The version of MySQL running on the remote host is 8.0.x prior to 8.0.20. It is, therefore, affected by multiple vulnerabilities, including the following, as noted in the April 2020 Critical Patch Update advisory:

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions   that are affected are 5.7.29 and prior and 8.0.19 and prior. Easily exploitable vulnerability allows high   privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of   this vulnerability can result in takeover of MySQL Server. (CVE-2021-2144)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Memcached). Supported versions   that are affected are 5.6.47 and prior, 5.7.29 and prior and 8.0.19 and prior. This difficult to exploit   vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server.
  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently   repeatable crash (complete DOS) of MySQL Server. (CVE-2020-2804)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported   versions that are affected are 5.6.47 and prior, 5.7.29 and prior and 8.0.19 and prior. This easily exploitable   vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.
  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently   repeatable crash (complete DOS) of MySQL Server. (CVE-2020-2763)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the MySQL Enterprise Monitor application running on the remote host is 4.0.11.x prior to 4.0.12.5341 or 8.0.18.x prior to 8.0.20.1227. It is, therefore, affected by a session fixation vulnerability. An unauthenticated, remote attacker could exploit this to steal the session of a valid user and perform actions in their name.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of the tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities, as referenced in the April 2020 Oracle CPU advisory.

- Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching, CacheStore, Invocation). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. 

- Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching, CacheStore, Invocation). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Coherence accessible data.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle WebCenter Portal installed on the remote host is missing a security patch from the April 2020 Critical Patch Update (CPU). It is, therefore, affected by the following vulnerabilities :

  - A polymorphic typing exists in the jackson-databind component of the security framework of Oracle     WebCenter Portal. An unauthenticated, remote attacker can exploit this, via an externally exposed RMI     endpoint, to make the service execute a malicious payload. (CVE-2019-16943)

  - A memory allocation issue exists in the Bouncy Castle Crypto library component of the security framework     of Oracle WebCenter Portal. An unauthenticated, remote attacker can exploit this, via crafted ASN.1 data,     to cause a partial denial of service condition. (CVE-2019-17359)

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

The version of Oracle Real User Experience Insight installed on the remote host is missing the April 2020 CPU. It is, therefore, affected by a buffer overflow condition due to insufficient validation of user-supplied input. An unauthenticated, remote attacker can exploit this, by sending specially crafted ASN.1 data to an affected host, to cause a denial of service condition or the execution of arbitrary code.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version

The version of MySQL running on the remote host is 5.6.x prior to 5.6.48. It is, therefore, affected by multiple of service vulnerabilities, including the following, as noted in the April 2020 Critical Patch Update advisory:

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Memcached). Supported versions   that are affected are 5.6.47 and prior, 5.7.29 and prior and 8.0.19 and prior. Difficult to exploit   vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server.
  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently   repeatable crash (complete DOS) of MySQL Server. (CVE-2020-2804)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are   affected are 5.6.47 and prior, 5.7.28 and prior and 8.0.18 and prior. Easily exploitable vulnerability allows   high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful   attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash   (complete DOS) of MySQL Server. (CVE-2020-2814)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported   versions that are affected are 5.6.47 and prior, 5.7.29 and prior and 8.0.19 and prior. Easily exploitable   vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL   Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently   repeatable crash (complete DOS) of MySQL Server. (CVE-2020-2812)


Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Oracle Primavera P6 Enterprise Project Portfolio Management (EPPM) installation running on the remote web server is 16.2.x prior to 16.2.20.0, 17.12.x prior to 17.12.17.1, 18.8.x prior to 18.8.18.2, 19.12.1.x prior to 19.12.4.0, and 20.1.x up to and including 20.2.0.0. It is, therefore, affected by multiple vulnerabilities:

  - Primavera P6 EPPM product of Oracle Construction and Engineering is vulnerable to unauthorized read/write     access vulnerablity. Successful attacks require human interaction from a person other than the attacker,     and while the vulnerability is in Primavera P6 EPPM, attacks may significantly impact additional products     and can cause a partial denial of service (partial DOS) of Primavera P6 EPPM. This issue affects the     'Project Manager' component. (CVE-2020-2594)

  - Primavera P6 EPPM product of Oracle Construction and Engineering is vulnerable to unauthorized read/write     access vulnerablity. Low privileged attacker with network access via HTTP can compromise Primavera P6 EPPM.
    This issue affects the 'Project Manager' component. (CVE-2020-2706)     Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle Access Manager installed on the remote host is affected by the following vulnerabilities as noted in the April 2020 CPU advisory :

