The 3.7.1.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0 versions of Coherence installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2022 CPU advisory.

  - Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported     versions that are affected are 3.7.1.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable     vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle     Coherence. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of Oracle Coherence. (CVE-2022-21570)

  - Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Centralized     Thirdparty Jars (jackson-databind)). The supported version that is affected is 14.1.1.0.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized ability to cause     a hang or frequently repeatable crash (complete DOS) of Oracle Coherence. (CVE-2020-36518)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle WebLogic Server installed on the remote host is missing a security patch from the July 2022 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilities, including:

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Third Party     Tools, Samples (Spring Framework)). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and     14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of     Oracle WebLogic Server. (CVE-2022-22965)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized     Third Party Jars (OWASP Enterprise Security API)). Supported versions that are affected are 12.2.1.3.0,     12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network     access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result     in takeover of Oracle WebLogic Server. (CVE-2022-23457)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized     Third Party Jars (Apache Maven)). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0.
    Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to     compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized     creation, deletion or modification access to critical data or all Oracle WebLogic Server accessible data     as well as unauthorized access to critical data or complete access to all Oracle WebLogic Server     accessible data. (CVE-2021-26291)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Primavera Gateway installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2022 CPU advisory.

  - Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component:
    Admin (jackson-databind)). Supported versions that are affected are 17.12.0-17.12.11, 18.8.0-18.8.14,     19.12.0-19.12.13, 20.12.0-20.12.8 and 21.12.0-21.12.1. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Primavera Gateway. Successful attacks     of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash     (complete DOS) of Primavera Gateway. (CVE-2020-36518)

  - Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component:
    Admin (Apache Xerces-J)). Supported versions that are affected are 17.12.0-17.12.11, 18.8.0-18.8.14,     19.12.0-19.12.13 and 20.12.0-20.12.8. Easily exploitable vulnerability allows unauthenticated attacker     with network access via HTTP to compromise Primavera Gateway. Successful attacks require human interaction     from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized     ability to cause a hang or frequently repeatable crash (complete DOS) of Primavera Gateway.
    (CVE-2022-23437)

  - Security-in-Depth issue in the Primavera Gateway product of Oracle Construction and Engineering     (component: Admin (Spring Framework)). This vulnerability cannot be exploited in the context of this     product. (CVE-2022-22965)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of MySQL Server installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2022, October 2022 and January 2023 CPU advisories.

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Packaging (OpenSSL)).
    Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise MySQL Server.
    Successful attacks of this vulnerability can result in takeover of MySQL Server. (CVE-2022-1292)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Packaging (cURL)). Supported     versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks require     human interaction from a person other than the attacker. Successful attacks of this vulnerability can result     in unauthorized creation, deletion or modification access to critical data or all MySQL Server accessible     data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL     Server. (CVE-2022-27778)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Compiling (zlib)). Supported     versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of     this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash     (complete DOS) of MySQL Server. (CVE-2018-25032)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 12.1.0.2, 19c, 21c, All Supported Versions, and None versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2022 CPU advisory.

  - Vulnerability in the Oracle Database - Enterprise Edition Sharding component of Oracle Database Server.
    For supported versions that are affected see note. Easily exploitable vulnerability allows low privileged     attacker having Local Logon privilege with logon to the infrastructure where Oracle Database - Enterprise     Edition Sharding executes to compromise Oracle Database - Enterprise Edition Sharding. While the     vulnerability is in Oracle Database - Enterprise Edition Sharding, attacks may significantly impact     additional products (scope change). Successful attacks of this vulnerability can result in takeover of     Oracle Database - Enterprise Edition Sharding. (CVE-2022-21510)

  - Vulnerability in the Oracle Database - Enterprise Edition Recovery component of Oracle Database Server. For     supported versions that are affected see note. Easily exploitable vulnerability allows high privileged     attacker having EXECUTE ON DBMS_IR.EXECUTESQLSCRIPT privilege with network access via Oracle Net to compromise Oracle     Database - Enterprise Edition Recovery. Successful attacks of this vulnerability can result in takeover of     Oracle Database - Enterprise Edition Recovery. Note: None of the supported versions are affected. (CVE-2022-21511)

  - Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are     12.1.0.2, 19c and 21c. Easily exploitable vulnerability allows low privileged attacker having Create Procedure     privilege with network access via Oracle Net to compromise Java VM. Successful attacks of this vulnerability     can result in unauthorized creation, deletion or modification access to critical data or all Java VM accessible     data. (CVE-2022-21565)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of MySQL Server installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2022 CPU advisory.

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Packaging (OpenSSL)).
    Supported versions that are affected are 5.7.38 and prior. Easily exploitable vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise MySQL Server.
    Successful attacks of this vulnerability can result in takeover of MySQL Server. (CVE-2022-1292)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Packaging (cURL)). Supported     versions that are affected are 5.7.38 and prior. Easily exploitable vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks require     human interaction from a person other than the attacker. Successful attacks of this vulnerability can result     in unauthorized creation, deletion or modification access to critical data or all MySQL Server accessible     data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL     Server. (CVE-2022-27778)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Compiling (zlib)). Supported     versions that are affected are 5.7.38 and prior. Easily exploitable vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of     this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash     (complete DOS) of MySQL Server. (CVE-2018-25032)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Primavera Unifier installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2022 CPU advisory.

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Document     Management (jackson-databind)). Supported versions that are affected are 17.7-17.12, 18.8, 19.12, 20.12     and 21.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Primavera Unifier. Successful attacks of this vulnerability can result in unauthorized     ability to cause a hang or frequently repeatable crash (complete DOS) of Primavera Unifier.
    (CVE-2020-36518)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component:
    Platform, User Interface (Apache Xerces-J)). Supported versions that are affected are 17.7-17.12, 18.8,     19.12, 20.12 and 21.12. Easily exploitable vulnerability allows unauthenticated attacker with network     access via HTTP to compromise Primavera Unifier. Successful attacks require human interaction from a     person other than the attacker. Successful attacks of this vulnerability can result in unauthorized     ability to cause a hang or frequently repeatable crash (complete DOS) of Primavera Unifier. (CVE-2022-23437)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Document     Management (Apache Tika)). Supported versions that are affected are 17.7-17.12, 18.8, 19.12, 20.12 and     21.12. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure     where Primavera Unifier executes to compromise Primavera Unifier. Successful attacks require human     interaction from a person other than the attacker. Successful attacks of this vulnerability can result in     unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Primavera Unifier.
    (CVE-2022-30126)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle WebCenter Portal installed on the remote host is missing a security patch from the July 2022 Critical Patch Update (CPU). It is, therefore, affected a remote code execution vulnerability:

 - Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security    Framework (XStream)). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily    exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle    WebCenter Portal. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter    Portal. (CVE-2021-39139)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Oracle E-Business Suite installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2022 CPU advisory.

  - Vulnerability in the Oracle E-Business Suite Information Discovery product of Oracle E-Business Suite     (component: Packaging issues (Apache Log4j)). Supported versions that are affected are 12.2.3-12.2.11. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle     E-Business Suite Information Discovery. Successful attacks of this vulnerability can result in takeover of Oracle     E-Business Suite Information Discovery. (CVE-2022-23305)

  - Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component:
    Diagnostics). Supported versions that are affected are 12.2.9-12.2.11. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Oracle Applications Framework. Successful attacks     of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle     Applications Framework accessible data. (CVE-2022-21566)

  - Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Worklist). Supported     versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker     with network access via HTTP to compromise Oracle Workflow. Successful attacks of this vulnerability can result     in unauthorized access to critical data or complete access to all Oracle Workflow accessible data. (CVE-2022-21567)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle Business Intelligence Publisher running on the remote host is 12.2.1.3.x prior to 12.2.1.3.220628, 12.2.1.4.x prior to 12.2.1.3.220628, It is, therefore, affected by multiple vulnerabilities as noted in the July 2022 Critical Patch Update advisory, including the following:

  - Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: BI Publisher Security     (Apache Axis)). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Difficult to exploit     vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the     hardware where the Oracle BI Publisher executes to compromise Oracle BI Publisher. Successful attacks of this     vulnerability can result in takeover of Oracle BI Publisher. (CVE-2019-0227)

  - Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: BI Publisher Security).     Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows low     privileged attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks of this     vulnerability can result in unauthorized read access to a subset of Oracle BI Publisher accessible data.
    (CVE-2022-21523)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 5.9.0.0.0 and All Supported Versions versions of Oracle Business Intelligence Enterprise Edition (OAS) installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2022 CPU advisory.

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware     (component: Service Administration UI (JQuery)). The supported version that is affected is 5.9.0.0.0.
    Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to     compromise Oracle Business Intelligence Enterprise Edition. Successful attacks require human interaction     from a person other than the attacker and while the vulnerability is in Oracle Business Intelligence     Enterprise Edition, attacks may significantly impact additional products (scope change). Successful     attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle     Business Intelligence Enterprise Edition accessible data as well as unauthorized read access to a subset     of Oracle Business Intelligence Enterprise Edition accessible data. (CVE-2020-11023)

  - Security-in-Depth issue in the Oracle BI Publisher product of Oracle Fusion Middleware (component: Web Service     API (Spring Framework)). This vulnerability cannot be exploited in the context of this product.
    (CVE-2022-22965)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 12.4.0.0 versions of Enterprise Manager Ops Center installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2022 CPU advisory.

