The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A     malicious server can redirect the Commons Net code to use a different host, but the user has to connect to     the malicious server in the first place. This may lead to leakage of information about services running on     the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL     does. See https://issues.apache.org/jira/browse/NET-711. (CVE-2021-37533)

Note that Nessus relies on the presence of the package as reported by the vendor.

The versions of Oracle Siebel CRM installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2023 CPU advisory.

  - Vulnerability in the Siebel CRM product of Oracle Siebel CRM (component: EAI (JSON-java)). Supported     versions that are affected are 23.5 and prior. Easily exploitable vulnerability allows unauthenticated     attacker with network access via HTTP to compromise Siebel CRM. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Siebel     CRM. (CVE-2020-15250, CVE-2022-45688)

  - Vulnerability in the Siebel CRM product of Oracle Siebel CRM (component: Siebel Core (Apache ZooKeeper)).
    Supported versions that are affected are 23.5 and prior. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Siebel CRM. Successful attacks of this     vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete     DOS) of Siebel CRM. (CVE-2020-36518, CVE-2020-9493, CVE-2021-21295, CVE-2021-37533, CVE-2022-2048,     CVE-2022-23307, CVE-2022-41915, CVE-2022-42003, CVE-2022-42004)

  - Vulnerability in the Siebel CRM product of Oracle Siebel CRM (component: UI Framework (jQueryUI)).
    Supported versions that are affected are 23.5 and prior. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Siebel CRM. Successful attacks require     human interaction from a person other than the attacker and while the vulnerability is in Siebel CRM,     attacks may significantly impact additional products (scope change). Successful attacks of this     vulnerability can result in unauthorized update, insert or delete access to some of Siebel CRM accessible     data as well as unauthorized read access to a subset of Siebel CRM accessible data. (CVE-2022-31160)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3251 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3251-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Markus Koschany     December 29, 2022                             https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : libcommons-net-java     Version        : 3.6-1+deb10u1     CVE ID         : CVE-2021-37533     Debian Bug     : 1025910

    ZeddYu Lu discovered that the FTP client of Apache Commons Net, a Java     client API for basic Internet protocols, trusts the host from PASV response     by default. A malicious server can redirect the Commons Net code to use a     different host, but the user has to connect to the malicious server in the     first place. This may lead to leakage of information about services running     on the private network of the client.

    For Debian 10 buster, this problem has been fixed in version     3.6-1+deb10u1.

    We recommend that you upgrade your libcommons-net-java packages.

    For the detailed security status of libcommons-net-java please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libcommons-net-java

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of IBM Engineering Requirements Management DOORS (formerly IBM Rational DOORS) installed on the remote host is 9.7.2.x prior to 9.7.2.8. It is, therefore, affected by multiple vulnerabilities as referenced in the 7124058 advisory.

  - Apache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet     containers. Applications using RegExPatternMatcher with `.` in the regular expression are possibly     vulnerable to an authorization bypass. (CVE-2022-32532)

  - The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow     a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary     shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client     or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade     both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.
    (CVE-2023-46604)

  - Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be     exploited. There is only a risk in conjunction with Java object deserialization within an application. In     such situations, it allows attackers to erase contents of arbitrary files, make network connections, or     possibly run arbitrary code (specifically, Function0 functions) via a gadget chain. (CVE-2022-36944)

  - IBM Engineering Requirements Management DOORS 9.7.2.7 is vulnerable to cross-site request forgery which     could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the     website trusts. IBM X-Force ID: 251216. (CVE-2023-28949)

  - A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows     remote attackers to inject arbitrary web script through a crafted protected comment (with the     cke_protected syntax). (CVE-2020-9281)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-6037-1 advisory.

    ZeddYu Lu discovered that the FTP client from Apache Commons Net trusted the host from PASV responses by     default. A remote attacker with a malicious FTP server could redirect the client to another server, which     could possibly result in leaked information about services running on the private network of the client.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The versions of Oracle Siebel CRM installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2023 CPU advisory.

  - Vulnerability in the Siebel CRM product of Oracle Siebel CRM (component: EAI - Open UI (JSON-java)).
    Supported versions that are affected are 23.8 and prior. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Siebel CRM. Successful attacks of this     vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete     DOS) of Siebel CRM. (CVE-2023-1370)

  - Vulnerability in the Siebel Apps product of Oracle Siebel CRM (component: Marketing (Apache Commons Net)).
    Supported versions that are affected are 23.8 and prior. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Siebel Apps. Successful attacks     require human interaction from a person other than the attacker. Successful attacks of this vulnerability     can result in unauthorized access to critical data or complete access to all Siebel Apps accessible data.
    (CVE-2021-37533)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle Business Intelligence Enterprise Edition (OAS) 6.4.0.0.0 and 7.0.0.0 installed on the remote host are affected by a vulnerability as referenced in the July 2023 CPU advisory. 

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Analytics Server (Apache Hive)). Supported versions that are affected are 6.4.0.0.0,     7.0.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network     access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of     this vulnerability can result in unauthorized creation, deletion or modification access to critical data     or all Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized access to     critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data.
    (CVE-2018-1282)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Visual Analyzer (jackson-databind)). Supported versions that are affected are 6.4.0.0.0 and     7.0.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of     Oracle Business Intelligence Enterprise Edition. (CVE-2022-33980)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Visual Analyzer (CKEditor)). Supported versions that are affected are 6.4.0.0.0 and     7.0.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks require human     interaction from a person other than the attacker and while the vulnerability is in Oracle Business     Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change).     Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to     some of Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized read     access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. (CVE-2023-28439)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-5307 advisory.

    ZeddYu Lu discovered that the FTP client of Apache Commons Net, a Java client API for basic Internet     protocols, trusts the host from PASV response by default. A malicious server can redirect the Commons Net     code to use a different host, but the user has to connect to the malicious server in the first place. This     may lead to leakage of information about services running on the private network of the client. For the     stable distribution (bullseye), this problem has been fixed in version 3.6-1+deb11u1. We recommend that     you upgrade your libcommons-net-java packages. For the detailed security status of libcommons-net-java     please refer to its security tracker page at: https://security-tracker.debian.org/tracker/libcommons-net-     java

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The versions of Primavera Gateway installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2023 CPU advisory.

  - Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: Admin     (Apache Commons Net)). Supported versions that are affected are 18.8.0-18.8.15, 19.12.0-19.12.16,     20.12.0-20.12.11 and 21.12.0-21.12.9. Easily exploitable vulnerability allows unauthenticated attacker     with network access via HTTP to compromise Primavera Gateway. Successful attacks require human interaction     from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized     access to critical data or complete access to all Primavera Gateway accessible data. (CVE-2021-37533)

  - Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: Admin     (JSZip)). Supported versions that are affected are 18.8.0-18.8.15, 19.12.0-19.12.16, 20.12.0-20.12.11 and     21.12.0-21.12.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via     HTTP to compromise Primavera Gateway. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Primavera Gateway accessible data as well as unauthorized read     access to a subset of Primavera Gateway accessible data and unauthorized ability to cause a partial denial     of service (partial DOS) of Primavera Gateway. (CVE-2022-48285)

  - Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: Admin     (json-smart)). Supported versions that are affected are 18.8.0-18.8.15, 19.12.0-19.12.16, 20.12.0-20.12.11     and 21.12.0-21.12.9. Easily exploitable vulnerability allows unauthenticated attacker with network access     via HTTP to compromise Primavera Gateway. Successful attacks of this vulnerability can result in     unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Primavera Gateway.
    (CVE-2023-1370)

  - Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: Admin     (Spring Framework)). Supported versions that are affected are 18.8.0-18.8.15, 19.12.0-19.12.16,     20.12.0-20.12.11 and 21.12.0-21.12.9. Easily exploitable vulnerability allows low privileged attacker with     network access via HTTP to compromise Primavera Gateway. Successful attacks of this vulnerability can     result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Primavera     Gateway. (CVE-2023-20863)


Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 13.5.0.0 versions of Enterprise Manager Base Platform installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2024 CPU advisory.

  - Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager     (component: Install (Apache Commons Net)). The supported version that is affected is 13.5.0.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Oracle Enterprise Manager Base Platform. Successful attacks require human interaction from a person other     than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical     data or complete access to all Oracle Enterprise Manager Base Platform accessible data. (CVE-2021-37533)

  - Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager     (component: Install (json-smart)). The supported version that is affected is 13.5.0.0. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Enterprise     Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete DOS) of Oracle Enterprise Manager Base Platform.     (CVE-2023-1370)

  - Vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager (component:     Install (Apache Mina SSHD)). The supported version that is affected is 13.3.0.1. Difficult to exploit     vulnerability allows unauthenticated attacker with network access via SSH to compromise Oracle     Application Testing Suite. Successful attacks of this vulnerability can result in unauthorized creation,     deletion or modification access to critical data or all Oracle Application Testing Suite accessible data.     (CVE-2023-48795)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
224041	Linux Distros Unpatched Vulnerability : CVE-2021-37533	Nessus	Misc.	3/5/2025	3/5/2025	medium
212439	Oracle Siebel Server <= 23.5 (July 2023 CPU)	Nessus	Misc.	12/11/2024	12/12/2024	critical
169424	Debian dla-3251 : libcommons-net-java - security update	Nessus	Debian Local Security Checks	12/30/2022	1/22/2025	medium
191754	IBM Engineering Requirements Management DOORS 9.7.2.x < 9.7.2.8 Multiple Vulnerabilities (7124058)	Nessus	Windows	3/8/2024	3/12/2024	critical
174751	Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS : Apache Commons Net vulnerability (USN-6037-1)	Nessus	Ubuntu Local Security Checks	4/25/2023	8/27/2024	medium
212438	Oracle Siebel Server (October 2023 CPU)	Nessus	Misc.	12/11/2024	12/12/2024	medium
178710	Oracle Business Intelligence Enterprise Edition (OAS) (July 2023 CPU)	Nessus	Misc.	7/21/2023	7/19/2024	critical
169419	Debian DSA-5307-1 : libcommons-net-java - security update	Nessus	Debian Local Security Checks	12/30/2022	1/24/2025	medium
178484	Oracle Primavera Gateway (Jul 2023 CPU)	Nessus	CGI abuses	7/19/2023	10/24/2023	high
202596	Oracle Enterprise Manager Cloud Control (Jul 2024 CPU)	Nessus	Misc.	7/18/2024	10/18/2024	medium

Detections

Analytics

Plugins Search

medium

critical

medium

critical

medium

medium

critical

medium

high

medium