU)	Nessus	Misc.	2022/10/20	2024/1/4	high
161911	RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.4.5 security update on RHEL 7 (Moderate) (RHSA-2022:4918)	Nessus	Red Hat Local Security Checks	2022/6/6	2025/6/4	critical
163328	Oracle Primavera Gateway (Jul 2022 CPU)	Nessus	CGI abuses	2022/7/21	2023/10/24	critical
158229	SUSE SLES12 Security Update : xerces-j2 (SUSE-SU-2022:0542-1)	Nessus	SuSE Local Security Checks	2022/2/22	2023/7/13	medium
166314	Oracle WebLogic Server 14.1.1 < 14.1.1.0.221010 (Oct 2022 CPU)	Nessus	Misc.	2022/10/20	2022/12/30	high
178625	Oracle Business Process Management Suite (Jul 2023 CPU)	Nessus	Misc.	2023/7/20	2023/10/24	medium
229679	Linux Distros Unpatched Vulnerability : CVE-2022-23437	Nessus	Misc.	2025/3/5	2026/4/29	medium
158179	SUSE SLES15 Security Update : xerces-j2 (SUSE-SU-2022:0500-1)	Nessus	SuSE Local Security Checks	2022/2/19	2023/7/13	medium
158231	openSUSE 15 Security Update : xerces-j2 (openSUSE-SU-2022:0500-1)	Nessus	SuSE Local Security Checks	2022/2/22	2023/11/7	medium
160115	EulerOS 2.0 SP5 : xerces-j2 (EulerOS-SA-2022-1555)	Nessus	Huawei Local Security Checks	2022/4/25	2023/10/31	medium
166440	Oracle GoldenGate (Oct 2022 CPU)	Nessus	Misc.	2022/10/25	2023/10/24	critical
161910	RHEL 8 : Red Hat JBoss Enterprise Application Platform 7.4.5 security update on RHEL 8 (Moderate) (RHSA-2022:4919)	Nessus	Red Hat Local Security Checks	2022/6/6	2025/6/4	critical

检测

插件搜索

high

medium

medium

medium

medium

high

critical

critical

medium

high

medium

medium

medium

medium

medium

critical

critical