  - An unspecified vulnerability exists in the Authentication Engine component of Oracle Fusion Middleware     subcomponent Oracle Access Manager.  An authenticated, remote attacker can exploit this, via HTTP, to     update, insert, or delete some of Oracle Access Manager accessible data, as well as unauthorized read to a     subset of Oracle Access Manager accessible data. (CVE-2020-2740)   
  - An unspecified vulnerability exists in the Federation component of Oracle Fusion Middleware subcomponent     Oracle Access Manager.  An unauthenticated, remote attacker can exploit this, via HTTP, to cause a partial     denial of service (DoS) of Oracle Access Manager. (CVE-2020-2745)   
  - An unspecified vulnerability exists in the SSO Engine component of Oracle Fusion Middleware subcomponent     Oracle Access Manager.  An authenticated, remote attacker can exploit this, via HTTP, to update, insert,     or delete some of Oracle Access Manager accessible data, as well as unauthorized read to a subset of     Oracle Access Manager accessible data. (CVE-2020-2747)   Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

The version of Oracle Application Testing Suite installed on the remote host is affected by a Server Side Request Forgery (SSRF) vulnerability in the Oracle FLEXCUBE Private Banking product of Oracle Financial Services Applications (component: Core (Apache Axis)). The supported versions which are affected are 12.0 and 12.1. This is a difficult to exploit vulnerability which allows an unauthenticated, adjacent attacker with access to the physical segment attached to the hardware where Oracle FLEXCUBE Private Banking executes to compromise Oracle FLEXCUBE Private Banking in order to take it over.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the CPUApr2020 advisory.

  - A remote code execution vulnerability exists in the Log4j SocketServer class due to unsafe deserialization of     untrusted data. An unauthenticated, remote attacker can exploit this to remotely execute arbitrary code when     combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j     versions up to 1.2 up to 1.2.17. (CVE-2019-17571)

  - An information disclosure vulnerability exists in the Console component. An unauthenticated, remote attacker can     exploit this to gain unauthorized read access to a subset of Oracle WebLogic Server accessible data. (CVE-2020-2766)

  - A vulnerability in the WLS Web Services component exists. An authenticated, remote attacker can exploit this via T3     to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle     WebLogic Server. (CVE-2020-2798)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the April 2020 CPU advisory.

  - Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer     overflow via a crafted regular expression that triggers     invalid write operations. (CVE-2018-18311)

  - ChaCha20-Poly1305 is an AEAD cipher, and requires a     unique nonce input for every encryption operation. RFC     7539 specifies that the nonce value (IV) should be 96     bits (12 bytes). OpenSSL allows a variable nonce length     and front pads the nonce with 0 bytes if it is less than     12 bytes. However it also incorrectly allows a nonce to     be set of up to 16 bytes. In this case only the last 12     bytes are significant and any additional leading bytes     are ignored. It is a requirement of using this cipher     that nonce values are unique. Messages encrypted using a     reused nonce value are susceptible to serious     confidentiality and integrity attacks. If an application     changes the default nonce length to be longer than 12     bytes and then makes a change to the leading bytes of     the nonce expecting the new value to be a new unique     nonce then such an application could inadvertently     encrypt messages with a reused nonce. Additionally the     ignored bytes in a long nonce are not covered by the     integrity guarantee of this cipher. Any application that     relies on the integrity of these ignored leading bytes     of a long nonce may be further affected. Any OpenSSL     internal use of this cipher, including in SSL/TLS, is     safe because no such use sets such a long nonce value.
    However user applications that use this cipher directly     and set a non-default nonce length to be longer than 12     bytes may be vulnerable. OpenSSL versions 1.1.1 and     1.1.0 are affected by this issue. Due to the limited     scope of affected deployments this has been assessed as     low severity and therefore we are not creating new     releases at this time. Fixed in OpenSSL 1.1.1c (Affected     1.1.1-1.1.1b). Fixed in OpenSSL 1.1.0k (Affected     1.1.0-1.1.0j). (CVE-2019-1543)

  - Vulnerability in the Enterprise Manager Base Platform product   of Oracle Enterprise Manager (component: Discovery Framework   (Oracle OHS)). Supported versions that are affected are 13.2.0.0   and 13.3.0.0. Easily exploitable vulnerability allows unauthenticated   attacker with network access via HTTP to compromise Enterprise Manager   Base Platform. Successful attacks of this vulnerability can result   in takeover of Enterprise Manager Base Platform. (CVE-2020-2961)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle Business Intelligence Publisher running on the remote host is 11.1.1.9.x prior to 11.1.1.9.200414 or 12.2.1.3.x prior to 12.2.1.3.200414 or 12.2.1.4.x prior to 12.2.1.4.200414. It is, therefore, affected by multiple vulnerabilities as noted in the April 2020 Critical Patch Update advisory

  - An unspecified vulnerability in the Analystics Web     General component of Oracle BI Published. An easily     exploitable vulnerability could allow an     unauthenticated attacker with network access via HTTP     to compromise Oracle Business Intelligence Enterprise     Edition. A successful attacks of this vulnerability     can result in takeover of Oracle Business Intelligence     Enterprise Edition. (CVE-2020-2950)

  - The Bouncy Castle Java library before 1.51 does not     validate a point is withing the elliptic curve, which     makes it easier for remote attackers to obtain private     keys via a series of crafted elliptic curve Diffie     Hellman (ECDH) key exchanges, aka an invalid curve     attack. (CVE-2015-7940)

  - Apache Commons FileUpload before 1.3.3 DiskFileItem File     Manipulation Remote Code Execution (CVE-2016-1000031)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle HTTP Server installed on the remote host is affected by the following vulnerabilities as referenced in the April 2020 CPU advisory:

  - An integer overflow in xmlmemory.c in libxml2 before 2.9.5, as used in Oracle HTTP Server's Web Listener     component, allows a remote attacker to potentially exploit heap corruption via a crafted XML file.
    (CVE-2017-5130)

  - An easily exploitable vulnerability in Oracle HTTP Server's Web Listener component affecting the supported     version 11.1.1.9.0. An unauthenticated, remote attacker with network access via HTTP can exploit this to     compromise Oracle HTTP Server, resulting in unauthorized update, insert or delete access to some of Oracle     HTTP Server accessible data as well as unauthorized read access to a subset of Oracle HTTP Server     accessible data. (CVE-2020-2952)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 7 Update 261, 8 Update 251, 11 Update 7, or 14 Update 1. It is, therefore, affected by multiple vulnerabilities related to the following components :

  - Oracle Java SE and Java SE Embedded are prone to a buffer overflow attack, over 'Multiple' protocol.
    This issue affects the 'JavaFX (libxslt)' component. Successful attacks of this vulnerability allow     unauthenticated attacker with network access to takeover of Java SE. (CVE-2019-18197)

  - Oracle Java SE and Java SE Embedded are prone to partial denial of service (partial DOS) vulnerability.
    An unauthenticated remote attacker can exploit this over 'Multiple' protocol. This issue affects the     'Scripting' component. (CVE-2020-2754, CVE-2020-2755)

  - Oracle Java SE and Java SE Embedded are prone to partial denial of service (partial DOS) vulnerability.
    An unauthenticated remote attacker can exploit this over 'Multiple' protocol. This issue affects the     'Serialization' component. (CVE-2020-2756, CVE-2020-2757)

  - Oracle Java SE prone to unauthorized read access vulnerability. An unauthenticated remote attacker can     exploit this over 'Multiple' protocol can result in unauthorized read access to a subset of Java SE     accessible data. This issue affects the 'Advanced Management Console' component. (CVE-2020-2764)

  - Oracle Java SE and Java SE Embedded are prone to unauthorized write/read access vulnerability. An     unauthenticated remote attacker over 'HTTPS' can read, update, insert or delete access to some of Java SE     accessible data. This issue affects the 'JSSE' component. (CVE-2020-2767)

  - Oracle Java SE and Java SE Embedded are prone to partial denial of service (partial DOS) vulnerability.
    An unauthenticated remote attacker can exploit this over 'Multiple' protocol. This issue affects the     'Scripting' component. (CVE-2020-2773)

It is also affected by other vulnerabilities; please see vendor advisories for more information.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 7 Update 261, 8 Update 251, 11 Update 7, or 14 Update 1. It is, therefore, affected by multiple vulnerabilities related to the following components :

  - Oracle Java SE and Java SE Embedded are prone to a buffer overflow attack, over 'Multiple' protocol.
    This issue affects the 'JavaFX (libxslt)' component. Successful attacks of this vulnerability allow     unauthenticated attacker with network access to takeover of Java SE. (CVE-2019-18197)

  - Oracle Java SE and Java SE Embedded are prone to partial denial of service (partial DOS) vulnerability.
    An unauthenticated remote attacker can exploit this over 'Multiple' protocol. This issue affects the     'Scripting' component. (CVE-2020-2754, CVE-2020-2755)

  - Oracle Java SE and Java SE Embedded are prone to partial denial of service (partial DOS) vulnerability.
    An unauthenticated remote attacker can exploit this over 'Multiple' protocol. This issue affects the     'Serialization' component. (CVE-2020-2756, CVE-2020-2757)

  - Oracle Java SE prone to unauthorized read access vulnerability. An unauthenticated remote attacker can     exploit this over 'Multiple' protocol can result in unauthorized read access to a subset of Java SE     accessible data. This issue affects the 'Advanced Management Console' component. (CVE-2020-2764)

  - Oracle Java SE and Java SE Embedded are prone to unauthorized write/read access vulnerability. An     unauthenticated remote attacker over 'HTTPS' can read, update, insert or delete access to some of Java SE     accessible data. This issue affects the 'JSSE' component. (CVE-2020-2767)

  - Oracle Java SE and Java SE Embedded are prone to partial denial of service (partial DOS) vulnerability.
    An unauthenticated remote attacker can exploit this over 'Multiple' protocol. This issue affects the     'Scripting' component. (CVE-2020-2773)

 It is also affected by other vulnerabilities; please see vendor advisories for more information.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by the following vulnerabilities as referenced in the April 2020 CPU advisory:

  - A vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported     versions that are affected are 8.0.14 and prior and 5.1.48 and prior. This is a difficult to exploit     vulnerability that allows an unauthenticated attacker, remote attacker via multiple protocols to     compromise MySQL Connectors. Successful attacks require human interaction from a person other than the     attacker and while the vulnerability is in MySQL Connectors, attacks may significantly impact additional     products. Successful attacks involving this vulnerability can result in unauthorized update, insert or     delete access to some of MySQL Connectors accessible data as well as unauthorized read access to a subset     of MySQL Connectors accessible data. (CVE-2020-2875) 

  - A vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported     versions that are affected are 5.1.48 and prior. This is a difficult to exploit vulnerability that allows     a high privileged, remote attacker via multiple protocols to compromise MySQL Connectors. Successful     attacks involving this vulnerability can result in unauthorized ability to cause a partial denial of     service (partial DOS) of MySQL Connectors. (CVE-2020-2933)

  - A vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported     versions that are affected are 8.0.19 and prior and 5.1.48 and prior. This is a difficult to exploit     vulnerability allows an unauthenticated, remote attacker via multiple protocols to compromise MySQL     Connectors. Successful attacks require human interaction from a person other than the attacker. Successful     attacks involving this vulnerability can result in unauthorized update, insert or delete access to some of     MySQL Connectors accessible data as well as unauthorized read access to a subset of MySQL Connectors     accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL     Connectors. (CVE-2020-2934)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle VM VirtualBox running on the remote host is 5.2.x prior to 5.2.40, 6.0.x prior to 6.0.20 or 6.1.x prior to 6.1.6. It is, therefore, affected by multiple vulnerabilities as noted in the April 2019 Critical Patch Update advisory. Note that Nessus has not tested for this issue buthas instead relied only on the application's self-reported version number:

  - An input-validation flaw exists within the processing of     data sent to OHCI endpoints that could allow privilege     escalation. (CVE-2020-2575)

  - An unspecified vulnerability exists in the Oracle     Virtualization Core component. An authenticated,     local attacker can exploit this issue, to compromise     and takeover the Oracle VM VirtualBox. (CVE-2020-2742,     CVE-2020-2758, CVE-2020-2894, CVE-2020-2905,     CVE-2020-2908, CVE-2020-2902, CVE-2020-2907,     CVE-2020-2911, CVE-2020-2913, CVE-2020-2914,     CVE-2020-2929, CVE-2020-2958)

  - An unspecified vulnerability exists in the Oracle     Virtualization Core component. An authenticated, local     attacker can exploit this issue, for unauthorized access     to critical data or complete access to all  Oracle VM     VirtualBox accessible data. (CVE-2020-2741,     CVE-2020-2743)

  - An unspecified vulnerability exists in the Oracle     Virtualization Core component. An authenticated, local     attacker can exploit this issue, for unauthorized read     access to a subset of Oracle VM VirtualBox  accessible     data. (CVE-2020-2748)

  - An unspecified vulnerability exists in the Oracle     Virtualization Core component. An authenticated, local     attacker can exploit this issue, for unauthorized     creation, deletion or modification access to critical     data or all Oracle VM VirtualBox accessible data.
    (CVE-2020-2910)

  - An unspecified vulnerability exists in the Oracle     Virtualization Core component. An authenticated, local     attacker can exploit this issue, for unauthorized     ability to cause a partial denial of service (partial     DOS) of Oracle VM VirtualBox. (CVE-2020-2909)

  - An unspecified vulnerability exists in the Oracle     Virtualization Core component. An authenticated, local     attacker can exploit this issue, for unauthorized     ability to cause a hang or frequently repeatable crash     (complete DOS) of Oracle VM VirtualBox. (CVE-2020-2959,     CVE-2020-2951)

The remote Oracle Database Server is missing the April 2020 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilities:
  - Vulnerability in the Oracle Multimedia component of Oracle Database Server. The supported version that is     affected is 12.1.0.2. Easily exploitable vulnerability allows low privileged attacker having Create     Session privilege with network access via Oracle Net to compromise Oracle Multimedia. Successful attacks     require human interaction from a person other than the attacker. Successful attacks of this vulnerability     can result in takeover of Oracle Multimedia (CVE-2016-10251).

  - Vulnerability in the Oracle Application Express component of Oracle Database Server. The supported   version that is affected is Prior to 19.1. Easily exploitable vulnerability allows unauthenticated attacker   with network access via HTTPS to compromise Oracle Application Express. Successful attacks require human   interaction from a person other than the attacker and while the vulnerability is in Oracle Application   Express, attacks may significantly impact additional products. Successful attacks of this vulnerability   can result in unauthorized update, insert or delete access to some of Oracle Application Express accessible   data as well as unauthorized read access to a subset of Oracle Application Express accessible data   (CVE-2016-7103).

  - Vulnerability in the WLM (Apache Tomcat) component of Oracle Database Server. Supported versions that   are affected are 12.2.0.1, 18c and 19c. Difficult to exploit vulnerability allows unauthenticated attacker   with network access via HTTPS to compromise WLM (Apache Tomcat). Successful attacks require human   interaction from a person other than the attacker. Successful attacks of this vulnerability can result in   takeover of WLM (Apache Tomcat) (CVE-2019-17563).

It is also affected by additional vulnerabilities; see the vendor advisory for more information.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the CPUApr2020 advisory.

  - initDocumentParser in     xml/XMLSchedulingDataProcessor.java in Terracotta Quartz     Scheduler through 2.3.0 allows XXE attacks via a job     description. (CVE-2019-13990)

  - A Polymorphic Typing issue was discovered in FasterXML     jackson-databind 2.0.0 through 2.9.10. When Default     Typing is enabled (either globally or for a specific     property) for an externally exposed JSON endpoint and     the service has the p6spy (3.8.6) jar in the classpath,     and an attacker can find an RMI service endpoint to     access, it is possible to make the service execute a     malicious payload. This issue exists because of     com.p6spy.engine.spy.P6DataSource mishandling.
    (CVE-2019-16943)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by the following vulnerabilities as referenced in the April 2020 CPU advisory:

  - In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows     suppressing the ability for an attacker to access the classloader via the class property available on all     Java objects. However, this characteristic of the PropertyUtilsBean was not used by default.
    (CVE-2019-10086)

  - The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an     infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an     attacker can choose the file names inside of an archive created by Compress. (CVE-2019-12402)

  - A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default     Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and     the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint     to access, it is possible to make the service execute a malicious payload. This issue exists because of     com.p6spy.engine.spy.P6DataSource mishandling. (CVE-2019-16943)

  - Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which     could result in an application crash (potential information disclosure) or a potential authentication     bypass. (CVE-2019-17195)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the April 2020 Oracle Critical Patch Update (CPU) advisory, including the following:

