jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.

The version of Oracle Business Process Management Suite installed on the remote host is affected by a vulnerability, as referenced in the October 2024 CPU advisory.

  - Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware   (component: Composer (RequireJS)). The supported version that is affected is 12.2.1.4.0. Easily exploitable   vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business   Process Management Suite. Successful attacks of this vulnerability can result in unauthorized access to   critical data or complete access to all Oracle Business Process Management Suite accessible data as well as   unauthorized update, insert or delete access to some of Oracle Business Process Management Suite accessible   data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Business Process   Management Suite. (CVE-2024-38998, CVE-2024-38999)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle Business Intelligence Enterprise Edition (OAS) 7.0.0.0 installed on the remote host is affected by multiple vulnerabilities as referenced in the October 2024 CPU advisory, including the following:

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Analytics Server (OpenSSL)). Supported versions that are affected are 7.0.0.0.0 and     7.6.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS     to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability     can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Business     Intelligence Enterprise Edition. (CVE-2023-5678)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Analytics Server (curl)). Supported versions that are affected are 7.0.0.0.0, 7.6.0.0.0     and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via     SOCKS5 to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this     vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. (CVE-2023-38545)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: BI Platform Security, Analytics Web Answers (RequireJS)). Supported versions that are     affected are 7.0.0.0.0, 7.6.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated     attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.     Successful attacks of this vulnerability can result in unauthorized access to critical data or complete     access to all Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized     update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible     data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Business     Intelligence Enterprise Edition. (CVE-2024-38999)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle Business Intelligence Enterprise Edition (OAS) 7.6.0.0 installed on the remote host is affected by multiple vulnerabilities as referenced in the October 2024 CPU advisory, including the following:

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Analytics Server (OpenSSL)). Supported versions that are affected are 7.0.0.0.0 and     7.6.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS     to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability     can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Business     Intelligence Enterprise Edition. (CVE-2023-5678)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Analytics Server (curl)). Supported versions that are affected are 7.0.0.0.0, 7.6.0.0.0     and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via     SOCKS5 to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this     vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. (CVE-2023-38545)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: BI Platform Security, Analytics Web Answers (RequireJS)). Supported versions that are     affected are 7.0.0.0.0, 7.6.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated     attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.     Successful attacks of this vulnerability can result in unauthorized access to critical data or complete     access to all Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized     update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible     data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Business     Intelligence Enterprise Edition. (CVE-2024-38999)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle Business Intelligence Enterprise Edition 12.2.1.4 installed on the remote host is affected by multiple vulnerabilities as referenced in the October 2024 CPU advisory, including the following:

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Installation, BI Platform Security (OpenSSL)). Supported versions that are affected are     7.6.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network     access via TLS to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this     vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash     (complete DOS) of Oracle Business Intelligence Enterprise Edition. (CVE-2023-0401)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Analytics Server (curl)). Supported versions that are affected are 7.0.0.0.0, 7.6.0.0.0     and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via     SOCKS5 to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this     vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. (CVE-2023-38545)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: BI Platform Security, Analytics Web Answers (RequireJS)). Supported versions that are     affected are 7.0.0.0.0, 7.6.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated     attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.     Successful attacks of this vulnerability can result in unauthorized access to critical data or complete     access to all Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized     update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible     data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Business     Intelligence Enterprise Edition. (CVE-2024-38999)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3771-1 advisory.

    - CVE-2024-38355: Fixed socket.io: unhandled 'error' event (bsc#1226967)
    - CVE-2024-38998: Fixed requirejs: prototype pollution via function config (bsc#1227248)
    - CVE-2024-38999: Fixed requirejs: prototype pollution via function s.contexts._.configure (bsc#1227252)
    - CVE-2024-39338: Fixed axios: server-side request forgery due to requests for path relative URLs being     processed as protocol relative URLs in axios (bsc#1229423)
    - CVE-2024-4067: Fixed micromatch: vulnerable to Regular Expression Denial of Service (ReDoS)     (bsc#1224366)
    - CVE-2024-4068: Fixed braces: fails to limit the number of characters it can handle, which could lead to     Memory Exhaustion (bsc#1224295)
    - CVE-2024-43788: Fixed webpack: DOM clobbering gadget in AutoPublicPathRuntimeModule could lead to XSS     (bsc#1229861)
    - CVE-2024-48948: Fixed elliptic: ECDSA signature verification error due to leading zero may reject     legitimate transactions in elliptic (bsc#1231684)
    - CVE-2024-48949: Fixed elliptic: Missing Validation in Elliptic's EDDSA Signature Verification     (bsc#1231564)
    - CVE-2024-9014: Fixed OAuth2 issue that could lead to information leak (bsc#1230928)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2024 CPU advisory.

  - Vulnerability in the Oracle Spatial and Graph (libcurl2) component of Oracle Database Server. Supported     versions that are affected are 19.3-19.24, 21.3-21.15 and 23.4-23.5. Difficult to exploit vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Oracle Spatial and Graph     (libcurl2). Successful attacks require human interaction from a person other than the attacker. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of Oracle Spatial and Graph (libcurl2). (CVE-2024-7264)

  - Vulnerability in the Oracle Database Security (OpenSSL) component of Oracle Database Server. Supported     versions that are affected are 23.4-23.5. Easily exploitable vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Oracle Database Security (OpenSSL). Successful     attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service     (partial DOS) of Oracle Database Security (OpenSSL). (CVE-2024-5535, CVE-2024-6119)

  - Vulnerability in the Fleet Patching and Provisioning - Micronaut (Netty) component of Oracle Database     Server. Supported versions that are affected are 23.4-23.5. Easily exploitable vulnerability allows low     privileged attacker having Authenticated User privilege with network access via HTTP to compromise Fleet     Patching and Provisioning - Micronaut (Netty). Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Fleet Patching and Provisioning
    - Micronaut (Netty). (CVE-2024-29025)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
210344	Oracle Business Process Management Suite (October 2024 CPU)	Nessus	Misc.	critical
210338	Oracle Business Intelligence Enterprise Edition (OAS 7.0) (October 2024 CPU)	Nessus	Misc.	critical
210337	Oracle Business Intelligence Enterprise Edition (OAS 7.6) (October 2024 CPU)	Nessus	Misc.	critical
210336	Oracle Business Intelligence Enterprise Edition (October 2024 CPU)	Nessus	Misc.	critical
209968	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : pgadmin4 (SUSE-SU-2024:3771-1)	Nessus	SuSE Local Security Checks	critical
209306	Oracle Database Server (October 2024 CPU)	Nessus	Databases	medium

Detections

Analytics

CVE-2024-38999

critical

Tenable Plugins

critical

critical

critical

critical

critical

medium