The All Supported Versions versions of GoldenGate installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2021 CPU advisory.

  - Vulnerability in Oracle GoldenGate (component: Install (Dell BSAFE Crypto-J)). The supported version that is     affected is Prior to 19.1.0.0.0.210420. Easily exploitable vulnerability allows unauthenticated attacker with     network access via Oracle Net to compromise Oracle GoldenGate. Successful attacks require human interaction     from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized     access to critical data or complete access to all Oracle GoldenGate accessible data. (CVE-2019-3740)

  - Security-in-Depth issue in Oracle GoldenGate (component: Install (jQuery)). This vulnerability cannot be     exploited in the context of this product. (CVE-2020-11023)   
  - Security-in-Depth issue in Oracle GoldenGate (component: General (Apache Batik)). This vulnerability cannot     be exploited in the context of this product. (CVE-2020-11987)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Primavera Unifier installed on the remote host is affected by multiple vulnerabilities as referenced in the October 2021 CPU advisory, including the following:

  - An easily exploitable vulnerability in the File Management component of Primavera Unifier that allows an     unauthenticated, remote attacker to compromise availability. (CVE-2021-36090)

  - An easily exploitable vulnerability in the Platform, UI (Lodash) component of Primavera Unifier that     allows a remote, high privileged attacker to compromise confidentiality, integrity, and availability.
    (CVE-2021-23337)

  - An easily exploitable vulnerability in the Platform (Apache Tika) component of Primavera unifier that     allows an unauthenticated attacker to compromise availability. (CVE-2021-28657)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of VirtualBox installed on the remote host is prior to 6.1.28. It is, therefore, affected by multiple  vulnerabilities as referenced in the October 2021 CPU advisory:

  - An easily exploitable vulnerability in the core component of Oracle VirtualBox that allows a highly     privileged, authenticated attacker to impact confidentiality and availability. (CVE-2021-35545)

  - An easily exploitable vulnerability in the core component of Oracle VirtualBox that allows a low     privileged, authenticated attacker to impact availability. (CVE-2021-35540)

  - An easily exploitable vulnerability in the core component of Oracle VirtualBox that allows a high     privileged, authenticated attacker to compromise availability. (CVE-2021-35542)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The 11.1.1.9.0, 12.2.1.3.0, and 12.2.1.4.0 versions of HTTP Server installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2021 CPU advisory.

  - Vulnerability in the Oracle WebLogic Server Proxy Plug-In product of Oracle Fusion Middleware (component:
    SSL Module (LibExpat)). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Oracle WebLogic Server Proxy Plug-In. Successful attacks of this vulnerability can result in unauthorized     ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server Proxy     Plug-In. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). (CVE-2018-20843)

  - Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OSSL Module). The     supported version that is affected is 11.1.1.9.0. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via HTTPS to compromise Oracle HTTP Server. Successful     attacks of this vulnerability can result in unauthorized access to critical data or complete access to all     Oracle HTTP Server accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). (CVE-2021-35666)

  - Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: SSL Module     (OpenSSL)). The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability     allows unauthenticated attacker with network access via HTTPS to compromise Oracle HTTP Server. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of Oracle HTTP Server. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). (CVE-2020-1971)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Primavera Gateway installed on the remote host is affected by multiple vulnerabilities as referenced in the October 2021 CPU advisory, including the following:

  - Vulnerability in the Oracle Retail Store Inventory Management product of Oracle Retail Applications     (component: SIM Integration (JDBC)). Supported versions that are affected are 14.1, 15.0 and 16.0.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to     compromise Oracle Retail Store Inventory Management. Successful attacks require human interaction from a     person other than the attacker and while the vulnerability is in Oracle Retail Store Inventory Management,     attacks may significantly impact additional products. Successful attacks of this vulnerability can result     in takeover of Oracle Retail Store Inventory Management. (CVE-2021-2351)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: File     Management (Apache Commons Compress)). Supported versions that are affected are 17.7-17.12, 18.8, 19.12     and 20.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Primavera Unifier. Successful attacks of this vulnerability can result in unauthorized     ability to cause a hang or frequently repeatable crash (complete DOS) of Primavera Unifier. (CVE-2021-36090)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component:
    Platform, UI (Lodash)). Supported versions that are affected are 17.7-17.12, 18.8, 19.12 and 20.12. Easily     exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise     Primavera Unifier. (CVE-2021-23337)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of VirtualBox installed on the remote host is prior to 6.1.28. It is, therefore, affected by multiple  vulnerabilities as referenced in the October 2021 CPU advisory:

