The version of Oracle WebLogic Server installed on the remote host is affected by multiple vulnerabilities:

  - An unspecified vulnerability allows a remote unauthenticated     attacker with network access to compromise and takeover the     StorageTek Tape Analytics SW Tool. (CVE-2019-2725) (CVE-2019-2729)

  - An unspecified vulnerability allows a remote unauthenticated     attacker with network access to compromise and takeover the     Tape Virtual Storage Manager GUI. (CVE-2019-2725)

  - An unspecified vulnerability in the WLS Core Component allows an     authenticated low privileged attacker with network     access via HTTP to compromise Oracle WebLogic Server, resulting     in unauthorized update, insert or delete access to Oracle     WebLogic Server accessible data. (CVE-2019-2824) (CVE-2019-2827)

  - An unspecified vulnerability in the jQuery Component allows an     authenticated low privileged attacker with network     access via HTTP to compromise Oracle WebLogic Server, resulting     in unauthorized update, insert or delete access to Oracle     WebLogic Server accessible data. Successful attacks require     human interaction from actions from another Weblogic user.
    (CVE-2016-71030)

  - An unspecified vulnerability in the Application Container - JavaEE     Component of Oracle WebLogic Server allows an unauthenticated     attacker with network access via T3 to compromise Oracle WebLogic     Server. A successful attack of this vulnerability could result in     takeover of Oracle WebLogic Server. (CVE-2019-2856)     
  - An unspecified vulnerability in the Sample apps (Spring Framework)     Component of Oracle WebLogic Server allows an unauthenticated     attacker with network access via HTTP to compromise Oracle WebLogic     Server. A successful attack of this vulnerability could result in     unauthorized ability to cause a hang or frequently repeatable crash     (complete DOS) of Oracle WebLogic Server. (CVE-2018-15756)

The version of Oracle WebLogic Server installed on the remote host is affected by a remote code execution vulnerability in the WLS9-async component due to unsafe deserialization of XML encoded Java objects. An unauthenticated, remote attacker can exploit this, via a crafted Java object, to execute arbitrary Java code in the context of the WebLogic server.

The remote Oracle WebLogic server is affected by a remote code execution vulnerability in the WLS9-async component due to unsafe deserialization of XML encoded Java objects. An unauthenticated, remote attacker can exploit this, via a crafted Java object, to execute arbitrary Java code in the context of the WebLogic server.

A vulnerability in Oracle WebLogic Server 10.3.6.0.0 & 12.1.3.0.0 allows an unauthenticated attacker with HTTP access to the service to obtain arbitrary code execution due to an insecure deserialization.

Oracle proposes the associated patches on its site to fix the vulnerability.

According to the version of the ksh package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - In ksh version 20120801, a flaw was found in the way it     evaluates certain environment variables. An attacker     could use this flaw to override or bypass environment     restrictions to execute shell commands. Services and     applications that allow remote unauthenticated     attackers to provide one of those environment variables     could allow them to exploit this issue     remotely.(CVE-2019-14868)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated rhn-client-tools packages that fix one security issue are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Red Hat Network Client Tools provide programs and libraries that allow your system to receive software updates from the Red Hat Network (RHN).

It was discovered that rhn-client-tools set insecure permissions on the loginAuth.pkl file, used to store session credentials for authenticating connections to Red Hat Network servers. A local, unprivileged user could use these credentials to download packages from the Red Hat Network. They could also manipulate package or action lists associated with the system's profile. (CVE-2010-1439)

Users of rhn-client-tools are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.

The gpg2 package was updated to fix the following security and non security issues :

  - CVE-2015-1606: Fixed invalid memory read using a garbled     keyring (bsc#918089).

  - CVE-2015-1607: Fixed memcpy with overlapping ranges     (bsc#918090).

  - bsc#955753: Fixed a regression of 'gpg --recv' due to     keyserver import filter (also boo#952347).

Oracle reports :

This Critical Patch Update contains 25 new security fixes for Oracle Java SE. 24 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password.

According to the version of the pidgin package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Pidgin allows you to talk to anyone using a variety of     messaging protocols including AIM, MSN, Yahoo!, Jabber,     Bonjour, Gadu-Gadu, ICQ, IRC, Novell Groupwise, QQ,     Lotus Sametime, Simple and Zephyr. These protocols are     implemented using a modular, easy to use design. To use     a protocol, just add an account using the account     editor. Pidgin supports many common features of other     clients, as well as many unique features, such as perl     scripting, TCL scripting and C plugins. Pidgin is not     affiliated with or endorsed by America Online, Inc.,     Microsoft Corporation, Yahoo! Inc., or ICQ Inc.Security     Fix(es):Pidgin version <2.11.0 contains a vulnerability     in X.509 Certificates imports specifically due to     improper check of return values from     gnutls_x509_crt_init() and gnutls_x509_crt_import()     that can result in code execution. This attack appear     to be exploitable via custom X.509 certificate from     another client.(CVE-2016-1000030)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Oracle OpenOffice.org installed on the remote host is prior to 3.2.1. It is, therefore, affected by several issues :

  - There is a TLS/SSL renegotiation vulnerability in the     included third-party OpenSSL library. (CVE-2009-3555)

  - There is a python scripting vulnerability that could     lead to undesired code execution when using the     OpenOffice scripting IDE. (CVE-2010-0395)

This update for avahi fixes the following issues :

CVE-2021-3468: avoid infinite loop by handling HUP event in client_work (bsc#1184521).

CVE-2021-26720: drop privileges when invoking avahi-daemon-check-dns.sh (bsc#1180827)

Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d.

Add sudo to requires: used to drop privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
126915	Oracle WebLogic Server Multiple Vulnerabilities (Jul 2019 CPU)	Nessus	Misc.	7/22/2019	1/4/2024	critical
124337	Oracle WebLogic Server wls9_async_response / wls-wsat Remote Code Execution	Nessus	Misc.	4/26/2019	12/5/2022	critical
124338	Oracle WebLogic WLS9-async Remote Code Execution (remote check)	Nessus	Web Servers	4/26/2019	2/12/2025	critical
112704	Oracle WebLogic 10.3.6.0.0 / 12.1.3.0.0 Remote Code Execution	Web App Scanning	Component Vulnerability	2/19/2021	9/7/2021	critical
142557	EulerOS Virtualization 3.0.6.6 : ksh (EulerOS-SA-2020-2446)	Nessus	Huawei Local Security Checks	11/6/2020	1/6/2021	high
46780	RHEL 5 : rhn-client-tools (RHSA-2010:0449)	Nessus	Red Hat Local Security Checks	6/2/2010	1/14/2021	low
87392	openSUSE Security Update : gpg2 (openSUSE-2015-886)	Nessus	SuSE Local Security Checks	12/16/2015	1/19/2021	medium
87386	FreeBSD : java -- multiple vulnerabilities (a5934ba8-a376-11e5-85e9-14dae9d210b8)	Nessus	FreeBSD Local Security Checks	12/16/2015	3/8/2022	critical
142072	EulerOS 2.0 SP5 : pidgin (EulerOS-SA-2020-2262)	Nessus	Huawei Local Security Checks	10/30/2020	2/13/2024	critical
46814	Oracle OpenOffice.org < 3.2.1 Multiple Vulnerabilities	Nessus	Windows	6/7/2010	7/16/2018	high
150267	SUSE SLES15 Security Update : avahi (SUSE-SU-2021:1845-1)	Nessus	SuSE Local Security Checks	6/4/2021	12/27/2023	high

Detections

Analytics

Plugins Search

critical

critical

critical

critical

high

low

medium

critical

critical

high

high