Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.21 before 1.26. Users are recommended to upgrade to version 1.26, which fixes the issue.

The version of Oracle Business Intelligence Enterprise Edition (OAS) 7.0.0.0 installed on the remote host is affected by multiple vulnerabilities as referenced in the October 2024 CPU advisory, including the following:

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Analytics Server (OpenSSL)). Supported versions that are affected are 7.0.0.0.0 and     7.6.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS     to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability     can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Business     Intelligence Enterprise Edition. (CVE-2023-5678)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Analytics Server (curl)). Supported versions that are affected are 7.0.0.0.0, 7.6.0.0.0     and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via     SOCKS5 to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this     vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. (CVE-2023-38545)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: BI Platform Security, Analytics Web Answers (RequireJS)). Supported versions that are     affected are 7.0.0.0.0, 7.6.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated     attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.     Successful attacks of this vulnerability can result in unauthorized access to critical data or complete     access to all Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized     update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible     data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Business     Intelligence Enterprise Edition. (CVE-2024-38999)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Oracle Application Testing Suite installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2024 CPU advisory.

  - Vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager (component:
    Load Testing for Web Apps (Apache Commons Compress)). The supported version that is affected is 13.3.0.1.
    Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where     Oracle Application Testing Suite executes to compromise Oracle Application Testing Suite. Successful     attacks require human interaction from a person other than the attacker. Successful attacks of this     vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete     DOS) of Oracle Application Testing Suite. (CVE-2023-42503, CVE-2024-26308, CVE-2024-25710)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 13.5.0.0 versions of Enterprise Manager Base Platform installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2024 CPU advisory.

  - Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager     (component: Agent Next Gen (BSAFE Crypto-J)). The supported version that is affected is 13.5.0.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in takeover     of Oracle Enterprise Manager Base Platform. (CVE-2022-34381)

  - Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager     (component: Agent Next Gen (Eclipse Jetty)). The supported version that is affected is 13.5.0.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise     Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in     unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Enterprise     Manager Base Platform. (CVE-2024-22201)

  - Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager     (component: Job System (Netty)). The supported version that is affected is 13.5.0.0. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Enterprise     Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized ability to     cause a partial denial of service (partial DOS) of Oracle Enterprise Manager Base Platform.
    (CVE-2024-29025)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 12.2.1.4.0 and 14.1.1.0.0 versions of WebLogic Server installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2024 CPU advisory:

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported     versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated     attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this     vulnerability can result in takeover of Oracle WebLogic Server. (CVE-2024-21181) 

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported     versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated     attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this     vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle     WebLogic Server accessible data. (CVE-2024-21175)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported     versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated     attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this     vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server     accessible data. (CVE-2024-21182)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle Essbase installed on the remote host is missing a security patch from the July 2024 Critical Patch Update (CPU). It is, therefore, affected by:

  - Vulnerability in Oracle Essbase (component: Essbase Web Platform (Apache Xerces-C++)). The supported version that     is affected is 21.5.6. Easily exploitable vulnerability allows high privileged attacker with logon to the     infrastructure where Oracle Essbase executes to compromise Oracle Essbase. Successful attacks of this     vulnerability can result in takeover of Oracle Essbase. (CVE-2023-37536)

  - Vulnerability in Oracle Essbase (component: Essbase Web Platform (Apache Commons Compress)). The supported version     that is affected is 21.5.6. Easily exploitable vulnerability allows unauthenticated attacker with logon to the     infrastructure where Oracle Essbase executes to compromise Oracle Essbase. Successful attacks require human     interaction from a person other than the attacker. Successful attacks of this vulnerability can result in     unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Essbase.
    (CVE-2024-26308)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 12.2.1.4.0 versions of WebCenter Portal installed on the remote host are affected by a vulnerability as referenced in the July 2024 CPU advisory.

  - Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portal Core (Apache     SOAP)). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal. Successful attacks of     this vulnerability can result in takeover of Oracle WebCenter Portal. (CVE-2022-45378)

  - Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Discussion Forums     (JSON-java)). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal. Successful attacks     of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete     DOS) of Oracle WebCenter Portal. (CVE-2023-5072)

  - Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework     (Apache Commons Compress)). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability     allows unauthenticated attacker with logon to the infrastructure where Oracle WebCenter Portal executes to     compromise Oracle WebCenter Portal. Successful attacks require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of Oracle WebCenter Portal. (CVE-2024-26308) 

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The versions of Primavera Gateway installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2024 CPU advisory.