  - A vulnerability in the Oracle Email Center product of Oracle E-Business Suite (component: Email Address     list and Message Display) of supported versions 12.1.1-12.1.3 and 12.2.3-12.2.9 which allows unauthorized     access to critical data or complete access to all Oracle Email Center accessible data as well as     unauthorized update, insert or delete access to some Oracle Email Center accessible data by an     unauthenticated, remote attacker. (CVE-2020-2794)   
  - A vulnerability in the Oracle Email Center product of Oracle E-Business Suite (component: Message Display)     of supported versions 12.1.1-12.1.3 and 12.2.3-12.2.9 which allows unauthorized access to critical data or     complete access to all Oracle Email Center accessible data as well as unauthorized update, insert or     delete access to some Oracle Email Center accessible data by an unauthenticated, remote attacker.
    (CVE-2020-2796)   
  - A vulnerability in the Oracle Marketing Encyclopedia System product of Oracle E-Business Suite (component:
    Administration) of supported versions 12.1.1-12.1.3 which allows unauthorized access to critical data or     complete access to all Oracle Marketing Encyclopedia System accessible data as well as unauthorized     update, insert or delete access to some Oracle Marketing Encyclopedia System accessible data by an     unauthenticated, remote attacker. (CVE-2020-2807)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
135701	MySQL 8.0.x < 8.0.20 Multiple Vulnerabilities (Apr 2020 CPU)	Nessus	Databases	2021/1/22	2024/1/26	high
138039	MySQL Enterprise Monitor 4.0.11.x < 4.0.12.5341 / 8.0.18.x < 8.0.20.1227(Apr 2020 CPU)	Nessus	CGI abuses	2020/7/2	2022/12/5	high
137853	Oracle Coherence (Apr 2020 CPU)	Nessus	Misc.	2020/6/26	2022/4/11	critical
135850	Oracle WebCenter Portal Multiple Vulnerabilities (Apr 2020 CPU)	Nessus	Misc.	2020/4/21	2024/4/23	critical
135705	Oracle Real User Experience Insight (Apr 2020 CPU)	Nessus	CGI abuses	2020/4/17	2020/4/23	critical
135699	MySQL 5.6.x < 5.6.48 Multiple Vulnerabilities (Apr 2020 CPU)	Nessus	Databases	2020/4/17	2023/11/1	low
135698	Oracle Primavera P6 Enterprise Project Portfolio Management (EPPM) Multiple Vulnerabilities (Apr 2020 CPU)	Nessus	CGI abuses	2020/4/17	2022/4/11	medium
135697	Oracle Access Manager Multiple Vulnerabilities (Apr 2020 CPU)	Nessus	Misc.	2020/4/17	2022/4/11	medium
135681	Oracle Application Testing Suite (Apr 2020 CPU)	Nessus	Misc.	2020/4/16	2022/12/5	high
135680	Oracle WebLogic Server Multiple Vulnerabilities (Apr 2020 CPU)	Nessus	Misc.	2020/4/16	2024/1/4	critical
135679	Oracle Enterprise Manager Cloud Control (Apr 2020 CPU)	Nessus	Misc.	2020/4/16	2022/10/21	critical
135678	Oracle Business Intelligence Publisher Multiple Vulnerabilities (Apr 2020 CPU)	Nessus	Misc.	2020/4/16	2022/12/5	critical
135677	Oracle Fusion Middleware Oracle HTTP Server (Apr 2020 CPU)	Nessus	Web Servers	2020/4/16	2022/4/11	high
135592	Oracle Java SE 1.7.0_261 / 1.8.0_251 / 1.11.0_7 / 1.14.0_1 Multiple Vulnerabilities (Apr 2020 CPU)	Nessus	Windows	2020/4/16	2022/5/13	high
135591	Oracle Java SE 1.7.0_261 / 1.8.0_251 / 1.11.0_7 / 1.14.0_1 Multiple Vulnerabilities (Apr 2020 CPU) (Unix)	Nessus	Misc.	2020/4/16	2024/4/3	high
135588	Oracle MySQL Connectors (Apr 2020 CPU)	Nessus	Misc.	2020/4/15	2023/11/1	medium
135586	Oracle VM VirtualBox (Apr 2020 CPU)	Nessus	Misc.	2020/4/15	2022/5/13	high
135585	Oracle Database Server Multiple Vulnerabilities (Apr 2020 CPU)	Nessus	Databases	2020/4/15	2024/3/18	high
135584	Oracle Primavera Unifier (Apr 2020 CPU)	Nessus	CGI abuses	2020/4/15	2024/3/18	critical
135583	Oracle Primavera Gateway (Apr 2020 CPU)	Nessus	CGI abuses	2020/4/15	2024/3/18	critical
135582	Oracle Oracle E-Business Suite (Apr 2020 CPU)	Nessus	Misc.	2020/4/15	2022/5/13	high

检测

插件搜索

high

high

critical

critical

critical

low

medium

medium

high

critical

critical

critical

high

high

high

medium

high

high

critical

critical

high