The 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 versions of Coherence installed on the remote host are affected by a vulnerability as referenced in the October 2025 CPU advisory.

  - Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Third Party     (Netty)). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise     Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized ability to cause a     hang or frequently repeatable crash (complete DOS) of Oracle Coherence. (CVE-2025-55163)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The 7.1.12 and 7.2.2 versions of VM VirtualBox installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2025 CPU advisory.

  - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions     that are affected are 7.1.12 and 7.2.2. Easily exploitable vulnerability allows high privileged attacker with logon     to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability     is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks     of this vulnerability can result in takeover of Oracle VM VirtualBox (CVE-2025-62587)

  - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported     versions that are affected are 7.1.12 and 7.2.2. Easily exploitable vulnerability allows high privileged     attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM     VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact     additional products (scope change). Successful attacks of this vulnerability can result in takeover of     Oracle VM VirtualBox. (CVE-2025-62590)

  - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported     versions that are affected are 7.1.12 and 7.2.2. Easily exploitable vulnerability allows low privileged     attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM     VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact     additional products (scope change). Successful attacks of this vulnerability can result in unauthorized     access to critical data or complete access to all Oracle VM VirtualBox accessible data. (CVE-2025-61759)

  - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported     versions that are affected are 7.1.12 and 7.2.2. Easily exploitable vulnerability allows high privileged     attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM     VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact     additional products (scope change). Successful attacks of this vulnerability can result in unauthorized     access to critical data or complete access to all Oracle VM VirtualBox accessible data. (CVE-2025-62591)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 12.2.1.4.0 versions of WebCenter Portal installed on the remote host are affected by a vulnerability as referenced in the October 2025 CPU advisory.

  - Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portal,     Analytics and REST (Apache Commons Lang)). The supported version that is affected is 12.2.1.4.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Oracle WebCenter Portal. Successful attacks of this vulnerability can result in unauthorized ability to     cause a partial denial of service (partial DOS) of Oracle WebCenter Portal. (CVE-2025-48924)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle JDeveloper installed on the remote host is missing a security patch. It is, therefore, affected by a vulnerability as referenced in the October 2025 CPU advisory. 

  - Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: ADF, ADF Faces     (Apache Commons BeanUtils)). The supported version that is affected is 12.2.1.4.0. Easily exploitable     vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle     JDeveloper. Successful attacks of this vulnerability can result in takeover of Oracle JDeveloper.     (CVE-2025-48734)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

The versions of Primavera Gateway installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2025 CPU advisory.

  - Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: Admin     (Apache Commons VFS)). Supported versions that are affected are 20.12.0-20.12.17 and 21.12.0-21.12.15. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Primavera Gateway. Successful attacks of this vulnerability can result in unauthorized access to critical     data or complete access to all Primavera Gateway accessible data. (CVE-2025-27553)

  - Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component:
    Admin (Apache Commons Lang)). Supported versions that are affected are 20.12.0-20.12.17 and     21.12.0-21.12.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via     HTTP to compromise Primavera Gateway. Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Primavera Gateway. (CVE-2025-48924)


Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2025 CPU advisory.

  - Vulnerability in the SQLcl (jgit) component of Oracle Database Server. Supported versions that are     affected are 23.4-23.9. Difficult to exploit vulnerability allows low privileged attacker having Valid     account privilege with network access via HTTP to compromise SQLcl (jgit). Successful attacks require     human interaction from a person other than the attacker. Successful attacks of this vulnerability can     result in unauthorized access to critical data or complete access to all SQLcl (jgit) accessible data.
    (CVE-2025-4949)

  - Vulnerability in the RDBMS (Python) component of Oracle Database Server. Supported versions that are     affected are 21.3-21.19 and 23.4-23.9. Easily exploitable vulnerability allows low privileged attacker     having Authenticated User privilege with logon to the infrastructure where RDBMS (Python) executes to     compromise RDBMS (Python). Successful attacks require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can result in takeover of RDBMS (Python).
    (CVE-2024-12254, CVE-2024-12718, CVE-2024-6923, CVE-2024-8088, CVE-2025-1795, CVE-2025-4138,     CVE-2025-4330, CVE-2025-4435, CVE-2025-4517)

  - Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are     19.3-19.28, 21.3-21.19 and 23.4-23.9. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via Oracle Net to compromise Java VM. Successful attacks of this vulnerability can     result in unauthorized creation, deletion or modification access to critical data or all Java VM     accessible data. (CVE-2025-61881)

  - Vulnerability in the Portable Clusterware component of Oracle Database Server. Supported versions that are     affected are 19.3-19.28, 21.3-21.19 and 23.4-23.9. Easily exploitable vulnerability allows unauthenticated     attacker with network access via Bonjour to compromise Portable Clusterware. While the vulnerability is in     Portable Clusterware, attacks may significantly impact additional products (scope change). Successful     attacks of this vulnerability can result in unauthorized read access to a subset of Portable Clusterware     accessible data. (CVE-2025-53047)

  - Vulnerability in the Unified Audit component of Oracle Database Server. Supported versions that are     affected are 23.4-23.9. Easily exploitable vulnerability allows high privileged attacker having DBA     privilege with network access via Oracle Net to compromise Unified Audit. Successful attacks of this     vulnerability can result in unauthorized update, insert or delete access to some of Unified Audit     accessible data. (CVE-2025-61749)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Primavera Unifier installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2025 CPU advisory.

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform     (Enterprise Security API for Java (Legacy))). Supported versions that are affected are 20.12.0-20.12.16,     21.12.0-21.12.17, 22.12.0-22.12.15, 23.12.0-23.12.15 and 24.12.0-24.12.9. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTPS to compromise Primavera Unifier. Successful     attacks of this vulnerability can result in unauthorized update, insert or delete access to some of     Primavera Unifier accessible data as well as unauthorized read access to a subset of Primavera Unifier     accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Primavera     Unifier. (CVE-2025-5878)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Document     Management (FreeType)). Supported versions that are affected are 20.12.0-20.12.16, 21.12.0-21.12.17,     22.12.0-22.12.15, 23.12.0-23.12.15 and 24.12.0-24.12.9. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks     of this vulnerability can result in takeover of Primavera Unifier. (CVE-2025-27363)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Document     Management (Apache Commons FileUpload)). Supported versions that are affected are 20.12.0-20.12.16,     21.12.0-21.12.17, 22.12.0-22.12.15, 23.12.0-23.12.15 and 24.12.0-24.12.9. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of Primavera Unifier. (CVE-2025-48976)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform     (Apache Commons Lang)). Supported versions that are affected are 20.12.0-20.12.16, 21.12.0-21.12.17,     22.12.0-22.12.15, 23.12.0-23.12.15 and 24.12.0-24.12.9. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks     of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial     DOS) of Primavera Unifier. (CVE-2025-48924)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 versions of WebLogic Server installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2025 CPU advisory.

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized     Thirdparty Jars (GlassFish Server)). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and     14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the     infrastructure where Oracle WebLogic Server executes to compromise Oracle WebLogic Server. Successful     attacks require human interaction from a person other than the attacker. Successful attacks of this     vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic     Server accessible data. (CVE-2020-15250)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).
    Supported versions that are affected are 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP/2 to compromise Oracle WebLogic Server.
    Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of Oracle WebLogic Server. (CVE-2025-61752)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).
    Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic     Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of     Oracle WebLogic Server accessible data. (CVE-2025-61764)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized     Thirdparty Jars (Apache Commons Lang)). The supported version that is affected is 12.2.1.4.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized ability to     cause a partial denial of service (partial DOS) of Oracle WebLogic Server. (CVE-2025-48924)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 8u461, 11.0.28, 17.0.16, 21.0.8, 25, versions of Java installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2025 CPU advisory.

  - Vulnerability in Oracle Java SE (component: JavaFX (WebKitGTK)). Supported versions that are affected are     Oracle Java SE: 8u461-b50. Difficult to exploit vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Oracle Java SE. Successful attacks require human     interaction from a person other than the attacker. Successful attacks of this vulnerability can result in     takeover of Oracle Java SE. (CVE-2025-31257)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u461,     8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM     Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle     GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation,     deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle     GraalVM Enterprise Edition accessible data. (CVE-2025-53057)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product     of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u461,     8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM     Enterprise Edition: 21.3.15. Easily exploitable vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle     GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access     to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition accessible data. (CVE-2025-53066)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Primavera P6 Enterprise Project Portfolio Management installed on the remote host are affected by a vulnerability as referenced in the October 2025 CPU advisory.

  - Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction     and Engineering (component: Outside In Technology Installer in P6 (FreeType)). Supported versions that     are affected are 20.12.0.0-20.12.21.0, 21.12.0.0-21.12.21.2, 22.12.0.0-22.12.20.0, 23.12.0.0-23.12.14.0     and 24.12.0.0-24.12.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with     network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. Successful     attacks of this vulnerability can result in takeover of Primavera P6 Enterprise Project Portfolio     Management. (CVE-2025-27363)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
271248	Oracle Coherence (October 2025 CPU)	Nessus	Misc.	2025/10/23	2025/10/23	high
271245	Oracle VM VirtualBox (October 2025 CPU)	Nessus	Misc.	2025/10/23	2025/10/23	high
271206	Oracle WebCenter Portal (October 2025 CPU)	Nessus	Misc.	2025/10/22	2025/10/22	medium
271207	Oracle JDeveloper DoS (October 2025 CPU)	Nessus	Misc.	2025/10/22	2025/10/22	high
271242	Oracle Primavera Gateway (October 2025 CPU)	Nessus	CGI abuses	2025/10/23	2025/10/23	high
271256	Oracle Database Server (October 2025 CPU)	Nessus	Databases	2025/10/23	2025/10/23	high
271244	Oracle Primavera Unifier (October 2025 CPU)	Nessus	CGI abuses	2025/10/23	2025/10/23	medium
271253	Oracle WebLogic Server (October 2025 CPU)	Nessus	Misc.	2025/10/23	2025/10/23	high
271249	Oracle Java SE Multiple Vulnerabilities (October 2025 CPU)	Nessus	Misc.	2025/10/23	2025/10/23	high
271243	Oracle Primavera P6 Enterprise Project Portfolio Management (October 2025 CPU)	Nessus	CGI abuses	2025/10/23	2025/10/23	high

检测

插件搜索

high

high

medium

high

high

high

medium

high

high

high