The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:2635 advisory.

    Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss     Application Server.

    This release of Red Hat JBoss Enterprise Application Platform 6.4.17 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 6.4.16, and includes bug fixes and enhancements, which are     documented in the Release Notes document linked to in the References.

    Security Fix(es):

    * It was found that when using remote logging with log4j socket server the log4j server would deserialize     any log event received via TCP or UDP. An attacker could use this flaw to send a specially crafted log     event that, during deserialization, would execute arbitrary code in the context of the logger application.
    (CVE-2017-5645)

    * A vulnerability was discovered in the error page mechanism in Tomcat's DefaultServlet implementation. A     crafted HTTP request could cause undesired side effects, possibly including the removal or replacement of     the custom error page. (CVE-2017-5664)

    * A deserialization flaw was discovered in the jackson-databind which could allow an unauthenticated user     to perform code execution by sending the maliciously crafted input to the readValue method of the     ObjectMapper. (CVE-2017-7525)

    Red Hat would like to thank Liao Xinxi (NSFOCUS) for reporting CVE-2017-7525.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9419 advisory.

    - Fix CVE-2022-23302, CVE-2022-23305, CVE-2022-23307, CVE-2017-5645

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle Enterprise Manager Cloud Control installed on the remote host is affected by multiple vulnerabilities in the Enterprise Manager Base Platform component.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:2423 advisory.

    Log4j is a tool to help the programmer output log statements to a variety of output targets.

    Security Fix(es):

    * It was found that when using remote logging with log4j socket server the log4j server would deserialize     any log event received via TCP or UDP. An attacker could use this flaw to send a specially crafted log     event that, during deserialization, would execute arbitrary code in the context of the logger application.
    (CVE-2017-5645)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 5 / 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2017:3399 advisory.

    Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss     Application Server.

    This asynchronous patch is a security update for log4j package in Red Hat JBoss Enterprise Application     Platform 5.2.0.

    Security Fix(es):

    * It was found that when using remote logging with log4j socket server the log4j server would deserialize     any log event received via TCP or UDP. An attacker could use this flaw to send a specially crafted log     event that, during deserialization, would execute arbitrary code in the context of the logger application.
    (CVE-2017-5645)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of WebLogic Server installed on the remote host is affected by multiple vulnerabilities as referenced in the July 2020 CPU advisory.

  - A vulnerability Centralized Thirdparty Jars (jackson-databind) exists. An unauthenticated, remote attacker     can exploit this issue via the HTTP protocol to takeover the Oracle WebLogic Server. (CVE-2020-9546)

  - A vulnerability in the Core component exists. An unauthenticated, remote attacker can exploit this issue     via the IIOP and T3 protocols to takeover the Oracle WebLogic Server. (CVE-2020-14687)

  - A vulnerability in the Core component exists. An unauthenticated, remote attacker can exploit this issue     via the IIOP and T3 protocols to takeover the Oracle WebLogic Server. (CVE-2020-14645)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. Also note that Oracle recommends applying ADR patches for the security issues documented here. Please see the applicable ADR Patch note for more information on the applicability of this patch.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
103041	RHEL 6 : Red Hat JBoss Enterprise Application Platform 6.4.17 update on RHEL 6 (Important) (RHSA-2017:2635)	Nessus	Red Hat Local Security Checks	2017/9/8	2025/11/24	critical
161444	Oracle Linux 6 : log4j (ELSA-2022-9419)	Nessus	Oracle Linux Local Security Checks	2022/5/23	2024/10/22	critical
111152	Oracle Enterprise Manager Cloud Control Multiple Vulnerabilities (July 2018 CPU)	Nessus	Misc.	2018/7/20	2022/4/11	critical
102348	RHEL 7 : log4j (RHSA-2017:2423)	Nessus	Red Hat Local Security Checks	2017/8/10	2025/4/29	critical
105209	RHEL 5 / 6 : Red Hat JBoss Enterprise Application Platform 5.2 (RHSA-2017:3399)	Nessus	Red Hat Local Security Checks	2017/12/13	2025/4/29	critical
138592	Oracle WebLogic Server Multiple Vulnerabilities (Jul 2020 CPU)	Nessus	Misc.	2020/7/17	2024/9/18	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical