The version of GoldenGate installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2022 CPU advisory.

  - Vulnerability in Oracle GoldenGate (component: Oracle GoldenGate Microservices (Dell BSAFE Micro Edition     Suite)).   The supported version that is affected is 19c. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTPS to compromise Oracle GoldenGate.  Successful     attacks of this vulnerability can result in takeover of Oracle GoldenGate. (CVE-2020-35169)

  - Vulnerability in the Oracle Goldengate product of Oracle GoldenGate (component: Stream Analytics     (JinJava)). The supported version that is affected is 19c. Easily exploitable vulnerability allows low     privileged attacker with network access via HTTP to compromise Oracle Goldengate.  Successful attacks of     this vulnerability can result in  unauthorized read access to a subset of Oracle Goldengate accessible     data. (CVE-2018-18893)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 8.0.30 versions of MySQL Connectors installed on the remote host are affected by a vulnerability as referenced in the October 2022 CPU advisory.

  - Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/C++ (OpenSSL)). Supported     versions that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of     this vulnerability can result in unauthorized read access to a subset of MySQL Connectors accessible data.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The versions of Primavera Unifier installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2022 CPU advisory.

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Document     Management (Apache Solr)). Supported versions that are affected are 18.8, 19.12, 20.12 and 21.12. Easily     exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise     Primavera Unifier. Successful attacks of this vulnerability can result in takeover of Primavera Unifier.
    (CVE-2020-9492)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: User     Interface (Enterprise Security API)). Supported versions that are affected are 18.8, 19.12, 20.12 and     21.12. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to     compromise Primavera Unifier. Successful attacks of this vulnerability can result in takeover of Primavera     Unifier. (CVE-2022-23457)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: User     Interface (Moment.js)). Supported versions that are affected are 19.12, 20.12 and 21.12. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Primavera Unifier. Successful attacks of this vulnerability can result in unauthorized ability to cause a     partial denial of service (partial DOS) of Primavera Unifier. (CVE-2022-31129)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Document     Management (Apache Tika)). Supported versions that are affected are 18.8, 19.12, 20.12 and 21.12. Easily     exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Primavera     Unifier executes to compromise Primavera Unifier. Successful attacks require human interaction from a     person other than the attacker. Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Primavera Unifier.  (CVE-2022-33879)

  - Security-in-Depth issue in the Primavera Unifier product of Oracle Construction and Engineering     (component: Platform, User Interface (Apache Velocity Engine)). This vulnerability cannot be exploited     in the context of this product. (CVE-2020-13936)

  - Security-in-Depth issue in the Primavera Unifier product of Oracle Construction and Engineering     (component: Document Management (Apache ZooKeeper)). This vulnerability cannot be exploited in the context     of this product. (CVE-2020-7712)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of MySQL Server installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2022 CPU advisory.

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Packaging (OpenSSL)).
    Supported versions that are affected are 5.7.39 and prior and 8.0.30 and prior. Easily exploitable     vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a     subset of MySQL Server accessible data. (CVE-2022-2097)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Connection Handling).
    Supported versions that are affected are 5.7.39 and prior and 8.0.30 and prior. Easily exploitable     vulnerability allows high privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2022-21617)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported     versions that are affected are 5.7.39 and prior and 8.0.30 and prior. Easily exploitable vulnerability     allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.
    Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of MySQL Server. (CVE-2022-21608)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 12.2.1.3.0 and 12.2.1.4.0 versions of WebCenter Sites installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2022 CPU advisory.

  - Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: Centralized Thirdparty     Jars (dojo)). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful     attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. (CVE-2021-23450)

  - Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites     (XStream)). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash     (complete DOS) of Oracle WebCenter Sites. (CVE-2021-43859)

  - Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites     (CKEditor)). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash     (complete DOS) of Oracle WebCenter Sites. (CVE-2022-24729)

  - CVE-2022-32532	Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component:     WebCenter Sites (Apache Shiro)). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle     WebCenter Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites.     (CVE-2022-32532)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle WebLogic Server installed on the remote host is missing a security patch from the October 2022 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilities, including:

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized Thirdparty     Jars (Bouncy Castle Java Library)). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle     WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.
    (CVE-2020-28052)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized Thirdparty     Jars (Apache Xerces-J)). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic     Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of     this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS)     of Oracle WebLogic Server. (CVE-2022-23437)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized Thirdparty     Jars (Apache Groovy)). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable     vulnerability allows low privileged attacker with logon to the infrastructure where Oracle WebLogic Server executes     to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to     critical data or complete access to all Oracle WebLogic Server accessible data. (CVE-2020-17521) )

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of MySQL Server installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2022 and January 2023 CPU advisories.

