The version of Oracle Business Intelligence Enterprise Edition (OAS) 7.6.0.0.0 installed on the remote host is affected by multiple vulnerabilities as referenced in the April 2026 CPU advisory.

  - mchange-commons-java, a library that provides Java utilities, includes code that mirrors early     implementations of JNDI functionality, including support for remote `factoryClassLocation` values, by     which code can be downloaded and invoked within a running application. If an attacker can provoke an     application to read a maliciously crafted `jaxax.naming.Reference` or serialized object, they can provoke     the download and execution of malicious code. Implementations of this functionality within the JDK were     disabled by default behind a System property that defaults to `false`,     `com.sun.jndi.ldap.object.trustURLCodebase`. However, since mchange-commons-java includes an independent     implementation of JNDI derefencing, libraries (such as c3p0) that resolve references via that     implementation could be provoked to download and execute malicious code even after the JDK was hardened.
    Mirroring the JDK patch, mchange-commons-java's JNDI functionality is gated by configuration parameters     that default to restrictive values starting in version 0.4.0. No known workarounds are available. Versions     prior to 0.4.0 should be avoided on application CLASSPATHs. (CVE-2026-27727)

  - Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure     vulnerability. This is due to the use of the File.createTempFile which creates a file inside of the system     temporary directory with the permissions: -rw-r--r--. Thus the contents of this file are viewable by all     other users locally on the system. As such, if the contents written is security sensitive, it can be     disclosed to other local users. (CVE-2021-28168)

  - In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource     consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter     (PBKDF2) component. (CVE-2023-52428)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2025-9114 advisory.

    * Fri Jun 13 2025 Mikolaj Izdebski <mizdebsk@redhat.com>
    - Fix improper access control vulnerability
    - Resolves: CVE-2025-48734

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:9318 advisory.

    * apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default     (CVE-2019-10086)

    * commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's     declaredClass property by default (CVE-2025-48734)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-10814 advisory.

    - Add SuppressPropertiesBeanIntrospector.SUPPRESS_DECLARING_CLASS       [Orabug: 38176946][CVE-2025-48734]
    - Fix CVE-2014-0114
    - Fix CVE-2019-10086
    - Resolves: CVE-2013-1571

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:15811 advisory.

    Jenkins is a continuous integration server that monitors executions of repeated jobs, such as building a     software project or jobs run by cron.

    Security Fix(es):

    * jenkins: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an     enum's declaredClass property by default (CVE-2025-48734)

    For more information about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:15817 advisory.

    Jenkins is a continuous integration server that monitors executions of repeated jobs, such as building a     software project or jobs run by cron.

    Security Fix(es):

    * jenkins: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass     property by default (CVE-2025-48734)

    For more information about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:15814 advisory.

    Jenkins is a continuous integration server that monitors executions of repeated jobs, such as building a     software project or jobs run by cron.

    Security Fix(es):

    * jenkins: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an     enum's declaredClass property by default (CVE-2025-48734)

    For more information about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:9166 advisory.

    * commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's     declaredClass property by default (CVE-2025-48734)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0654 advisory.

    Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:

    CVE-2025-48734:
    Improper Access Control vulnerability in Apache Commons.



    A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using     the declared class property of Java enum objects to get access to the classloader. However this protection     was not enabled by default. PropertyUtilsBean (and consequently BeanUtilsBean) now disallows declared     class level property access by default.





    Releases 1.11.0 and 2.0.0-M2 address a potential security issue when accessing enum properties in an     uncontrolled way. If an application using Commons BeanUtils passes property paths from an external source     directly to the getProperty() method of PropertyUtilsBean, an attacker can access the enums class     loader via the declaredClass property available on all Java enum objects. Accessing the     enums declaredClass allows remote attackers to access the ClassLoader and execute arbitrary code.
    The same issue exists with PropertyUtilsBean.getNestedProperty().
    Starting in versions 1.11.0 and 2.0.0-M2 a special BeanIntrospector suppresses the declaredClass     property. Note that this new BeanIntrospector is enabled by default, but you can disable it to regain the     old behavior; see section 2.5 of the user's guide and the unit tests.

    This issue affects Apache Commons BeanUtils 1.x before 1.11.0, and 2.x before 2.0.0-M2.Users of the     artifact commons-beanutils:commons-beanutils

     1.x are recommended to upgrade to version 1.11.0, which fixes the issue.


    Users of the artifact org.apache.commons:commons-beanutils2

     2.x are recommended to upgrade to version 2.0.0-M2, which fixes the issue.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 versions of WebLogic Server installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2025 CPU advisory.

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized     Thirdparty Jars (Spring Framework)). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and     14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via     HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in     unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data.     (CVE-2024-38819)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console     (Apache Commons BeanUtils)). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily     exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise     Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle     WebLogic Server. (CVE-2025-48734)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web     Container). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Oracle WebLogic Server. Successful attacks require human interaction from a person other than the     attacker and while the vulnerability is in Oracle WebLogic Server, attacks may significantly impact     additional products (scope change). Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Oracle WebLogic Server accessible data as well as unauthorized     read access to a subset of Oracle WebLogic Server accessible data. (CVE-2025-50073)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
309965	Oracle Business Intelligence Enterprise Edition (OAS 7.6) (April 2026 CPU)	Nessus	Misc.	2026/4/23	2026/4/27	high
240189	Oracle Linux 9 : apache-commons-beanutils (ELSA-2025-9114)	Nessus	Oracle Linux Local Security Checks	2025/6/19	2025/6/19	high
243102	RockyLinux 8 : javapackages-tools:201801 (RLSA-2025:9318)	Nessus	Rocky Linux Local Security Checks	2025/7/30	2025/7/30	high
243210	Oracle Linux 7 : apache-commons-beanutils (ELSA-2025-10814)	Nessus	Oracle Linux Local Security Checks	2025/7/30	2025/9/11	high
264815	RHEL 9 : Red Hat Product OCP Tools 4.16 OpenShift Jenkins (RHSA-2025:15811)	Nessus	Red Hat Local Security Checks	2025/9/15	2025/9/15	high
264816	RHEL 8 : Red Hat Product OCP Tools 4.15 OpenShift Jenkins (RHSA-2025:15817)	Nessus	Red Hat Local Security Checks	2025/9/15	2025/9/15	high
264817	RHEL 9 : Red Hat Product OCP Tools 4.17 OpenShift Jenkins (RHSA-2025:15814)	Nessus	Red Hat Local Security Checks	2025/9/15	2025/9/15	high
269862	AlmaLinux 10 : apache-commons-beanutils (ALSA-2025:9166)	Nessus	Alma Linux Local Security Checks	2025/10/9	2025/10/9	high
276030	TencentOS Server 2: apache-commons-beanutils (TSSA-2025:0654)	Nessus	Tencent Local Security Checks	2025/11/20	2025/11/20	high
242331	Oracle WebLogic Server (July 2025 CPU)	Nessus	Misc.	2025/7/18	2026/1/21	medium

检测

插件搜索

high

high

high

high

high

high

high

high

high

medium