  - An easily exploitable vulnerability in the core component of Oracle VirtualBox that allows a     low-privileged, authenticated attacker to takeover VirtualBox. (CVE-2021-35538)

  - An easily exploitable vulnerability in the core component of Oracle VirtualBox that allows a highly     privileged, authenticated attacker to impact confidentiality and availability. (CVE-2021-35545)

  - An easily exploitable vulnerability in the core component of Oracle VirtualBox that allows a low     privileged, authenticated attacker to impact availability. (CVE-2021-35540)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle WebCenter Portal installed on the remote host is missing a security patch from the October 2021 Critical Patch Update (CPU). It is, therefore, affected by a vulnerability in the Discussion Forums (XStream) component that is easily exploitable by a remote, low privileged attacker to compromise Oracle WebCenter Portal's confidentiality, integrity and availability.

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

The 8.0.25 versions of MySQL Enterprise Monitor installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2021 CPU advisory.

  - Vulnerability in the MySQL Enterprise Monitor product of Oracle MySQL (component: Monitoring: General     (Spring Security)). Supported versions that are affected are 8.0.25 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via HTTPS to compromise MySQL Enterprise     Monitor. Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Monitor. (CVE-2021-22112)

  - Vulnerability in the Oracle Retail Predictive Application Server product of Oracle Retail Applications     (component: RPAS Fusion Client (Spring Framework)). Supported versions that are affected are 14.1.3,     15.0.3 and 16.0.3. Easily exploitable vulnerability allows low privileged attacker with logon to the     infrastructure where Oracle Retail Predictive Application Server executes to compromise Oracle Retail     Predictive Application Server. Successful attacks of this vulnerability can result in takeover of Oracle     Retail Predictive Application Server. (CVE-2021-22118)

  - Vulnerability in the MySQL Workbench product of Oracle MySQL (component: MySQL Workbench (OpenSSL)).
    Supported versions that are affected are 8.0.26 and prior. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via MySQL Workbench to compromise MySQL Workbench. Successful     attacks of this vulnerability can result in unauthorized access to critical data or complete access to all     MySQL Workbench accessible data and unauthorized ability to cause a hang or frequently repeatable crash     (complete DOS) of MySQL Workbench. (CVE-2021-3712)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle NoSQL Database Enterprise running on the remote host is prior to 21.1.12. It is, therefore, affected by multiple vulnerabilities as referenced in the October 2021 CPU advisory.

  - Security-in-Depth issue in Oracle NoSQL Database (component: Administration (Netty). This vulnerability     cannot be exploited in the context of this product. (CVE-2021-21409)

  - Security-in-Depth issue in Oracle NoSQL Database (component: Snappy frame decoder function). The Snappy     frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside     this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to     excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that     decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.
    (CVE-2021-37137)

  - Security-in-Depth issue in Oracle NoSQL Database (component: Administration (Go). This vulnerability     cannot be exploited in the context of this product. (CVE-2021-34558)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Oracle WebCenter Sites component of Oracle Fusion Middleware is affected by multiple vulnerabilities.

