The version of Oracle Access Manager installed on the remote host is missing a security patch from the July 2023 CPU Advisory. It is, therefore, affected by denial of service vulnerability. Oracle Access Manager product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars (jackson-databind)). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Access Manager. 

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2024:0150 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2020-36518:
    jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large     depth of nested objects.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2023-5805:01 advisory.

    * jackson-databind: denial of service via a large depth of nested objects (CVE-2020-36518)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:4918 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime.

    This release of Red Hat JBoss Enterprise Application Platform 7.4.5 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.4.4 and includes bug fixes and enhancements. See the Red Hat JBoss     Enterprise Application Platform 7.4.5 Release Notes for information about the most significant bug fixes     and enhancements included in this release.

    Security Fix(es):

    * h2: Loading of custom classes from remote servers through JNDI (CVE-2022-23221)

    * jackson-databind: denial of service via a large depth of nested objects (CVE-2020-36518)

    * netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data (CVE-2021-37136)

    * netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an     unnecessary way (CVE-2021-37137)

    * h2: Remote Code Execution in Console (CVE-2021-42392)

    * netty: control chars in header names may lead to HTTP request smuggling (CVE-2021-43797)

    * xnio: org.xnio.StreamConnection.notifyReadClosed log to debug instead of stderr (CVE-2022-0084)

    * wildfly: Wildfly management of EJB Session context returns wrong caller principal with Elytron Security     enabled (CVE-2022-0866)

    * undertow: Double AJP response for 400 from EAP 7 results in CPING failures (CVE-2022-1319)

    * OpenJDK: Infinite loop related to incorrect handling of newlines in XMLEntityScanner (JAXP, 8270646)     (CVE-2022-21299)

    * mysql-connector-java: Difficult to exploit vulnerability allows high privileged attacker with network     access via multiple protocols to compromise MySQL Connectors (CVE-2022-21363)

    * xerces-j2: infinite loop when handling specially crafted XML document payloads (CVE-2022-23437)

    * artemis-commons: Apache ActiveMQ Artemis DoS (CVE-2022-23913)

    * Moment.js: Path traversal in moment.locale (CVE-2022-24785)

    * jboss-client: memory leakage in remote client transaction (CVE-2022-0853)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Oracle Siebel CRM installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2022 CPU advisory.

  - Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing     (XMLBeans)). Supported versions that are affected are 22.8 and prior. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Marketing.
    Successful attacks of this vulnerability can result in unauthorized access to critical data or complete     access to all Siebel Apps - Marketing accessible data and unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of Siebel Apps - Marketing. (CVE-2021-23926)

  - Vulnerability in the Siebel Industry - Life Sciences product of Oracle Siebel CRM (component: eDetailing     (PDF Viewer)). Supported versions that are affected are 22.8 and prior. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Siebel Industry - Life     Sciences. Successful attacks require human interaction from a person other than the attacker. Successful     attacks of this vulnerability can result in takeover of Siebel Industry - Life Sciences. (CVE-2018-5158)

  - Vulnerability in the Siebel Engineering - Rel Eng product of Oracle Siebel CRM (component: Build System     (Visual Studio)). Supported versions that are affected are 22.8 and prior. Easily exploitable     vulnerability allows unauthenticated attacker with logon to the infrastructure where Siebel Engineering -     Rel Eng executes to compromise Siebel Engineering - Rel Eng. Successful attacks require human interaction     from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of     Siebel Engineering - Rel Eng. (CVE-2020-16856)

  - Vulnerability in the Siebel Core - Automation product of Oracle Siebel CRM (component: Keyword Automation     (Google Gson)). Supported versions that are affected are 22.8 and prior. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Siebel Core - Automation.
    Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of Siebel Core - Automation.  Vulnerability in the Siebel Core - Common     Components product of Oracle Siebel CRM (component: DISA (Google Gson)). Supported versions that are     affected are 22.8 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network     access via HTTP to compromise Siebel Core - Common Components. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Siebel     Core - Common Components. (CVE-2022-25647)

  - Vulnerability in the Siebel Core - Common Components product of Oracle Siebel CRM (component: Calendar     (Moment.js)). Supported versions that are affected are 22.8 and prior. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Siebel Core - Common     Components. Successful attacks of this vulnerability can result in unauthorized creation, deletion or     modification access to critical data or all Siebel Core - Common Components accessible data.
    (CVE-2022-24785)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7409 advisory.

    Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides     authentication and standards-based single sign-on capabilities for web and mobile applications.

    This release of Red Hat Single Sign-On 7.6.1 on RHEL 7 serves as a replacement for Red Hat Single Sign-On     7.6.0, and includes bug fixes and enhancements, which are documented in the Release Notes document linked     to in the References.

    Security Fix(es):

    * jackson-databind: denial of service via a large depth of nested objects (CVE-2020-36518)

    * h2: Remote Code Execution in Console (CVE-2021-42392)

    * netty: control chars in header names may lead to HTTP request smuggling (CVE-2021-43797)

    * xnio: org.xnio.StreamConnection.notifyReadClosed log to debug instead of stderr (CVE-2022-0084)

    * keycloak: Stored XSS in groups dropdown (CVE-2022-0225)

    * wildfly: Wildfly management of EJB Session context returns wrong caller principal with Elytron Security     enabled (CVE-2022-0866)

    * keycloak: Uploading of SAML javascript protocol mapper scripts through the admin console (CVE-2022-2668)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Primavera Gateway installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2022 CPU advisory.

  - Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component:
    Admin (jackson-databind)). Supported versions that are affected are 17.12.0-17.12.11, 18.8.0-18.8.14,     19.12.0-19.12.13, 20.12.0-20.12.8 and 21.12.0-21.12.1. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Primavera Gateway. Successful attacks     of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash     (complete DOS) of Primavera Gateway. (CVE-2020-36518)

  - Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component:
    Admin (Apache Xerces-J)). Supported versions that are affected are 17.12.0-17.12.11, 18.8.0-18.8.14,     19.12.0-19.12.13 and 20.12.0-20.12.8. Easily exploitable vulnerability allows unauthenticated attacker     with network access via HTTP to compromise Primavera Gateway. Successful attacks require human interaction     from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized     ability to cause a hang or frequently repeatable crash (complete DOS) of Primavera Gateway.
    (CVE-2022-23437)

  - Security-in-Depth issue in the Primavera Gateway product of Oracle Construction and Engineering     (component: Admin (Spring Framework)). This vulnerability cannot be exploited in the context of this     product. (CVE-2022-22965)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
178705	Oracle Access Manager DoS (Jul 2023 CPU)	Nessus	Misc.	2023/7/21	2023/10/24	high
236058	Alibaba Cloud Linux 3 : 0150: pki-core:10.6 and pki-deps:10.6 (ALINUX3-SA-2024:0150)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	high
293145	MiracleLinux 9 : jackson (AXSA:2023-5805:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
161911	RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.4.5 security update on RHEL 7 (Moderate) (RHSA-2022:4918)	Nessus	Red Hat Local Security Checks	2022/6/6	2025/6/4	critical
212450	Oracle Siebel Server (October 2022 CPU)	Nessus	Misc.	2024/12/11	2024/12/12	critical
166946	RHEL 7 : Red Hat Single Sign-On 7.6.1 security update on RHEL 7 (Moderate) (RHSA-2022:7409)	Nessus	Red Hat Local Security Checks	2022/11/4	2024/11/7	critical
163328	Oracle Primavera Gateway (Jul 2022 CPU)	Nessus	CGI abuses	2022/7/21	2023/10/24	critical

检测

插件搜索

high

high

high

critical

critical

critical

critical