XML external entity (XXE) vulnerability in the SqlXmlUtil code in Apache Derby before 10.12.1.1, when a Java Security Manager is not in place, allows context-dependent attackers to read arbitrary files or cause a denial of service (resource consumption) via vectors involving XmlVTI and the XML datatype.

The versions of Oracle Siebel CRM installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2019 CPU advisory.

  - Vulnerability in the Oracle Knowledge component of Oracle Siebel CRM (subcomponent: Information Manager     Console (Apache Xalan)). Supported versions that are affected are 8.5.1.0 - 8.5.1.7, 8.6.0 and 8.6.1.
    Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to     compromise Oracle Knowledge. Successful attacks of this vulnerability can result in unauthorized update,     insert or delete access to some of Oracle Knowledge accessible data as well as unauthorized read access     to a subset of Oracle Knowledge accessible data and unauthorized ability to cause a partial denial of     service (partial DOS) of Oracle Knowledge. (CVE-2014-0107)     
  - Vulnerability in the Oracle Knowledge component of Oracle Siebel CRM (subcomponent: Information Manager     Console (Apache Commons BeanUtils)). Supported versions that are affected are 8.5.1.0 - 8.5.1.7, 8.6.0 and     8.6.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to     compromise Oracle Knowledge. Successful attacks of this vulnerability can result in takeover of Oracle     Knowledge. (CVE-2014-0114)

  - Vulnerability in the Oracle Knowledge component of Oracle Siebel CRM (subcomponent: Information Manager     Console (Apache Derby)). Supported versions that are affected are 8.5.1.0 - 8.5.1.7, 8.6.0 and 8.6.1.
    Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to     compromise Oracle Knowledge. Successful attacks of this vulnerability can result in unauthorized access to     critical data or complete access to all Oracle Knowledge accessible data and unauthorized ability to cause     a hang or frequently repeatable crash (complete DOS) of Oracle Knowledge. (CVE-2015-1832)     
  - Vulnerability in the Oracle Knowledge component of Oracle Siebel CRM (subcomponent: Information Manager     Console (JGroups)). Supported versions that are affected are 8.5.1.0 - 8.5.1.7, 8.6.0 and 8.6.1. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Oracle Knowledge. Successful attacks of this vulnerability can result in takeover of Oracle Knowledge.
    (CVE-2016-2141)

  - Vulnerability in the Oracle Knowledge component of Oracle Siebel CRM (subcomponent: Information Manager     Console (Apache Commons FileUpload)). Supported versions that are affected are 8.5.1.0 - 8.5.1.7, 8.6.0     and 8.6.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Oracle Knowledge. Successful attacks of this vulnerability can result in takeover of Oracle     Knowledge. (CVE-2016-1000031)

  - Vulnerability in the Oracle Knowledge component of Oracle Siebel CRM (subcomponent: Web Applications     (InfoCenter)). Supported versions that are affected are 8.5.1.0 - 8.5.1.7, 8.6.0 and 8.6.1. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Oracle Knowledge. Successful attacks require human interaction from a person other than the attacker and     while the vulnerability is in Oracle Knowledge, attacks may significantly impact additional products.
    Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to     some of Oracle Knowledge accessible data as well as unauthorized read access to a subset of Oracle     Knowledge accessible data. (CVE-2019-2719)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 16.1-16.2, 17.7-17.12, 18.8, and 19.12 versions of Primavera Unifier installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2020 CPU advisory.

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform     (Apache Derby)). Supported versions that are affected are 16.1-16.2, 17.7-17.12, 18.8 and 19.12. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Primavera Unifier. Successful attacks of this vulnerability can result in unauthorized access to critical     data or complete access to all Primavera Unifier accessible data and unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of Primavera Unifier. (CVE-2015-1832)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform     (iText)). Supported versions that are affected are 16.1-16.2, 17.7-17.12, 18.8 and 19.12. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Primavera Unifier. Successful attacks require human interaction from a person other than the attacker.
    Successful attacks of this vulnerability can result in takeover of Primavera Unifier. (CVE-2017-9096)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform     (Apache Solr)). Supported versions that are affected are 16.1-16.2, 17.7-17.12, 18.8 and 19.12. Difficult     to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise     Primavera Unifier. Successful attacks of this vulnerability can result in takeover of Primavera Unifier.
    (CVE-2019-17558)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle WebLogic Server installed on the remote host is affected by multiple vulnerabilities:

  - XML external entity (XXE) vulnerability in the SqlXmlUtil code     in Apache Derby before 10.12.1.1, when a Java Security Manager     is not in place, allows context-dependent attackers to read     arbitrary files or cause a denial of service (resource     consumption) via vectors involving XmlVTI and the XML datatype.
    (CVE-2015-1832)

  - Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and     earlier have a flaw in the Low-level interface to RSA key pair     generator, specifically RSA Key Pairs generated in low-level API     with added certainty may have less M-R tests than expected. This     appears to be fixed in versions BC 1.60 beta 4 and later,     BC-FJA 1.0.2 and later. (CVE-2018-1000180)

  - Vulnerability in the Oracle WebLogic Server component of Oracle     Fusion Middleware (subcomponent: WLS Core Components). Supported     versions that are affected are 10.3.6.0, 12.1.3.0 and 12.2.1.3.
    Easily exploitable vulnerability allows high privileged attacker     with network access via HTTP to compromise Oracle WebLogic     Server. Successful attacks of this vulnerability can result in     unauthorized creation, deletion or modification access to     critical data or all Oracle WebLogic Server accessible data as     well as unauthorized read access to a subset of Oracle WebLogic     Server accessible data and unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of Oracle WebLogic     Server. (CVE-2019-2452)

  - Vulnerability in the Oracle WebLogic Server component of Oracle     Fusion Middleware (subcomponent: WLS Core Components). Supported     versions that are affected are 10.3.6.0, 12.1.3.0 and 12.2.1.3.
    Difficult to exploit vulnerability allows unauthenticated     attacker with network access via T3 to compromise Oracle     WebLogic Server. While the vulnerability is in Oracle WebLogic     Server, attacks may significantly impact additional products.
    Successful attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of Oracle     WebLogic Server accessible data as well as unauthorized read     access to a subset of Oracle WebLogic Server accessible data and     unauthorized ability to cause a partial denial of service     (partial DOS) of Oracle WebLogic Server. (CVE-2019-2418)

  - Vulnerability in the Oracle WebLogic Server component of Oracle     Fusion Middleware (subcomponent: WLS - Web Services). The     supported version that is affected is 10.3.6.0. Easily     exploitable vulnerability allows low privileged attacker with     network access via HTTP to compromise Oracle WebLogic Server.
    Successful attacks of this vulnerability can result in     unauthorized read access to a subset of Oracle WebLogic Server     accessible data and unauthorized ability to cause a partial     denial of service (partial DOS) of Oracle WebLogic Server.
    (CVE-2019-2395)

  - Vulnerability in the Oracle WebLogic Server component of Oracle     Fusion Middleware (subcomponent: Application Container - JavaEE).     The supported version that is affected is 12.2.1.3. Easily     exploitable vulnerability allows unauthenticated attacker     with network access via HTTP to compromise Oracle WebLogic     Server. Successful attacks of this vulnerability can result in     unauthorized read access to a subset of Oracle WebLogic Server     accessible data. (CVE-2019-2441)

  - Vulnerability in the Oracle WebLogic Server component of Oracle     Fusion Middleware (subcomponent: WLS - Deployment). Supported     versions that are affected are 10.3.6.0, 12.1.3.0 and 12.2.1.3.
    Easily exploitable vulnerability allows low privileged attacker     with network access via HTTP to compromise Oracle WebLogic     Server. Successful attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of Oracle     WebLogic Server accessible data. (CVE-2019-2398)

  - Legion of the Bouncy Castle Java Cryptography APIs versions prior     to 1.60 are affected by CWE-470: Use of Externally-Controlled     Input to Select Classes or Code ('Unsafe Reflection') flaw in     XMSS/XMSS^MT private key deserialization routines. This allows     an attacker to force execution of arbitrary code. Successful     attack could be conducted via usage of a handcrafted private key     object with references to unexpected classes which allow     malicious commands execution. (CVE-2018-1000613)

  - Vulnerability in the Oracle WebLogic Server component of Oracle     Fusion Middleware (subcomponent: WLS - Web Services). Supported     versions that are affected are 12.1.3.0 and 12.2.1.3. Easily     exploitable vulnerability allows unauthenticated attacker with     network access via HTTP to compromise Oracle WebLogic Server.
    Successful attacks of this vulnerability can result in     unauthorized access to critical data or complete access to all     Oracle WebLogic Server accessible data. (CVE-2018-3246)

  - In Apache Derby 10.3.1.4 to 10.14.1.0, a specially-crafted     network packet can be used to request the Derby Network Server     to boot a database whose location and contents are under the     user's control. If the Derby Network Server is not running with     a Java Security Manager policy file, the attack is successful.
    If the server is using a policy file, the policy file must     permit the database location to be read for the attack to work.
    The default Derby Network Server policy file distributed with     the affected releases includes a permissive policy as the     default Network Server policy, which allows the attack to work.
    (CVE-2018-1313)

This update for derby fixes the following issues :

  - CVE-2015-1832: Remote attackers could have obtained     sensitive information via an XML external entity when     processing XML (bsc#1002763)

ID	Name	Product	Family	Severity
212392	Oracle Siebel Server 8.5.1.x <= 8.5.1.7 / 8.6.0 / 8.6.1 (April 2019 CPU)	Nessus	Misc.	critical
141641	Oracle Primavera Unifier (Oct 2020 CPU)	Nessus	CGI abuses	critical
121226	Oracle WebLogic Server Multiple Vulnerabilities (January 2019 CPU)	Nessus	Misc.	critical
94087	openSUSE Security Update : derby (openSUSE-2016-1191)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2015-1832

critical

Tenable Plugins

critical

critical

critical

critical