The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:4226 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.1.10 serves as a     replacement for Red Hat JBoss Enterprise Application Platform 7.1.9, and includes bug fixes and     enhancements. See the Red Hat JBoss Enterprise Application Platform 7.1.9 Release Notes for information     about the most significant bug fixes and enhancements included in this release.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of IBM Engineering Requirements Management DOORS (formerly IBM Rational DOORS) installed on the remote host is 9.6.1.1 prior or equal to 9.6.1.13 or 9.7.2.1 prior or equal to 9.7.2.11. It is, therefore, affected by multiple vulnerabilities as referenced in the 7279145 advisory.

  - IBM DOORS Web Access do not limit the length of a connection which could allow for a Slowloris HTTP denial     of service attack to take place. This can cause the web server to become unresponsive. (CVE-2024-25039)

  - IBM DOORS Web Access is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated     attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality     potentially leading to credentials disclosure within a trusted session. (CVE-2025-0152)

  - IBM DOORS Web Access could allow a remote attacker to obtain sensitive information when a detailed     technical error message is returned in the browser. This information could be used in further attacks     against the system. (CVE-2020-4984)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Oracle Business Intelligence Publisher (OAS) installed on the remote host are affected by a vulnerability as referenced in the October 2023 CPU advisory.

  - Vulnerability in the BI Publisher product of Oracle Analytics (component: Development Operations     (XStream)). The supported version that is affected is 6.4.0.0.0. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise BI Publisher. Successful attacks of     this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash     (complete DOS) of BI Publisher. (CVE-2022-40152)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:4437 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.3.13 serves as a     replacement for Red Hat JBoss Enterprise Application Platform 7.3.12, and includes bug fixes and     enhancements. See the Red Hat JBoss Enterprise Application Platform 7.3.13 Release Notes for information     about the most significant bug fixes and enhancements included in this release.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.3.13 serves as a     replacement for Red Hat JBoss Enterprise Application Platform 7.3.12, and includes bug fixes and     enhancements. See the Red Hat JBoss Enterprise Application Platform 7.3.13 Release Notes for information     about the most significant bug fixes and enhancements included in this release.

    Security Fix(es):

    * com.google.code.gson-gson: Deserialization of Untrusted Data in com.google.code.gson-gson [eap-7.3.z]     (CVE-2022-25647)

    * woodstox-core: woodstox to serialise XML data was vulnerable to Denial of Service attacks [eap-7.3.z]     (CVE-2022-40152)

    * xnio: org.xnio.StreamConnection.notifyReadClosed log to debug instead of stderr [eap-7.3.z]     (CVE-2022-0084)

    * artemis-commons: Apache ActiveMQ Artemis DoS [eap-7.3] (CVE-2022-23913)

    * Moment.js: Path traversal  in moment.locale [eap-7.3.z] (CVE-2022-24785)

    * jettison: memory exhaustion via user-supplied XML or JSON data [eap-7.3.z] (CVE-2022-40150)

    * snakeyaml: Denial of Service due to missing nested depth limitation for collections [eap-7.3.z]     (CVE-2022-25857)

    * jettison: parser crash by stackoverflow [eap-7.3.z] (CVE-2022-40149)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgements, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-680589 advisory.

    Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks (DOS) if DTD support     is enabled. If the parser is running on user supplied input, an attacker may supply content that causes     the parser to crash by stackoverflow. This effect may support a denial of service attack.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle WebLogic Server installed on the remote host is missing a security patch from the April 2023 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilities, including:

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console     (Apache Commons FileUpload)). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and     14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized     ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server.
    (CVE-2023-24998)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Samples     (XStream)). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic     Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of Oracle WebLogic Server. (CVE-2022-40152)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Third Party     (Apache Commons Compress)). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server. (CVE-2021-36090)

  Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3299 advisory.

    Jenkins is a continuous integration server that monitors executions of repeated jobs, such as building a     software project or jobs run by cron.

    Security Fix(es):

    * apache-commons-text: variable interpolation RCE (CVE-2022-42889)

    * google-oauth-client: missing PKCE support in accordance with the RFC for OAuth 2.0 for Native Apps can     lead to improper authorization (CVE-2020-7692)

    * jenkins-2-plugins/script-security: Sandbox bypass vulnerability in Script Security Plugin     (CVE-2023-24422)

    * kubernetes-client: Insecure deserialization in unmarshalYaml method (CVE-2021-4178)

    * jackson-databind: Possible DoS if using JDK serialization to serialize JsonNode (CVE-2021-46877)

    * springframework: Authorization Bypass in RegexRequestMatcher (CVE-2022-22978)

    * xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks (CVE-2022-40151)

    * woodstox-core: woodstox to serialise XML data was vulnerable to Denial of Service attacks     (CVE-2022-40152)

    * Apache Commons FileUpload: FileUpload DoS with excessive parts (CVE-2023-24998)

    * jenkins-2-plugins/JUnit: Stored XSS vulnerability in JUnit Plugin (CVE-2023-25761)

    * jenkins-2-plugins/pipeline-build-step: Stored XSS vulnerability in Pipeline: Build Step Plugin     (CVE-2023-25762)

    * Jenkins: Denial of Service attack (CVE-2023-27900)

    * Jenkins: Denial of Service attack (CVE-2023-27901)

    * Jenkins: Workspace temporary directories accessible through directory browser (CVE-2023-27902)

    * Jenkins: Information disclosure through error stack traces related to agents (CVE-2023-27904)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
237013	RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.1.10 on RHEL 7 (RHSA-2025:4226)	Nessus	Red Hat Local Security Checks	2025/5/21	2025/6/5	high
333335	IBM Engineering Requirements Management DOORS 9.6.1.1 <= 9.6.1.13 / 9.7.2.1 <= 9.7.2.11 Multiple Vulnerabilities (7279145)	Nessus	Windows	2026/8/7	2026/9/29	high
183411	Oracle Business Intelligence Publisher 6.4 (OAS) (October 2023 CPU)	Nessus	Misc.	2023/10/19	2023/10/20	high
235116	RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.3.13 (RHSA-2025:4437)	Nessus	Red Hat Local Security Checks	2025/5/5	2025/6/5	high
266906	Unity Linux 20.1070e Security Update: woodstox-core (UTSA-2025-680589)	Nessus	Unity Linux Local Security Checks	2025/10/7	2025/10/10	high
174464	Oracle WebLogic Server (Apr 2023 CPU)	Nessus	Misc.	2023/4/19	2026/2/24	high
194250	RHEL 8 : jenkins and jenkins-2-plugins (RHSA-2023:3299)	Nessus	Red Hat Local Security Checks	2024/4/28	2024/11/7	critical

偵測

搜尋 Plugin

high

high

high

high

high

high

critical