The 13.3.0.1 versions of Application Testing Suite installed on the remote host are affected by a vulnerability as referenced in the July 2021 CPU advisory.

  - Vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager (component:
    Load Testing for Web Apps (Apache Commons BeanUtils)). The supported version that is affected is 13.3.0.1.
    Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to     compromise Oracle Application Testing Suite. Successful attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of Oracle Application Testing Suite accessible data     as well as unauthorized read access to a subset of Oracle Application Testing Suite accessible data and     unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Application Testing     Suite. (CVE-2019-10086)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle Business Intelligence Enterprise Edition 12.2.1.4 installed on the remote host is affected by multiple vulnerabilities as referenced in the October 2023 CPU advisory, including the following:

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics   (component: BI Platform Security (Apache Commons BeanUtils)). The supported version that is affected is   12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to   compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can   result in unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise   Edition accessible data as well as unauthorized read access to a subset of Oracle Business Intelligence   Enterprise Edition accessible data and unauthorized ability to cause a partial denial of service (partial   DOS) of Oracle Business Intelligence Enterprise Edition. (CVE-2019-10086)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics   (component: Presentation Services (Apache XmlGraphics Commons)). Supported versions that are affected are   6.4.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network   access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this   vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business   Intelligence Enterprise Edition accessible data as well as unauthorized update, insert or delete access to   some of Oracle Business Intelligence Enterprise Edition accessible data. (CVE-2020-11988)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics   (component: Analytics Web Dashboards). Supported versions that are affected are 6.4.0.0.0, 7.0.0.0.0 and   12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to   compromise Oracle Business Intelligence Enterprise Edition. Successful attacks require human interaction   from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized   update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data   as well as unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition   accessible data. (CVE-2023-22109)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202405-21 (Commons-BeanUtils: Improper Access Restriction)

  - In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the     ability for an attacker to access the classloader via the class property available on all Java objects.
    We, however were not using this by default characteristic of the PropertyUtilsBean. (CVE-2019-10086)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:9318 advisory.

    * apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default     (CVE-2019-10086)
      * commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's     declaredClass property by default (CVE-2025-48734)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:5856 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.1.7 serves as a     replacement for Red Hat JBoss Enterprise Application Platform 7.1.6, and includes bug fixes and     enhancements. See the Red Hat JBoss Enterprise Application Platform 7.1.7 Release Notes for information     about the most significant bug fixes and enhancements included in this release.

    Security Fix(es):

    * undertow: EAP: field-name is not parsed in accordance to RFC7230 [eap-7.1.z] (CVE-2020-1710)

    * commons-beanutils: apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean     by default [eap-7.1.z] (CVE-2019-10086)

    * log4j: Remote code execution in Log4j 1.x when application is configured to use JMSSink [eap-7.1.z]     (CVE-2022-23302)

    * jackson-databind: default typing mishandling leading to remote code execution [eap-7.1.z]     (CVE-2019-14379)

    * undertow: HTTP/2: flood using HEADERS frames results in unbounded memory growth [eap-7.1.z]     (CVE-2019-9514)

    * undertow: AJP File Read/Inclusion Vulnerability [eap-7.1.z] (CVE-2020-1745)

    * undertow: HTTP/2: large amount of data requests leads to denial of service [eap-7.1.z] (CVE-2019-9511)

    * undertow: servletPath in normalized incorrectly leading to dangerous application mapping which could     result in security bypass [eap-7.1.z] (CVE-2020-1757)

    * undertow: possible Denial Of Service (DOS) in Undertow HTTP server listening on HTTPS [eap-7.1.z]     (CVE-2019-14888)

    * log4j: Unsafe deserialization flaw in Chainsaw log viewer [eap-7.1.z] (CVE-2022-23307)

    * netty: HttpObjectDecoder.java allows Content-Length header to accompanied by second Content-Length     header [eap-7.1.z] (CVE-2019-20445)

    * log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender [eap-7.1.z]     (CVE-2021-4104)

    * undertow: HTTP/2: flood using SETTINGS frames results in unbounded memory growth [eap-7.1.z]     (CVE-2019-9515)

    * infinispan-core: infinispan: invokeAccessibly method from ReflectionUtil class allows to invoke private     methods [eap-7.1.z] (CVE-2019-10174)

    * log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender [eap-7.1.z]     (CVE-2022-23305)

    * jackson-databind: failure to block the logback-core class from polymorphic deserialization leading to     remote code execution [eap-7.1.z] (CVE-2019-12384)

    * wildfly-security-manager: security manager authorization bypass (CVE-2019-14843)

    * HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512)

    * netty: HTTP request smuggling by mishandled whitespace before the colon in HTTP headers (CVE-2019-16869)

    * jackson-databind: Serialization gadgets in org.apache.log4j.receivers.db.* (CVE-2019-17531)

    * netty: HTTP request smuggling (CVE-2019-20444)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2020 CPU advisory.