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions     that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows low privileged attacker     with network access via multiple protocols to compromise MySQL Server. Successful attacks of this     vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS)     of MySQL Server. (CVE-2022-39408)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that     are affected are 8.0.30 and prior. Easily exploitable vulnerability allows low privileged attacker with network     access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in     unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2022-39410)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Packaging (OpenSSL)). Supported     versions that are affected are 5.7.39 and prior and 8.0.30 and prior. Easily exploitable vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks     of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. (CVE-2022-2097)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 19c and 21c versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2022 CPU advisory.

  - Vulnerability in the Oracle Database - Machine Learning (Numpy) component of Oracle Database Server. The     supported version that is affected is 21c. Easily exploitable vulnerability allows low privileged attacker     having Create Session privilege with network access via Oracle Net to compromise Oracle Database - Machine     Learning (Numpy). (CVE-2021-41495)  

  - Vulnerability in the Spatial and Graph (jackson-databind) component of Oracle Database Server. Supported     versions that are affected are 19c and 21c. Easily exploitable vulnerability allows low privileged attacker     having Authenticated User privilege with network access via HTTP to compromise Spatial and     Graph (jackson-databind). Successful attacks of this vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete DOS) of Spatial and Graph (jackson-databind).
    (CVE-2020-36518)

  - Vulnerability in the Oracle Notification Server (PCRE2) component of Oracle Database Server. Supported     versions that are affected are 19c and 21c. Easily exploitable vulnerability allows low privileged     attacker having Subscriber privilege with network access via HTTP to compromise Oracle Notification     Server (PCRE2). Successful attacks of this vulnerability can result in unauthorized ability to cause     a hang or frequently repeatable crash (complete DOS) of Oracle Notification Server (PCRE2).
    Note: This vulnerability applies to Windows systems only. (CVE-2022-1587)

  - Vulnerability in the Oracle Database - Advanced Queuing component of Oracle Database Server. The supported     version that is affected is 19c. Easily exploitable vulnerability allows high privileged attacker having     DBA user privilege with network access via Oracle Net to compromise Oracle Database - Advanced Queuing.
    Successful attacks of this vulnerability can result in takeover of Oracle Database - Advanced Queuing.
    (CVE-2022-21596)

  - Vulnerability in the Oracle Database - Sharding component of Oracle Database Server. Supported versions     that are affected are 19c and 21c. Easily exploitable vulnerability allows high privileged attacker having     Local Logon privilege with network access via Local Logon to compromise Oracle Database - Sharding.
    Successful attacks of this vulnerability can result in takeover of Oracle Database - Sharding.
    (CVE-2022-21603)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of MySQL Enterprise Monitor installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2022 CPU advisory.   
  - Vulnerability in the MySQL Enterprise Monitor product of Oracle MySQL (component: Monitoring: General     (Moment.js)). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability     allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Enterprise     Monitor. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of MySQL Enterprise Monitor. (CVE-2022-31129)

  - Vulnerability in the MySQL Enterprise Monitor product of Oracle MySQL (component: Monitoring: General     (Apache Tomcat)). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability     allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Enterprise     Monitor. Successful attacks require human interaction from a person other than the attacker and while the     vulnerability is in MySQL Enterprise Monitor, attacks may significantly impact additional products (scope     change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete     access to some of MySQL Enterprise Monitor accessible data as well as unauthorized read access to a     subset of MySQL Enterprise Monitor accessible data. (CVE-2022-34305)

  - Vulnerability in the MySQL Enterprise Monitor product of Oracle MySQL (component: Monitoring: General     (OpenSSL)). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability     allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Enterprise     Monitor. Successful attacks of this vulnerability can result in unauthorized read access to a subset of     MySQL Enterprise Monitor accessible data. (CVE-2022-2097)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Primavera Gateway installed on the remote host are affected by a denial of service vulnerability as referenced in the October 2022 CPU advisory. This vulnerability is in the Primavera Gateway product of Oracle Construction and Engineering (component: Admin (Moment.js)). Supported versions that are affected are 18.8.0-18.8.15, 19.12.0-19.12.14, 20.12.0-20.12.9 and 21.12.0-21.12.7. This is an easily exploitable vulnerability that allows unauthenticated attackers with network access via HTTP to compromise Primavera Gateway. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Primavera Gateway. 

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of VirtualBox installed on the remote host is prior to 6.1.38. It is, therefore, affected by multiple  vulnerabilities as referenced in the Oct 2022 CPU advisory:

  - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions     that are affected are Prior to 6.1.38. Difficult to exploit vulnerability allows high privileged attacker with     logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the     vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change).     Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. (CVE-2022-39422)

  - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions     that are affected are Prior to 6.1.38. Easily exploitable vulnerability allows high privileged attacker with logon     to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the     vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change).     Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to     all Oracle VM VirtualBox accessible data. (CVE-2022-39423)   Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 12.2.1.4.0 and 14.1.1.0.0 versions of Coherence installed on the remote host are affected by an unauthorized access vulnerability as referenced in the Oct 2022 CPU advisory. This easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Coherence executes to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Coherence accessible data. 

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Oracle E-Business Suite installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2022 CPU advisory.

  - Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite     (component: Upload). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web     Applications Desktop Integrator. Successful attacks of this vulnerability can result in takeover of Oracle     Web Applications Desktop Integrator. (CVE-2022-21587, CVE-2022-39428)

  - Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite (component: Common Modules     (Apache Commons BeanUtils)). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Human     Resources. Successful attacks of this vulnerability can result in unauthorized update, insert or delete     access to some of Oracle Human Resources accessible data as well as unauthorized read access to a subset     of Oracle Human Resources accessible data and unauthorized ability to cause a partial denial of service     (partial DOS) of Oracle Human Resources. (CVE-2019-10086)

  - Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Session     Management). Supported versions that are affected are 12.2.6-12.2.11. Easily exploitable vulnerability     allows low privileged attacker with network access via HTTP to compromise Oracle Applications Framework.
    Successful attacks of this vulnerability can result in unauthorized access to critical data or complete     access to all Oracle Applications Framework accessible data. (CVE-2022-21636)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of VirtualBox installed on the remote host is prior to 6.1.40. It is, therefore, affected by multiple  vulnerabilities as referenced in the Oct 2022 CPU advisory:

  - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions     that are affected are Prior to 6.1.40. Difficult to exploit vulnerability allows unauthenticated attacker with     network access via VRDP to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result     in takeover of Oracle VM VirtualBox. (CVE-2022-39424)

  - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions     that are affected are Prior to 6.1.40. Difficult to exploit vulnerability allows unauthenticated attacker with     network access via VRDP to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result     in takeover of Oracle VM VirtualBox. (CVE-2022-39425)

  - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions     that are affected are Prior to 6.1.40. Difficult to exploit vulnerability allows unauthenticated attacker with     network access via VRDP to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result     in takeover of Oracle VM VirtualBox. (CVE-2022-39426)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 5.9.0.0 and 6.4.0.0 versions of Oracle Business Intelligence Enterprise Edition installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2022 CPU advisory.

  - Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: Core     Formatting API). Supported versions that are affected are 5.9.0.0, 6.4.0.0.0, 12.2.1.3.0 and 12.2.1.4.0.     Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to     compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in unauthorized     access to critical data or complete access to all Oracle BI Publisher accessible data as well as     unauthorized update, insert or delete access to some of Oracle BI Publisher accessible data and     unauthorized ability to cause a partial denial of service (partial DOS) of Oracle BI Publisher.     (CVE-2022-21590)

  - Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: Security     (Google Gson)). Supported versions that are affected are 5.9.0.0, 6.4.0.0.0, 12.2.1.3.0 and 12.2.1.4.0.     Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to     compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in unauthorized     ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle BI Publisher.     (CVE-2022-25647)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle WebLogic Server installed on the remote host is missing a security patch from the October 2022 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilities, including:

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized Thirdparty     Jars (Bouncy Castle Java Library)). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle     WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.
    (CVE-2020-28052)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized Thirdparty     Jars (Apache Xerces-J)). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic     Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of     this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS)     of Oracle WebLogic Server. (CVE-2022-23437)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container).
    Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Difficult to exploit vulnerability     allows high privileged attacker with logon to the infrastructure where Oracle WebLogic Server executes to     compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server as well as unauthorized update,     insert or delete access to some of Oracle WebLogic Server accessible data and unauthorized read access to a subset     of Oracle WebLogic Server accessible data. (CVE-2022-21616)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 13.4.0.0 and 13.5.0.0 versions of Enterprise Manager Base Platform installed on the remote host are affected by a vulnerability as referenced in the October 2022 CPU advisory.

  - Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component:
    Application Config Console). Supported versions that are affected are 13.4.0.0 and 13.5.0.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized     creation, deletion or modification access to critical data or all Enterprise Manager Base Platform     accessible data. (CVE-2022-21623) Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle WebCenter Portal installed on the remote host is missing a security patch from the Oct 2022 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilites:

  - Vulnerability in the Oracle Communications Convergence product of Oracle Communications Applications (component:     Framework (dojo)). The supported version that is affected is 3.0.3.0. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Oracle Communications Convergence. Successful     attacks of this vulnerability can result in takeover of Oracle Communications Convergence. (CVE-2021-23450)

  - Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework     (jackson-databind)). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal.     Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of Oracle WebCenter Portal. (CVE-2020-36518)

  - Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework     (Apache Santuario XML Security For Java)). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0.     Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle     WebCenter Portal. Successful attacks of this vulnerability can result in unauthorized access to critical data or     complete access to all Oracle WebCenter Portal accessible data. (CVE-2021-40690)

Note that Nessus has not attempted to exploit this issue but has instead relied only on the application's self-reported version number.

The versions of Oracle Business Intelligence Enterprise Edition (OAS) installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2022 CPU advisory.

  - Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter     Sites (CKEditor)). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter     Sites. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of Oracle WebCenter Sites. (CVE-2022-24729)

  - Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component:
    Installation and Configuration (Apache Commons Configuration)). The supported version that is affected is     11.2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to     compromise Oracle Hyperion Infrastructure Technology. Successful attacks of this vulnerability can result     in takeover of Oracle Hyperion Infrastructure Technology. (CVE-2022-33980)   
  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware     (component: Analytics Web ADF Integration (Apache Commons Compress)). The supported version that is     affected is 5.9.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access     via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this     vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete     DOS) of Oracle Business Intelligence Enterprise Edition. (CVE-2021-36090)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of VirtualBox installed on the remote host is prior to 6.1.40. It is, therefore, affected by multiple  vulnerabilities as referenced in the Oct 2022 CPU advisory:

  - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions     that are affected are Prior to 6.1.40. Easily exploitable vulnerability allows low privileged attacker with logon     to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the     vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change).     Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. Note: This vulnerability     applies to Windows systems only. (CVE-2022-39427)

  - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions     that are affected are Prior to 6.1.40. Easily exploitable vulnerability allows low privileged attacker with logon     to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks     require human interaction from a person other than the attacker. Successful attacks of this vulnerability can     result in takeover of Oracle VM VirtualBox. Note: This vulnerability applies to Windows systems only.     (CVE-2022-39421)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Oracle Business Intelligence Enterprise Edition (OAS) installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2022 CPU advisory.

  - Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter     Sites (CKEditor)). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter     Sites. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of Oracle WebCenter Sites. (CVE-2022-24729)

  - Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component:
    Installation and Configuration (Apache Commons Configuration)). The supported version that is affected is     11.2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to     compromise Oracle Hyperion Infrastructure Technology. Successful attacks of this vulnerability can result     in takeover of Oracle Hyperion Infrastructure Technology. (CVE-2022-33980)

  - jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large     depth of nested objects. (CVE-2020-36518)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 12.4.0.0 versions of Enterprise Manager Ops Center installed on the remote host is missing a security patch as documented in the October 2022 Critical Patch Update (CPU). It is, therefore, affected by a vulnerability in the Networking (dojo) component. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Enterprise Manager Ops Center. Successful attacks of this vulnerability can result in takeover of Enterprise Manager Ops Center.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
166440	Oracle GoldenGate (Oct 2022 CPU)	Nessus	Misc.	2022/10/25	2023/10/24	critical
166315	Oracle MySQL Connectors (Oct 2022 CPU)	Nessus	Misc.	2022/10/20	2023/11/1	medium
166305	Oracle Primavera Unifier (Oct 2022 CPU)	Nessus	CGI abuses	2022/10/20	2023/10/9	critical
166309	Oracle MySQL Server (Oct 2022 CPU)	Nessus	Databases	2022/10/20	2023/11/1	medium
166377	Oracle WebCenter Sites (Oct 2022 CPU)	Nessus	Windows	2022/10/21	2023/10/9	critical
166313	Oracle WebLogic Server (Oct 2022 CPU)	Nessus	Misc.	2022/10/20	2024/1/4	high
166310	Oracle MySQL Server (Oct 2022 CPU)	Nessus	Databases	2022/10/20	2023/11/1	medium
166370	Oracle Database Server (Oct 2022 CPU)	Nessus	Databases	2022/10/21	2023/10/24	critical
166325	Oracle MySQL Enterprise Monitor (Oct 2022 CPU)	Nessus	CGI abuses	2022/10/20	2023/11/1	medium
166331	Oracle Primavera Gateway (Oct 2022 CPU)	Nessus	CGI abuses	2022/10/20	2023/10/9	high
166293	Oracle VM VirtualBox < 6.1.38 (Oct 2022 CPU)	Nessus	Misc.	2022/10/20	2023/10/9	high
166378	Oracle Coherence Unauthorized Access (Oct 2022 CPU)	Nessus	Misc.	2022/10/21	2023/10/9	medium
166317	Oracle E-Business Suite (Oct 2022 CPU)	Nessus	Misc.	2022/10/20	2023/10/24	critical
166292	Oracle VM VirtualBox < 6.1.40 (Oct 2022 CPU)	Nessus	Misc.	2022/10/20	2023/10/9	high
166338	Oracle Business Intelligence Publisher (Oct 2022 CPU)	Nessus	Windows	2022/10/20	2023/10/24	high
166314	Oracle WebLogic Server 14.1.1 < 14.1.1.0.221010 (Oct 2022 CPU)	Nessus	Misc.	2022/10/20	2022/12/30	high
166323	Oracle Enterprise Manager Cloud Control (Oct 2022 CPU)	Nessus	Misc.	2022/10/20	2023/10/9	high
166335	Oracle WebCenter Portal Multiple Vulnerabilities (Oct 2022 CPU)	Nessus	Misc.	2022/10/20	2023/10/24	critical
166337	Oracle Business Intelligence Publisher 5.9.x < 5.9.0(OAS) (Oct 2022 CPU)	Nessus	Misc.	2022/10/20	2023/10/9	critical
166291	Oracle VM VirtualBox < 6.1.40 Multiple Vulnerabilities Windows (Oct 2022 CPU)	Nessus	Windows	2022/10/20	2023/10/9	high
166336	Oracle Business Intelligence Publisher 5.9.x < 5.9.0 (OAS) (Oct 2022 CPU)	Nessus	Misc.	2022/10/20	2023/10/24	critical
170175	Oracle Enterprise Manager Ops Center UI and Other Patches (Oct 2022 CPU)	Nessus	Misc.	2023/1/19	2023/9/7	critical

偵測

搜尋 Plugin

critical

medium

critical

medium

critical

high

medium

critical

medium

high

high

medium

critical

high

high

high

high

critical

critical

high

critical

critical