The version of Oracle Business Intelligence Enterprise Edition (OAS) 6.4.0.0.0 and 7.0.0.0 installed on the remote host are affected by a vulnerability as referenced in the July 2023 CPU advisory. 

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Analytics Server (Apache Hive)). Supported versions that are affected are 6.4.0.0.0,     7.0.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network     access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of     this vulnerability can result in unauthorized creation, deletion or modification access to critical data     or all Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized access to     critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data.
    (CVE-2018-1282)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Visual Analyzer (jackson-databind)). Supported versions that are affected are 6.4.0.0.0 and     7.0.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of     Oracle Business Intelligence Enterprise Edition. (CVE-2022-33980)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Visual Analyzer (CKEditor)). Supported versions that are affected are 6.4.0.0.0 and     7.0.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks require human     interaction from a person other than the attacker and while the vulnerability is in Oracle Business     Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change).     Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to     some of Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized read     access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. (CVE-2023-28439)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7258-1 advisory.

    Kevin Backhouse discovered that CKEditor did not properly sanitize HTML content. An attacker could     possibly use this issue to perform cross site scripting and obtain sensitive information. This issue only     affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-24728)

    It was discovered that CKEditor did not properly handle the creation of editor instances in the Iframe     Dialog and Media Embed packages. An attacker could possibly use this issue to perform cross site scripting     and obtain sensitive information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu     20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-28439)

    It was discovered that CKEditor did not properly handle parsing HTML content. An attacker could possibly     use this issue to perform cross site scripting and obtain sensitive information. (CVE-2024-24815,     CVE-2024-24816)

    It was discovered that CKEditor did not properly sanitize version notifications. An attacker could     possibly use this issue to perform cross site scripting and obtain sensitive information. This issue only     affected Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2024-43411)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-426b3a500d advisory.

    - [4.22.0/4.22.1](https://ckeditor.com/cke4/release/CKEditor-4.22.0-4.22.1)
    - [4.21.0](https://ckeditor.com/cke4/release/CKEditor-4.21.0)
        - [GHSA-vh5c-xwqv-cv9g /     CVE-2023-28439](https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-vh5c-xwqv-cv9g)
    - [4.20.2](https://ckeditor.com/cke4/release/CKEditor-4.20.2)
    - [4.20.1](https://ckeditor.com/cke4/release/CKEditor-4.20.1)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The versions of Oracle Siebel CRM installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2024 CPU advisory.

  - Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: EAI (Apache Tomcat)).
    Supported versions that are affected are 24.7 and prior. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP/2 to compromise Siebel CRM Integration. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of Siebel CRM Integration. (CVE-2024-24549)

  - Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: User Interface     (CKEditor)). Supported versions that are affected are 24.7 and prior. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Marketing.
    Successful attacks require human interaction from a person other than the attacker and while the     vulnerability is in Siebel Apps - Marketing, attacks may significantly impact additional products (scope     change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete     access to some of Siebel Apps - Marketing accessible data as well as unauthorized read access to a subset     of Siebel Apps - Marketing accessible data. (CVE-2023-28439)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-983ff03630 advisory.

    - [4.22.0/4.22.1](https://ckeditor.com/cke4/release/CKEditor-4.22.0-4.22.1)
    - [4.21.0](https://ckeditor.com/cke4/release/CKEditor-4.21.0)
        - [GHSA-vh5c-xwqv-cv9g /     CVE-2023-28439](https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-vh5c-xwqv-cv9g)
    - [4.20.2](https://ckeditor.com/cke4/release/CKEditor-4.20.2)
    - [4.20.1](https://ckeditor.com/cke4/release/CKEditor-4.20.1)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-79b5902a52 advisory.

    - [4.22.0/4.22.1](https://ckeditor.com/cke4/release/CKEditor-4.22.0-4.22.1)
    - [4.21.0](https://ckeditor.com/cke4/release/CKEditor-4.21.0)
        - [GHSA-vh5c-xwqv-cv9g /     CVE-2023-28439](https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-vh5c-xwqv-cv9g)
    - [4.20.2](https://ckeditor.com/cke4/release/CKEditor-4.20.2)
    - [4.20.1](https://ckeditor.com/cke4/release/CKEditor-4.20.1)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
178710	Oracle Business Intelligence Enterprise Edition (OAS) (July 2023 CPU)	Nessus	Misc.	7/21/2023	7/19/2024	critical
215049	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : CKEditor vulnerabilities (USN-7258-1)	Nessus	Ubuntu Local Security Checks	2/6/2025	2/28/2025	medium
185267	Fedora 39 : ckeditor (2023-426b3a500d)	Nessus	Fedora Local Security Checks	11/7/2023	11/14/2024	medium
209246	Oracle Siebel CRM <= 24.7 (October 2024 CPU)	Nessus	Misc.	10/17/2024	10/18/2024	medium
182542	Fedora 37 : ckeditor (2023-983ff03630)	Nessus	Fedora Local Security Checks	10/4/2023	11/14/2024	medium
182545	Fedora 38 : ckeditor (2023-79b5902a52)	Nessus	Fedora Local Security Checks	10/4/2023	11/14/2024	medium

Detections

Analytics

Plugins Search

critical

medium

medium

medium

medium

medium