  - Vulnerability in the MapViewer (Apache Commons     FileUpload) component of Oracle Database Server.
    Supported versions that are affected are 12.2.0.1, 18c     and 19c. Easily exploitable vulnerability allows low     privileged attacker having Valid User Account privilege     with network access via HTTP to compromise MapViewer     (Apache Commons FileUpload). Successful attacks of this     vulnerability can result in takeover of MapViewer     (Apache Commons FileUpload). Note: MapViewer is not     deployed with a default installation. To use MapViewer     the customer needs to re-deploy MapViewer EAR file into     Oracle WebLogic Server. CVSS 3.1 Base Score 8.8     (Confidentiality, Integrity and Availability impacts).
    (CVE-2016-1000031)

  - Vulnerability in the Java VM component of Oracle     Database Server. Supported versions that are affected     are 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c and 19c. Difficult     to exploit vulnerability allows low privileged attacker     having Create Session, Create Procedure privilege with     network access via multiple protocols to compromise Java     VM. Successful attacks require human interaction from a     person other than the attacker and while the     vulnerability is in Java VM, attacks may significantly     impact additional products. Successful attacks of this     vulnerability can result in takeover of Java VM. CVSS     3.1 Base Score 8.0 (Confidentiality, Integrity and     Availability impacts). (CVE-2020-2968)

  - Vulnerability in the Core RDBMS (zlib) component of     Oracle Database Server. The supported version that is     affected is 18c. Easily exploitable vulnerability allows     high privileged attacker having Create Session privilege     with network access via Oracle Net to compromise Core     RDBMS (zlib). Successful attacks of this vulnerability     can result in takeover of Core RDBMS (zlib). CVSS 3.1     Base Score 7.2 (Confidentiality, Integrity and     Availability impacts).(CVE-2016-9843)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of WebLogic Server installed on the remote host is affected by multiple vulnerabilities as referenced in the April 2021 CPU advisory.

  - An unspecified vulnerability exists in the Coherence Container component. Easily exploitable vulnerability     allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server.
    Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. (CVE-2021-2135)

  - An unspecified vulnerability exists in the Core component. Easily exploitable vulnerability allows     unauthenticated attacker with network access via IIOP to compromise Oracle WebLogic Server. Successful     attacks of this vulnerability can result in takeover of Oracle WebLogic Server. (CVE-2021-2136)     
  - An unspecified vulnerability exists in the TopLink Integration component. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.
    Successful attacks of this vulnerability can result in unauthorized access to critical data or complete     access to all Oracle WebLogic Server accessible data. (CVE-2021-2157)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:0194 advisory.

  - In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the     ability for an attacker to access the classloader via the class property available on all Java objects.
    We, however were not using this by default characteristic of the PropertyUtilsBean. (CVE-2019-10086)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has apache-commons-beanutils packages installed that are affected by a vulnerability:

  - In Apache Commons Beanutils 1.9.2, a special     BeanIntrospector class was added which allows     suppressing the ability for an attacker to access the     classloader via the class property available on all Java     objects. We, however were not using this by default     characteristic of the PropertyUtilsBean.
    (CVE-2019-10086)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0806 advisory.

    This release of Red Hat JBoss Enterprise Application Platform 7.2.7 serves as a     replacement for Red Hat JBoss Enterprise Application Platform 7.2.6, and     includes bug fixes and enhancements. See the Red Hat JBoss Enterprise     Application Platform 7.2.7 Release Notes for information about the most     significant bug fixes and enhancements included in this release.

    Security Fix(es):

    * commons-beanutils: apache-commons-beanutils: does not suppresses the class     property in PropertyUtilsBean by default (CVE-2019-10086)

    * libthrift: thrift: Endless loop when feed with specific input data     (CVE-2019-0205)

    * libthrift: thrift: Out-of-bounds read related to TJSONProtocol or     TSimpleJSONProtocol (CVE-2019-0210)

    * xmlsec: xml-security: Apache Santuario potentially loads XML parsing code from     an untrusted source (CVE-2019-12400)

    * wildfly: The 'enabled-protocols' value in legacy security is not respected if OpenSSL security provider     is in use (CVE-2019-14887)

    * netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling (CVE-2020-7238)

    * netty: HTTP request smuggling (CVE-2019-20444)

    * netty: HttpObjectDecoder.java allows Content-Length header to accompanied by second Content-Length     header (CVE-2019-20445)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, see the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Oracle Business Intelligence Enterprise Edition (OBIEE) (OAS) installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2023 CPU advisory.

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Analytics Server (Apache Commons BeanUtils)). The supported version that is affected is     6.4.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability     can result in unauthorized update, insert or delete access to some of Oracle Business Intelligence     Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Business     Intelligence Enterprise Edition accessible data and unauthorized ability to cause a partial denial of     service (partial DOS) of Oracle Business Intelligence Enterprise Edition. (CVE-2019-10086)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Analytics Server (zlib)). The supported version that is affected is 6.4.0.0.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in     takeover of Oracle Business Intelligence Enterprise Edition. (CVE-2022-37434)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: BI Application Archive (Apache Commons Text)). The supported version that is affected is     6.4.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability     can result in takeover of Oracle Business Intelligence Enterprise Edition. (CVE-2022-42889)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:9318 advisory.

    * apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default     (CVE-2019-10086)

    * commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's     declaredClass property by default (CVE-2025-48734)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

MySQL Enterprise Monitor installed on the remote host is 8.0.x prior to 8.0.23. Therefore, it's affected by multiple vulnerabilities as referenced in the January 2021 CPU advisory.

  - Vulnerability in the MySQL Enterprise Monitor product of Oracle MySQL (component: Service Manager (Apache     Commons BeanUtils)). Supported versions that are affected are 8.0.22 and prior. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Enterprise     Monitor. Successful attacks of this vulnerability can result in unauthorized update, insert or delete     access to some of MySQL Enterprise Monitor accessible data as well as unauthorized read access to a subset     of MySQL Enterprise Monitor accessible data and unauthorized ability to cause a partial denial of service     (partial DOS) of MySQL Enterprise Monitor. (CVE-2019-10086)

  - Vulnerability in the MySQL Enterprise Monitor product of Oracle MySQL (component: Service Manager (Spring     Framework)). Supported versions that are affected are 8.0.22 and prior. Difficult to exploit vulnerability     allows low privileged attacker with network access via HTTPS to compromise MySQL Enterprise Monitor.
    Successful attacks require human interaction from a person other than the attacker and while the     vulnerability is in MySQL Enterprise Monitor, attacks may significantly impact additional products.
    Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification     access to critical data or all MySQL Enterprise Monitor accessible data as well as unauthorized read     access to a subset of MySQL Enterprise Monitor accessible data. (CVE-2020-5421)

  - Vulnerability in the MySQL Enterprise Monitor product of Oracle MySQL (component: Service Manager (Spring     Security)). Supported versions that are affected are 8.0.22 and prior. Easily exploitable vulnerability     allows low privileged attacker with network access via HTTPS to compromise MySQL Enterprise Monitor.
    Successful attacks of this vulnerability can result in unauthorized access to critical data or complete     access to all MySQL Enterprise Monitor accessible data. (CVE-2020-5408)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Azure CycleCloud product is missing security updates. It is, therefore, affected by an elevation of privilege vulnerability. The attacker who successfully exploited this vulnerability could elevate privileges to the SuperUser role in the affected Azure CycleCloud instance.
To exploit this vulnerability an attacker must have an account with the User role assigned.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4766-1 advisory.

    It was discovered that Apache Commons BeanUtils improperly handled certain input. An attacker could     possibly use this vulnerability to cause a crash or execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
152043	Oracle Application Testing Suite (Jul 2021 CPU)	Nessus	Misc.	2021/7/23	2023/12/6	high
183506	Oracle Business Intelligence Enterprise Edition (October 2023 CPU)	Nessus	Misc.	2023/10/20	2026/2/24	high
195136	GLSA-202405-21 : Commons-BeanUtils: Improper Access Restriction	Nessus	Gentoo Local Security Checks	2024/5/8	2024/5/8	high
241316	AlmaLinux 8 : javapackages-tools:201801 (ALSA-2025:9318)	Nessus	Alma Linux Local Security Checks	2025/7/3	2025/7/4	high
206210	RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.1.7 on RHEL 7 (RHSA-2024:5856)	Nessus	Red Hat Local Security Checks	2024/8/26	2024/11/7	critical
138528	Oracle Database Server Multiple Vulnerabilities (Jul 2020 CPU)	Nessus	Databases	2020/7/16	2024/3/1	critical
148924	Oracle WebLogic Server Multiple Vulnerabilities (Apr 2021 CPU)	Nessus	Misc.	2021/4/22	2024/11/29	high
133310	CentOS 7 : apache-commons-beanutils (RHSA-2020:0194)	Nessus	CentOS Local Security Checks	2020/1/30	2024/10/9	high
134324	NewStart CGSL CORE 5.04 / MAIN 5.04 : apache-commons-beanutils Vulnerability (NS-SA-2020-0011)	Nessus	NewStart CGSL Local Security Checks	2020/3/8	2022/12/6	high
134614	RHEL 8 : Red Hat JBoss Enterprise Application Platform 7.2.7 on RHEL 8 (RHSA-2020:0806)	Nessus	Red Hat Local Security Checks	2020/3/16	2024/11/7	critical
174743	Oracle Business Intelligence Enterprise Edition (OAS) (Apr 2023 CPU)	Nessus	Misc.	2023/4/25	2026/2/24	critical
243102	RockyLinux 8 : javapackages-tools:201801 (RLSA-2025:9318)	Nessus	Rocky Linux Local Security Checks	2025/7/30	2025/7/30	high
145538	Oracle MySQL Enterprise Monitor Multiple Vulnerabilities (Jan 2021 CPU)	Nessus	CGI abuses	2021/1/28	2023/11/1	high
202026	Security Updates for Azure CycleCloud (July 2024)	Nessus	Web Servers	2024/7/9	2024/7/10	high
183108	Ubuntu 16.04 ESM / 18.04 ESM : Apache Commons BeanUtils vulnerabilities (USN-4766-1)	Nessus	Ubuntu Local Security Checks	2023/10/16	2024/8/27	high

检测

插件搜索

high

high

high

high

critical

critical

high

high

high

critical

critical

high

high

high

high