  - Denial of Service in JSON-Java versions up to and including 20230618. A bug in the parser means that an     input string of modest size can lead to indefinite amounts of memory being used. (CVE-2023-5072)

  - Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress. This issue     affects Apache Commons Compress: from 1.21 before 1.26. Users are recommended to upgrade to version 1.26,     which fixes the issue. (CVE-2024-26308)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Primavera Unifier installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2024 CPU advisory.

  - The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation     can reset many streams quickly, as exploited in the wild in August through October 2023. (CVE-2023-44487)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Document     Management (Apache Solr)). Supported versions that are affected are 19.12.0-19.12.16, 20.12.0-20.12.16,     21.12.0-21.12.17, 22.12.0-22.12.12 and 23.12.0-23.12.3. Easily exploitable vulnerability allows low     privileged attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks of     this vulnerability can result in unauthorized update, insert or delete access to some of Primavera     Unifier accessible data as well as unauthorized read access to a subset of Primavera Unifier accessible     data and unauthorized ability to cause a partial denial of service (partial DOS) of Primavera Unifier.
    (CVE-2023-50298)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Document     Management (Apache Solr)). Supported versions that are affected are 19.12.0-19.12.16, 20.12.0-20.12.16,     21.12.0-21.12.17, 22.12.0-22.12.12 and  23.12.0-23.12.3. Easily exploitable vulnerability allows low     privileged attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks of     this vulnerability can result in unauthorized update, insert or delete access to some of Primavera     Unifier accessible data as well as unauthorized read access to a subset of Primavera Unifier accessible     data and unauthorized ability to cause a partial denial of service (partial DOS) of Primavera Unifier.
    (CVE-2023-50386)

  - Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress. This     issue affects Apache Commons Compress: from 1.3 through 1.25.0. Users are recommended to upgrade to     version 1.26.0 which fixes the issue. (CVE-2024-25710)

  - Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress. This issue     affects Apache Commons Compress: from 1.21 before 1.26. Users are recommended to upgrade to version 1.26,     which fixes the issue. (CVE-2024-26308)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 12.2.1.4.0 and 14.1.1.0.0 versions of WebLogic Server installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2024 CPU advisory:

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Samples (handlebars)).     Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows \     unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of     this vulnerability can result in takeover of Oracle WebLogic Server. (CVE-2021-23369)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized Thirdparty     Jars (Bouncy Castle Java Library)). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise     Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset     of Oracle WebLogic Server accessible data. (CVE-2023-2976)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). The     supported version that is affected is 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker     with network access via HTTP/2 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can     result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic     Server. (CVE-2023-44487)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0726-1 advisory.

  - Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress.This issue     affects Apache Commons Compress: from 1.3 through 1.25.0. Users are recommended to upgrade to version     1.26.0 which fixes the issue. (CVE-2024-25710)

  - Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue     affects Apache Commons Compress: from 1.21 before 1.26. Users are recommended to upgrade to version 1.26,     which fixes the issue. (CVE-2024-26308)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
210338	Oracle Business Intelligence Enterprise Edition (OAS 7.0) (October 2024 CPU)	Nessus	Misc.	critical
209387	Oracle Application Testing Suite (October 2024 CPU)	Nessus	Misc.	medium
209256	Oracle Enterprise Manager Cloud Control (October 2024 CPU)	Nessus	Misc.	critical
202722	Oracle WebLogic Server (July 2024 CPU)	Nessus	Misc.	critical
202719	Oracle Essbase Multiple Vulnerabilities (July 2024 CPU)	Nessus	Misc.	high
202598	Oracle WebCenter Portal (July 2024 CPU)	Nessus	Misc.	critical
193486	Oracle Primavera Gateway (April 2024 CPU)	Nessus	CGI abuses	high
193436	Oracle Primavera Unifier (April 2024 CPU)	Nessus	CGI abuses	high
193425	Oracle WebLogic Server (April 2024 CPU)	Nessus	Misc.	critical
191447	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : Java (SUSE-SU-2024:0726-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2024-26308

medium

Tenable Plugins

critical

medium

critical

critical

high

critical

high

high

critical

medium