  - Vulnerability in the Enterprise Manager Ops Center product of Oracle Enterprise Manager (component:
    Networking (Apache HTTP Server)). The supported version that is affected is 12.4.0.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Enterprise Manager Ops Center. Successful attacks of this vulnerability can result in takeover     of Enterprise Manager Ops Center. (CVE-2022-22721)

  - Vulnerability in the Enterprise Manager Ops Center product of Oracle Enterprise Manager (component:     Networking (OpenSSL)). The supported version that is affected is 12.4.0.0. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Enterprise     Manager Ops Center. Successful attacks of this vulnerability can result in takeover of Enterprise     Manager Ops Center. (CVE-2022-1292)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 13.4.0.0 and 13.5.0.0 versions of Enterprise Manager Base Platform installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2022 CPU advisory.

  - Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component:
    Enterprise Manager Install). Supported versions that are affected are 13.4.0.0 and 13.5.0.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Enterprise Manager Base Platform accessible data as well as     unauthorized read access to a subset of Enterprise Manager Base Platform accessible data and unauthorized     ability to cause a partial denial of service (partial DOS) of Enterprise Manager Base Platform.     (CVE-2022-21516)     
  - Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component:
    Policy Framework). Supported versions that are affected are 13.4.0.0 and 13.5.0.0. Difficult to exploit     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Enterprise     Manager Base Platform. Successful attacks of this vulnerability can result in takeover of Enterprise     Manager Base Platform. (CVE-2022-21536)

  - Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component:     Enterprise Manager Install (AntiSamy)). Supported versions that are affected are 13.4.0.0 and 13.5.0.0.     Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to     compromise Enterprise Manager Base Platform. Successful attacks require human interaction from a person     other than the attacker and while the vulnerability is in Enterprise Manager Base Platform, attacks may     significantly impact additional products (scope change). Successful attacks of this vulnerability can     result in unauthorized update, insert or delete access to some of Enterprise Manager Base Platform     accessible data as well as unauthorized read access to a subset of Enterprise Manager Base Platform     accessible data. (CVE-2022-29577)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Primavera P6 Enterprise Project Portfolio Management installed on the remote host are affected by a vulnerability as referenced in the July 2022 CPU advisory.

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized     Third Party Jars (jackson-databind)). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and     14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized     ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
163401	Oracle Coherence (Jul 2022 CPU)	Nessus	Misc.	7/22/2022	10/24/2023	high
163298	Oracle WebLogic Server (Jul 2022 CPU)	Nessus	Misc.	7/20/2022	1/4/2024	critical
163328	Oracle Primavera Gateway (Jul 2022 CPU)	Nessus	CGI abuses	7/21/2022	10/24/2023	critical
163332	Oracle MySQL Server (Jul 2022 CPU)	Nessus	Databases	7/21/2022	11/1/2023	critical
163408	Oracle Database Server (Jul 2022 CPU)	Nessus	Databases	7/22/2022	10/31/2024	critical
163333	Oracle MySQL Server (Jul 2022 CPU)	Nessus	Databases	7/21/2022	11/1/2023	critical
163289	Oracle Primavera Unifier (Jul 2022 CPU)	Nessus	CGI abuses	7/20/2022	10/23/2024	high
163288	Oracle WebCenter Portal RCE (Jul 2022 CPU)	Nessus	Misc.	7/20/2022	12/30/2022	high
163411	Oracle E-Business Suite (Jul 2022 CPU)	Nessus	Misc.	7/22/2022	10/17/2023	critical
164340	Oracle Business Intelligence Publisher (Jul 2022 CPU)	Nessus	Misc.	8/23/2022	10/13/2023	high
164159	Oracle Business Intelligence Publisher (OAS) (Jul 2022 CPU)	Nessus	Misc.	8/17/2022	1/18/2023	critical
163406	Oracle Enterprise Manager Ops Center (Jul 2022 CPU)	Nessus	Misc.	7/22/2022	10/17/2023	critical
163405	Oracle Enterprise Manager Cloud Control (Jul 2022 CPU)	Nessus	Misc.	7/22/2022	10/17/2023	high
165694	Oracle Primavera P6 Enterprise Project Portfolio Management (Jul 2022 CPU)	Nessus	CGI abuses	10/5/2022	10/23/2024	high

Detections

Analytics

Plugins Search

high

critical

critical

critical

critical

critical

high

high

critical

high

critical

critical

high

high