initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3247 advisory.

    The ovirt-engine package provides the Red Hat Virtualization Manager, a     centralized management platform that allows system administrators to view and manage virtual machines. The     Manager provides a comprehensive range of features including search capabilities, resource management,     live migrations, and virtual infrastructure provisioning.

    The Manager is a JBoss Application Server application that provides several interfaces through which the     virtual environment can be accessed and interacted with, including an Administration Portal, a VM Portal,     and a Representational State Transfer (REST) Application Programming Interface (API).

    A list of bugs fixed in this update is available in the Technical Notes     book:

    https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.4/html-single/technical_notes

    Security Fix(es):

    * apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default     (CVE-2019-10086)

    * libquartz: XXE attacks via job description (CVE-2019-13990)

    * novnc: XSS vulnerability via the messages propagated to the status field (CVE-2017-18635)

    * bootstrap: XSS in the tooltip or popover data-template attribute (CVE-2019-8331)

    * nimbus-jose-jwt: Uncaught exceptions while parsing a JWT (CVE-2019-17195)

    * ovirt-engine: response_type parameter allows reflected XSS (CVE-2019-19336)

    * nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a     constructor or __proto__ payload (CVE-2020-7598)

    * ovirt-engine: Redirect to arbitrary URL allows for phishing (CVE-2020-10775)

    * Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)

    * jQuery: passing HTML containing <option> elements to manipulation methods could result in untrusted code     execution (CVE-2020-11023)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 12.2.1.4.0 versions of Identity Manager installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2024 CPU advisory.

  - Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Third Party     (Quartz)). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager. Successful     attacks of this vulnerability can result in takeover of Oracle Identity Manager. (CVE-2019-13990)

  - Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Third Party     (jackson-databind)). The supported version that is affected is 12.2.1.4.0. Difficult to exploit     vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Identity     Manager executes to compromise Oracle Identity Manager. Successful attacks of this vulnerability can     result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle     Identity Manager. (CVE-2023-35116)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Atlassian JIRA Service Desk Server running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-14401 advisory.

  - XXE (XML External Entity Injection) in Jira Service Management Data Center and Server - CVE-2019-13990     (CVE-2019-13990)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle Business Intelligence Enterprise Edition 12.2.1.4 installed on the remote host are affected by a vulnerability as referenced in the July 2023 CPU advisory. 

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Analytics Server (Apache Hive)). Supported versions that are affected are 6.4.0.0.0,     7.0.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network     access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of     this vulnerability can result in unauthorized creation, deletion or modification access to critical data     or all Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized access to     critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data.
    (CVE-2018-1282)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Framework (Quartz)). The supported version that is affected is 12.2.1.4.0. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business     Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in takeover of     Oracle Business Intelligence Enterprise Edition. (CVE-2019-13990)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Analytics Web Answers (Apache Commons FileUpload)). The supported version that is affected is     12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of     Oracle Business Intelligence Enterprise Edition. (CVE-2023-24998)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Oracle WebCenter Sites component of Oracle Fusion Middleware is affected by multiple vulnerabilities.

  - Component: WebCenter Sites (Terracotta Quartz Scheduler)). The supported   versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable   vulnerability allows unauthenticated attacker with network access via HTTP to   compromise Oracle WebCenter Sites. Successful attacks of this vulnerability   can result in takeover of Oracle WebCenter Sites. (CVE-2019-13990)

  - Component: WebCenter Sites (XStream)). The supported versions that are   affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability   allows low privileged attacker with network access via HTTP to compromise   Oracle WebCenter Sites. Successful attacks of this vulnerability can result   in takeover of Oracle WebCenter Sites. (CVE-2021-29505)

  - Component: WebCenter Sites (dojo)). The supported versions that are   affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability   allows unauthenticated attacker with network access via HTTP to compromise   Oracle WebCenter Sites. Successful attacks of this vulnerability can result   in unauthorized creation, deletion or modification access to critical data or   all Oracle WebCenter Sites accessible data. (CVE-2020-5258)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version

The 12.4.0.0 versions of Enterprise Manager Ops Center installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2020 CPU advisory.

