A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from source. The successor to Axis 1.x is Axis2, the latest version is 1.7.9 and is not vulnerable to this issue.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - axis: Hard coded domain name in example web service named StockQuoteService.jws leading to remote     code execution. (CVE-2019-0227)

  - Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the     default servlet/services. (CVE-2018-8032)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - axis: Hard coded domain name in example web service named StockQuoteService.jws leading to remote     code execution. (CVE-2019-0227)

  - Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the     default servlet/services. (CVE-2018-8032)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The version of IBM Cognos Analytics installed on the remote host is prior to 11.1.7 FP8, 11.2.4 FP3, or 12.0.2. It is, therefore, affected by multiple vulnerabilities as referenced in the IBM Security Bulletin No. 7123154, including the following:

  - When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the   allowed constraints and thus lead to out of memory on the system. This issue affects Java applications using   Apache Avro Java SDK up to and including 1.11.2. Users should update to apache-avro version 1.11.3 which   addresses this issue. (CVE-2023-39410)

  - In order to decrypt SM2 encrypted data an application is expected to call the API function   EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the   'out' parameter can be NULL and, on exit, the 'outlen' parameter is populated with the buffer size required   to hold the decrypted plaintext. The application can then allocate a sufficiently sized buffer and call   EVP_PKEY_decrypt() again, but this time passing a non-NULL value for the 'out' parameter. A bug in the   implementation of the SM2 decryption code means that the calculation of the buffer size required to hold the   plaintext returned by the first call to EVP_PKEY_decrypt() can be smaller than the actual size required by   the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is called by the application a   second time with a buffer that is too small. A malicious attacker who is able present SM2 content for   decryption to an application could cause attacker chosen data to overflow the buffer by up to a maximum of   62 bytes altering the contents of other data held after the buffer, possibly changing application behaviour   or causing the application to crash. The location of the buffer is application dependent but is typically   heap allocated. Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k). (CVE-2021-3711)

  - SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization.
  Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using   SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend   upgrading to version 2.0 and beyond. (CVE-2022-1471)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle Business Intelligence Enterprise Edition 12.2.1.4 installed on the remote host are affected by a vulnerability as referenced in the July 2023 CPU advisory. 

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Analytics Server (Apache Hive)). Supported versions that are affected are 6.4.0.0.0,     7.0.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network     access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of     this vulnerability can result in unauthorized creation, deletion or modification access to critical data     or all Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized access to     critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data.
    (CVE-2018-1282)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Framework (Quartz)). The supported version that is affected is 12.2.1.4.0. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business     Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in takeover of     Oracle Business Intelligence Enterprise Edition. (CVE-2019-13990)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Analytics Web Answers (Apache Commons FileUpload)). The supported version that is affected is     12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of     Oracle Business Intelligence Enterprise Edition. (CVE-2023-24998)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle Business Intelligence Publisher running on the remote host is 12.2.1.3.x prior to 12.2.1.3.220628, 12.2.1.4.x prior to 12.2.1.3.220628, It is, therefore, affected by multiple vulnerabilities as noted in the July 2022 Critical Patch Update advisory, including the following:

  - Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: BI Publisher Security     (Apache Axis)). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Difficult to exploit     vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the     hardware where the Oracle BI Publisher executes to compromise Oracle BI Publisher. Successful attacks of this     vulnerability can result in takeover of Oracle BI Publisher. (CVE-2019-0227)

  - Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: BI Publisher Security).     Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows low     privileged attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks of this     vulnerability can result in unauthorized read access to a subset of Oracle BI Publisher accessible data.
    (CVE-2022-21523)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle WebCenter Portal installed on the remote host is missing a security patch from the July 2020 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilities, including the following:

  - A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default     Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and     the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a     JNDI service to access, it is possible to make the service execute a malicious payload. This is part of     the Security Framework component and is an easily exploitable vulnerability hat allows an unauthenticated     attacker with network access to compromise Oracle WebCenter Portal. (CVE-2019-17531)

  - A vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer).
    Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. This is an easily exploitable     vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle     WebCenter Portal. Successful attacks of this vulnerability can result in unauthorized creation, deletion or     modification access to critical data or all Oracle WebCenter Portal accessible data as well as     unauthorized read access to a subset of Oracle WebCenter Portal accessible data and the unauthorized     ability to cause a partial denial of service (partial DOS) of Oracle WebCenter Portal. (CVE-2020-14611)

  - A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was     last released in 2006, which is used in Oracle WebCenter Portal's WebCenter Spaced Application component.
    This difficult to exploit vulnerability allows an unauthenticated attacker with access to the physical     communication segment attached to the hardware where the Oracle WebCenter Portal executes to compromise     Oracle WebCenter Portal. (CVE-2019-0227)

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

The 13.3.0.0, 13.4.0.0, and 12.1.0.5 versions of Enterprise Manager Base Platform installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2020 CPU advisory.

  - Vulnerability in the Enterprise Manager Base Platform     product of Oracle Enterprise Manager (component:
    Enterprise Manager Install (jackson-databind)).
    Supported versions that are affected are 13.3.0.0 and     13.4.0.0. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to     compromise Enterprise Manager Base Platform. Successful     attacks of this vulnerability can result in takeover of     Enterprise Manager Base Platform. CVSS 3.1 Base Score     9.8 (Confidentiality, Integrity and Availability     impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
    (CVE-2020-9546)

  - Vulnerability in the Enterprise Manager Base Platform     product of Oracle Enterprise Manager (component:
    Reporting Framework (Apache Struts 2)). Supported     versions that are affected are 13.3.0.0 and 13.4.0.0.
    Difficult to exploit vulnerability allows     unauthenticated attacker with network access via HTTP to     compromise Enterprise Manager Base Platform. Successful     attacks of this vulnerability can result in takeover of     Enterprise Manager Base Platform. CVSS 3.1 Base Score     8.1 (Confidentiality, Integrity and Availability     impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
    (CVE-2018-11776)

  - Vulnerability in the Enterprise Manager Base Platform     product of Oracle Enterprise Manager (component:
    Application Service Level Mgmt (Apache Axis)). Supported     versions that are affected are 12.1.0.5 and 13.3.0.0.
    Difficult to exploit vulnerability allows     unauthenticated attacker with access to the physical     communication segment attached to the hardware where the     Enterprise Manager Base Platform executes to compromise     Enterprise Manager Base Platform. Successful attacks of     this vulnerability can result in takeover of Enterprise     Manager Base Platform. CVSS 3.1 Base Score 7.5     (Confidentiality, Integrity and Availability impacts).
    CVSS Vector:
    (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
    (CVE-2019-0227)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle Application Testing Suite installed on the remote host is affected by a Server Side Request Forgery (SSRF) vulnerability in the Oracle FLEXCUBE Private Banking product of Oracle Financial Services Applications (component: Core (Apache Axis)). The supported versions which are affected are 12.0 and 12.1. This is a difficult to exploit vulnerability which allows an unauthenticated, adjacent attacker with access to the physical segment attached to the hardware where Oracle FLEXCUBE Private Banking executes to compromise Oracle FLEXCUBE Private Banking in order to take it over.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Oracle Primavera Unifier installation running on the remote web server is 16.1.x or 16.2.x prior to 16.2.16.0, or 17.7.x through 17.12.x prior to 17.12.11.2, or 18.8.x prior to 18.8.15, or 19.12.x prior to 19.12.0.1. It is, therefore, affected by multiple vulnerabilities:

  - A Polymorphic Typing issue was discovered in FasterXML     jackson-databind before 2.9.10 used in Primavera Unifier.
    (CVE-2019-14540)

  - A memory exhaustion flaw exists in Apache Tika's RecursiveParserWrapper     versions 1.7 - 1.21 used in Primavera Unifier. (CVE-2019-10088)

  - A Server Side Request Forgery (SSRF) vulnerability affected the     Apache Axis 1.4 distribution that was last released in 2006. Security     and bug commits commits continue in the projects Axis 1.x Subversion     repository, legacy users are encouraged to build from source. The     successor to Axis 1.x is Axis2, the latest version is 1.7.9 and is     not vulnerable to this issue. (CVE-2019-0227)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle Secure Global Desktop installed on the remote host is missing a security patch from the January 2020 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilities:

  - A remote code execution vulnerability exists in the Core (Apache Axis) component. An unauthenticated,     adjacent attacker can exploit this issue, to execute arbitrary commands. (CVE-2019-0227)

  - A cross-site scripting vulnerability exists in the Web Server (Appache HTTPD Server) component. An     unauthenticated, remote attacker can exploit this issue via causing the link on the mod_proxy error page     to be malformed and point to a page of the attacker's choice. (CVE-2019-10092)

  - A cross-site scripting vulnerability exists in faces/context/PartialViewContextImpl.java in Eclipse     (Mojarra) due to mishandling of a client window field. An unauthenticated, remote attacker can exploit     this issue, to perform unauthorized update, insert or delete access to some of Oracle Communications     Unified Inventory Management accessible data as well as to perform an unauthorized read access to a subset     of Oracle Communications Unified Inventory Management accessible data. (CVE-2019-17091)

The version of Oracle Tuxedo installed on the remote host is missing a security patch. It is, therefore, affected by a remote code execution vulnerability due to a Server Side Request Forgery (SSRF) vulnerability found in the Apache Axis 1.4 distribution used in the TX SALT component.

According to its self-reported version number, the Oracle Primavera Gateway installation running on the remote web server is 15.x prior to 15.2.18, 16.x prior to 16.2.11, 17.x prior to 17.12.6, or 18.x prior to 18.8.8.1. It is, therefore, affected by multiple vulnerabilities, including the following:

  - Two Polymorphic Typing issues present in FasterXML jackson-databind related to     com.zaxxer.hikari.HikariDataSource which can be exploited by remote, unauthenticated attackers.
    (CVE-2019-16335, CVE-2019-14540)

  - A man-in-the-middle vulnerability caused by the getCN function in Apache Axis not properly verifying that     the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of     the X.509 certificate. An unauthenticated, remote attacker can exploit this to spoof SSL servers via a     certificate with a subject that specifies a common name in a field that is not a CN field. (CVE-2014-3596)

  - A Server Side Request Forgery (SSRF) vulnerability in Apache Axis that can be exploited by an     unauthenticated, remote attacker. (CVE-2019-0227)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
199650	RHEL 5 : axis (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
199604	RHEL 6 : axis (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
193868	IBM Cognos Analytics 11.1.1 < 11.1.7 FP8 / 11.2.x < 11.2.4 FP3 / 12.0.x < 12.0.2 (7123154)	Nessus	CGI abuses	critical
178711	Oracle Business Intelligence Enterprise Edition (July 2023 CPU)	Nessus	Misc.	critical
164340	Oracle Business Intelligence Publisher (Jul 2022 CPU)	Nessus	Misc.	high
138564	Oracle WebCenter Portal Multiple Vulnerabilities (Jul 2020 CPU)	Nessus	Misc.	critical
138555	Oracle Enterprise Manager Cloud Control (Jul 2020 CPU)	Nessus	Misc.	critical
135681	Oracle Application Testing Suite (Apr 2020 CPU)	Nessus	Misc.	high
133359	Oracle Primavera Unifier Multiple Vulnerabilities (Jan 2020 CPU)	Nessus	CGI abuses	critical
133042	Oracle Secure Global Desktop Multiple Vulnerabilities (January 2020 CPU)	Nessus	Misc.	high
133041	Oracle Tuxedo Remote Code Execution Vulnerability (Jan 2020 CPU)	Nessus	Misc.	high
132936	Oracle Primavera Gateway Multiple Vulnerabilities (Jan 2020 CPU)	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2019-0227

high

Tenable Plugins

high

high

critical

critical

high

critical

critical

high

critical

high

high

critical