The version of Oracle WebLogic Server installed on the remote host is affected by multiple vulnerabilities:

  - An unspecified vulnerability in the Spring Framework allows     a low privileged, remote attacker with network access via HTTP to     compromise and takeover the Oracle Communications Unified     Inventory Management. (CVE-2018-1258)   
  - An unspecified vulnerability in the WLS Core Component allows an     authenticated low privileged attacker with network     access via HTTP to compromise Oracle WebLogic Server, resulting     in unauthorized update, insert or delete access to Oracle     WebLogic Server accessible data. (CVE-2019-2568)

  - An unspecified vulnerability in the WLS Core Component which     allows an authenticated, high privileged attacker with network     access via HTTP to compromise Oracle WebLogic Server, resulting     in unauthorized access to critical data or complete access to all     Oracle WebLogic Server accessible data. (CVE-2019-2615)

  - An unspecified vulnerability in the WLS Core Component which     allows an authenticated, high privileged attacker with network     access via HTTP to compromise Oracle WebLogic Server, resulting     in unauthorized access to critical data or complete access to all     Oracle WebLogic Server accessible data as well as unauthorized     update, insert or delete access to some of Oracle WebLogic Server     accessible data. (CVE-2019-2618)

  - An unspecified vulnerability in the WLS Core Components allows     an unauthenticated, remote attacker with network access via T3 to     compromise and takeover the Oracle WebLogic Server.     (CVE-2019-2645)

  - An unspecified vulnerability in the EJB Container allows     an unauthenticated, remote attacker with network access via T3 to     compromise and takeover the Oracle WebLogic Server.     (CVE-2019-2646)

  - An unspecified vulnerability in the WLS - Web Services which     allows an authenticated, high privileged attacker with network     access via HTTP to compromise Oracle WebLogic Server, resulting     in unauthorized access to critical data or complete access to all     Oracle WebLogic Server accessible data.  (CVE-2019-2647)     (CVE-2019-2648) (CVE-2019-2649) (CVE-2019-2650)

  - An unspecified vulnerability in the WLS Core Component allows an     authenticated low privileged attacker with network     access via HTTP to compromise Oracle WebLogic Server, resulting     in unauthorized update, insert or delete access to Oracle     WebLogic Server accessible data. (CVE-2019-2658)

Detections

Analytics

Oracle WebLogic Server Multiple Vulnerabilities (Apr 2019 CPU)

critical Nessus Plugin ID 124122

Version 1.8