  - A XML external entity injection (XXE) vulnerability in the Agent Provisioning (Quartz Scheduler) component of the     Enterprise Manager Ops Center product. The easily exploitable vulnerability allows an unauthenticated attacker with     network access via HTTP to compromise Enterprise Manager Ops Center. Successful attacks of this vulnerability can     result in takeover of Enterprise Manager Ops Center. (CVE-2019-13990)

  - A jQuery vulnerability in the Reports in Ops Center compontent of the Enterprise Manager Ops Center product. The     easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Enterprise Manager Ops Center. Successful attacks require human interaction from a person other than the attacker     and attacks may significantly impact additional products. This can result in unauthorized update, insert or delete     access to some of Enterprise Manager Ops Center accessible data as well as unauthorized read access to a subset of     Enterprise Manager Ops Center accessible data. (CVE-2020-11022)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2020 CPU advisory.

  - Vulnerability in the MapViewer (Apache Commons     FileUpload) component of Oracle Database Server.
    Supported versions that are affected are 12.2.0.1, 18c     and 19c. Easily exploitable vulnerability allows low     privileged attacker having Valid User Account privilege     with network access via HTTP to compromise MapViewer     (Apache Commons FileUpload). Successful attacks of this     vulnerability can result in takeover of MapViewer     (Apache Commons FileUpload). Note: MapViewer is not     deployed with a default installation. To use MapViewer     the customer needs to re-deploy MapViewer EAR file into     Oracle WebLogic Server. CVSS 3.1 Base Score 8.8     (Confidentiality, Integrity and Availability impacts).
    (CVE-2016-1000031)

  - Vulnerability in the Java VM component of Oracle     Database Server. Supported versions that are affected     are 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c and 19c. Difficult     to exploit vulnerability allows low privileged attacker     having Create Session, Create Procedure privilege with     network access via multiple protocols to compromise Java     VM. Successful attacks require human interaction from a     person other than the attacker and while the     vulnerability is in Java VM, attacks may significantly     impact additional products. Successful attacks of this     vulnerability can result in takeover of Java VM. CVSS     3.1 Base Score 8.0 (Confidentiality, Integrity and     Availability impacts). (CVE-2020-2968)

  - Vulnerability in the Core RDBMS (zlib) component of     Oracle Database Server. The supported version that is     affected is 18c. Easily exploitable vulnerability allows     high privileged attacker having Create Session privilege     with network access via Oracle Net to compromise Core     RDBMS (zlib). Successful attacks of this vulnerability     can result in takeover of Core RDBMS (zlib). CVSS 3.1     Base Score 7.2 (Confidentiality, Integrity and     Availability impacts).(CVE-2016-9843)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the CPUApr2020 advisory.

  - initDocumentParser in     xml/XMLSchedulingDataProcessor.java in Terracotta Quartz     Scheduler through 2.3.0 allows XXE attacks via a job     description. (CVE-2019-13990)

  - A Polymorphic Typing issue was discovered in FasterXML     jackson-databind 2.0.0 through 2.9.10. When Default     Typing is enabled (either globally or for a specific     property) for an externally exposed JSON endpoint and     the service has the p6spy (3.8.6) jar in the classpath,     and an attacker can find an RMI service endpoint to     access, it is possible to make the service execute a     malicious payload. This issue exists because of     com.p6spy.engine.spy.P6DataSource mishandling.
    (CVE-2019-16943)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
210560	RHEL 8 : RHV Manager (ovirt-engine) 4.4 (RHSA-2020:3247)	Nessus	Red Hat Local Security Checks	critical
193693	Oracle Identity Manager (Apr 2024 CPU)	Nessus	Misc.	critical
183513	Atlassian JIRA Service Desk < 4.20.26 / 5.4.x < 5.4.10 / 5.5.x < 5.7.2 / 5.8.x < 5.8.2 / 5.9.x < 5.9.2 / 5.10.x < 5.10.1 (JSDSERVER-14401)	Nessus	Misc.	critical
178711	Oracle Business Intelligence Enterprise Edition (July 2023 CPU)	Nessus	Misc.	critical
154418	Oracle WebCenter Sites Multiple Vulnerabilities (Oct 2021 CPU)	Nessus	Windows	critical
152772	Oracle Enterprise Manager Ops Center (Oct 2020 CPU)	Nessus	Misc.	critical
138528	Oracle Database Server Multiple Vulnerabilities (Jul 2020 CPU)	Nessus	Databases	critical
135584	Oracle Primavera Unifier (Apr 2020 CPU)	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2019-13990

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical