According to its self-reported version, the Tenable SecurityCenter application installed on the remote host is less than 5.21.0 and is therefore affected by multiple vulnerabilities:

    - A command injection vulnerability exists in Composer. An unauthenticated, remote attacker can exploit this       to execute arbitrary commands by installing untrusted dependencies. (CVE-2021-41116)     
    - A code injection vulnerability exists in Composer. An unauthenticated, remote attacker can exploit this       to execute arbitrary commands by controlling the $file or $identifier argument. (CVE-2022-24828)     
    - Read/write beyond bounds - Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to       overwrite heap memory with possibly attacker provided data. This issue affects Apache HTTP Server 2.4 version       2.4.52 and prior versions. (CVE-2022-23943)   Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The version of JQuery UI library hosted on the remote web server is prior to 1.13.0. It is, therefore, affected by multiple cross-site scripting vulnerabilities:

  - Accepting the value of the 'altField' option of the Datepicker widget from untrusted sources may execute untrusted     code. (CVE-2021-41182)

  - Accepting the value of various '*Text' options of the Datepicker widget from untrusted sources may execute     untrusted code. (CVE-2021-41183)

  - Accepting the value of the 'of' option of the '.position()' util from untrusted sources may execute untrusted     code. (CVE-2021-41184)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Primavera Unifier installed on the remote host is affected by multiple vulnerabilities as referenced in the April 2022 CPU advisory.

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform     (dojo)). Supported versions that are affected are 17.7-17.12, 18.8, 19.12, 20.12 and 21.12. Easily     exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise     Primavera Unifier. Successful attacks of this vulnerability can result in unauthorized ability to cause a     hang or frequently repeatable crash (complete DOS) of Primavera Unifier as well as unauthorized update,     insert or delete access to some of Primavera Unifier accessible data and unauthorized read access to a     subset of Primavera Unifier accessible data. (CVE-2021-23450)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console,     Samples (jQueryUI)). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0.
    Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to     compromise Oracle WebLogic Server. Successful attacks require human interaction from a person other than     the attacker and while the vulnerability is in Oracle WebLogic Server, attacks may significantly impact     additional products (scope change). Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Oracle WebLogic Server accessible data as well as unauthorized     read access to a subset of Oracle WebLogic Server accessible data. (CVE-2021-41184)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Oracle Business Intelligence Enterprise Edition (OBIEE) (OAS) installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2023 CPU advisory.

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Analytics Server (Apache Commons BeanUtils)). The supported version that is affected is     6.4.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability     can result in unauthorized update, insert or delete access to some of Oracle Business Intelligence     Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Business     Intelligence Enterprise Edition accessible data and unauthorized ability to cause a partial denial of     service (partial DOS) of Oracle Business Intelligence Enterprise Edition. (CVE-2019-10086)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Analytics Server (zlib)). The supported version that is affected is 6.4.0.0.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in     takeover of Oracle Business Intelligence Enterprise Edition. (CVE-2022-37434)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: BI Application Archive (Apache Commons Text)). The supported version that is affected is     6.4.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability     can result in takeover of Oracle Business Intelligence Enterprise Edition. (CVE-2022-42889)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
160883	Tenable SecurityCenter < 5.21.0 Multiple Vulnerabilities (TNS-2022-09)	Nessus	Misc.	2022/5/10	2024/5/10	critical
156443	JQuery UI < 1.13.0 Multiple XSS	Nessus	CGI abuses	2021/12/31	2023/11/21	medium
159919	Oracle Primavera Unifier (Apr 2022 CPU)	Nessus	CGI abuses	2022/4/20	2024/10/23	critical
174743	Oracle Business Intelligence Enterprise Edition (OAS) (Apr 2023 CPU)	Nessus	Misc.	2023/4/25	2026/2/24	critical

检测

插件搜索

critical

medium

critical

critical