The 12.2.1.4.0 versions of WebCenter Portal installed on the remote host are affected by a vulnerability as referenced in the July 2024 CPU advisory.

  - Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portal Core (Apache     SOAP)). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal. Successful attacks of     this vulnerability can result in takeover of Oracle WebCenter Portal. (CVE-2022-45378)

  - Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Discussion Forums     (JSON-java)). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal. Successful attacks     of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete     DOS) of Oracle WebCenter Portal. (CVE-2023-5072)

  - Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework     (Apache Commons Compress)). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability     allows unauthenticated attacker with logon to the infrastructure where Oracle WebCenter Portal executes to     compromise Oracle WebCenter Portal. Successful attacks require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of Oracle WebCenter Portal. (CVE-2024-26308) 

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Primavera P6 Enterprise Project Portfolio Management installed on the remote host are affected by vulnerabilities as referenced in the January 2024 CPU advisory.

  - Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction     and Engineering (component: Web (Google Guava)). Supported versions that are affected are     19.12.0-19.12.22, 20.12.0-20.12.20, 21.12.0-21.12.17 and 22.12.0-22.12.10. Easily exploitable     vulnerability allows low privileged attacker with logon to the infrastructure where Primavera P6     Enterprise Project Portfolio Management executes to compromise Primavera P6 Enterprise Project Portfolio     Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or     modification access to critical data or all Primavera P6 Enterprise Project Portfolio Management     accessible data as well as unauthorized access to critical data or complete access to all Primavera P6     Enterprise Project Portfolio Management accessible data. (CVE-2023-2976)

  - Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction     and Engineering (component: Web (Apache Commons Compress)). Supported versions that are affected are     19.12.0-19.12.22, 20.12.0-20.12.20, 21.12.0-21.12.17 and 22.12.0-22.12.10. Easily exploitable     vulnerability allows low privileged attacker with logon to the infrastructure where Primavera P6     Enterprise Project Portfolio Management executes to compromise Primavera P6 Enterprise Project Portfolio     Management. Successful attacks require human interaction from a person other than the attacker. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of Primavera P6 Enterprise Project Portfolio Management. (CVE-2023-42503)

  - Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction     and Engineering (component: Web (JSON-java)). Supported versions that are affected are 19.12.0-19.12.22,     20.12.0-20.12.20, 21.12.0-21.12.17 and 22.12.0-22.12.10. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Primavera P6 Enterprise Project     Portfolio Management. Successful attacks of this vulnerability can result in unauthorized ability to cause     a hang or frequently repeatable crash (complete DOS) of Primavera P6 Enterprise Project Portfolio     Management. (CVE-2023-5072)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The versions of Primavera Gateway installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2024 CPU advisory.

  - Denial of Service in JSON-Java versions up to and including 20230618. A bug in the parser means that an     input string of modest size can lead to indefinite amounts of memory being used. (CVE-2023-5072)

  - Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress. This issue     affects Apache Commons Compress: from 1.21 before 1.26. Users are recommended to upgrade to version 1.26,     which fixes the issue. (CVE-2024-26308)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Oracle Siebel CRM installed on the remote host are affected by a vulnerability as referenced in the July 2024 CPU advisory.

  - Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: EAI (JSON-java)).
    Supported versions that are affected are 23.12 and prior. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of Siebel CRM Integration. (CVE-2023-5072)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle Business Intelligence Enterprise Edition (OAS) 7.0.0.0 installed on the remote host is affected by multiple vulnerabilities as referenced in the January 2024 CPU advisory, including the following:

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Installation (Google Gson)). Supported versions that are affected are 6.4.0.0.0 and     7.0.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via     HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this     vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash     (complete DOS) of Oracle Business Intelligence Enterprise Edition. (CVE-2022-25647)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Majel Mobile Service (JSON-java)). Supported versions that are affected are 6.4.0.0.0 and     7.0.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of     Oracle Business Intelligence Enterprise Edition. (CVE-2023-5072)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Visual Analyzer (Snappy)). The supported version that is affected is 7.0.0.0.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to     compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of     Oracle Business Intelligence Enterprise Edition. (CVE-2023-43642)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
202598	Oracle WebCenter Portal (July 2024 CPU)	Nessus	Misc.	2024/7/18	2024/7/19	critical
189184	Oracle Primavera P6 Enterprise Project Portfolio Management (January 2024 CPU)	Nessus	CGI abuses	2024/1/18	2024/10/23	high
193486	Oracle Primavera Gateway (April 2024 CPU)	Nessus	CGI abuses	2024/4/18	2024/7/19	high
212443	Oracle Siebel Server <= 23.12 (July 2024 CPU)	Nessus	Misc.	2024/12/11	2024/12/12	high
189732	Oracle Business Intelligence Enterprise Edition (OAS 7.0) (January 2024 CPU)	Nessus	Misc.	2024/1/29	2024/1/30	high

检测

插件搜索

critical

high

high

high

high