  - Component: WebCenter Sites (Terracotta Quartz Scheduler)). The supported   versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable   vulnerability allows unauthenticated attacker with network access via HTTP to   compromise Oracle WebCenter Sites. Successful attacks of this vulnerability   can result in takeover of Oracle WebCenter Sites. (CVE-2019-13990)

  - Component: WebCenter Sites (XStream)). The supported versions that are   affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability   allows low privileged attacker with network access via HTTP to compromise   Oracle WebCenter Sites. Successful attacks of this vulnerability can result   in takeover of Oracle WebCenter Sites. (CVE-2021-29505)

  - Component: WebCenter Sites (dojo)). The supported versions that are   affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability   allows unauthenticated attacker with network access via HTTP to compromise   Oracle WebCenter Sites. Successful attacks of this vulnerability can result   in unauthorized creation, deletion or modification access to critical data or   all Oracle WebCenter Sites accessible data. (CVE-2020-5258)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version

The 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0 versions of WebLogic Server installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2021 CPU advisory.

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Coherence     Container). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0.
    Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP to     compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of     Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).
    CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). (CVE-2021-35617)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services     (slf4j-ext)). The supported version that is affected is 12.1.3.0.0. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.
    Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base     Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). (CVE-2018-8088)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).
    Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0.
    Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise     Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server. CVSS 3.1 Base Score     7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). (CVE-2021-35620)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The 13.4.0.x < 13.4.0.13 and 13.5.0.x < 13.5.0.1 versions of Enterprise Manager Base Platform installed on the remote  host are affected by a vulnerability, as referenced in the October 2021 CPU advisory. 

- Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Policy   Framework). Supported versions that are affected are 13.4.0.0 and 13.5.0.0. Easily exploitable vulnerability   allows low privileged attacker with network access via HTTP to compromise Enterprise Manager Base Platform.   Successful attacks of this vulnerability can result in takeover of Enterprise Manager Base Platform.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle E-Business Suite installed on the remote host is affected by multiple vulnerabilities as referenced in the October 2021 CPU advisory, including the following:

  - An easily exploitable vulnerability in the Oracle Content Manager product's Content Item Manager component     that allows a low privileged, remote attacker to compromise confidentiality and integrity. (CVE-2021-2483)

  - An easily exploitable vulnerability in the Oracle Applications Manager Diagnostics component that allows a     low privileged, remote attacker to compromise confidentiality and integrity. (CVE-2021-35566)   
  - An easily exploitable vulnerability in a Miscellaneous component of the Oracle Deal Management product     that allows a low privileged, remote attacker to compromise confidentiality and integrity.
    (CVE-2021-35536)


Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version   number.

The version of MySQL running on the remote host is 8.0.x prior to 8.0.27. It is, therefore, affected by multiple vulnerabilities, including the following, as noted in the October 2021 Critical Patch Update advisory:

  - A vulnerability in the OpenSSL component that can result in a takeover of the MySQL server.
    (CVE-2021-3711)

  - An easily exploitable vulnerability in the Kerberos component of MySQL server that allows an     unauthenticated, remote attacker to affect availability. (CVE-2021-36222)

  - An easily exploitable vulnerability in the cURL component that allows an unauthenticated, remote attacker     to affect the availability of the MySQL Server. (CVE-2021-22926)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of MySQL running on the remote host is 5.7.x prior to 5.7.36. It is, therefore, affected by multiple vulnerabilities, including the following, as noted in the October 2021 Critical Patch Update advisory:

  - A vulnerability in the OpenSSL component that can result in a takeover of the MySQL server.
    (CVE-2021-3711)

  - An easily exploitable vulnerability in the InnoDB component that allows a high privileged attacker to     affect the integrity and availability of the MySQL Server. (CVE-2021-35604)

  - An easily exploitable vulnerability in the cURL component that allows an unauthenticated, remote attacker     to affect the availability of the MySQL Server. (CVE-2021-22926)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 12.4.0.0 versions of Enterprise Manager Ops Center installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2021 CPU advisory.

  - Vulnerability in the Enterprise Manager Ops Center product of Oracle Enterprise Manager (component:     Networking (Apache HTTP Server)). The supported version that is affected is 12.4.0.0. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Enterprise     Manager Ops Center. Successful attacks of this vulnerability can result in takeover of Enterprise     Manager Ops Center. (CVE-2021-26691)

  - Vulnerability in the Enterprise Manager Ops Center product of Oracle Enterprise Manager (component: Guest     Management (libxml2)). The supported version that is affected is 12.4.0.0. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Enterprise     Manager Ops Center. Successful attacks require human interaction from a person other than the attacker.
    Successful attacks of this vulnerability can result in takeover of Enterprise Manager Ops Center.
    (CVE-2021-3518)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 12.4.0.0 versions of Enterprise Manager Ops Center installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2021 CPU advisory.

  - Vulnerability in the Enterprise Manager Ops Center product of Oracle Enterprise Manager (component: Guest     Management (XStream)). The supported version that is affected is 12.4.0.0. Easily exploitable     vulnerability allows low privileged attacker with network access via HTTP to compromise Enterprise Manager     Ops Center. Successful attacks of this vulnerability can result in takeover of Enterprise Manager Ops     Center. (CVE-2021-29505)

  - Vulnerability in the Enterprise Manager Ops Center product of Oracle Enterprise Manager Ops Center     (component: Common Core (XStream)). The supported version that is affected is 12.4.0.0. Easily exploitable     vulnerability allows low privileged attacker with network access via HTTP to compromise Enterprise Manager     Ops Center. Successful attacks of this vulnerability can result in takeover of Enterprise Manager Ops     Center. (CVE-2021-21345) 

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
154342	Oracle GoldenGate (Oct 2021 CPU)	Nessus	Misc.	2021/10/22	2023/11/28	high
154262	Oracle Primavera Unifier (Oct 2021 CPU)	Nessus	CGI abuses	2021/10/20	2023/11/28	high
154246	Oracle VM VirtualBox (Oct 2021 CPU)	Nessus	Misc.	2021/10/20	2023/4/17	medium
154340	Oracle HTTP Server (Oct 2021 CPU)	Nessus	Web Servers	2021/10/22	2023/11/28	medium
154297	Oracle Primavera Gateway (Oct 2021 CPU)	Nessus	CGI abuses	2021/10/21	2023/10/24	high
154245	Oracle VM VirtualBox (Oct 2021 CPU) (macOS)	Nessus	Misc.	2021/10/20	2022/5/9	high
154326	Oracle WebCenter Portal RCE (Oct 2021 CPU)	Nessus	Misc.	2021/10/21	2022/4/11	high
154267	Oracle MySQL Enterprise Monitor (Oct 2021 CPU)	Nessus	CGI abuses	2021/10/20	2022/12/5	high
154253	Oracle NoSQL Database Multiple Vulnerabilities (Oct 2021 CPU)	Nessus	Databases	2021/10/20	2023/11/29	medium
154418	Oracle WebCenter Sites Multiple Vulnerabilities (Oct 2021 CPU)	Nessus	Windows	2021/10/26	2023/11/28	critical
154771	Oracle WebLogic Server Multiple Vulnerabilities (Oct 2021 CPU)	Nessus	Misc.	2021/11/1	2023/12/12	critical
154266	Oracle Enterprise Manager Cloud Control (Oct 2021 CPU)	Nessus	Misc.	2021/10/20	2022/4/11	high
154291	Oracle E-Business Suite Multiple Vulnerabilities (Oct 2021 CPU)	Nessus	Misc.	2021/10/21	2023/11/28	high
154258	MySQL 8.0.x < 8.0.27 Multiple Vulnerabilities (Oct 2021 CPU)	Nessus	Databases	2021/10/20	2023/11/28	critical
154259	MySQL 5.7.x < 5.7.36 Multiple Vulnerabilities (Oct 2021 CPU)	Nessus	Databases	2021/10/20	2023/11/28	critical
170202	Oracle Enterprise Manager Ops Center UCE Patches (Oct 2021 CPU)	Nessus	Misc.	2023/1/20	2023/1/23	critical
170201	Oracle Enterprise Manager Ops Center UI and Other Patches (Oct 2021 CPU)	Nessus	Misc.	2023/1/20	2023/9/7	critical

检测

插件搜索

high

high

medium

medium

high

high

high

high

medium

critical

critical

high

high

critical

critical

critical

critical