The versions of Python Connector installed on the remote host are affected by a vulnerability as referenced in the January 2023 CPU advisory. Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of MySQL NET Connector installed on the remote host are affected by a vulnerability as referenced in the January 2023 CPU advisory. Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of MySQL ODBC or C++ Connectors installed on the remote host are affected by a vulnerability in the Cyrus SASL component as referenced in the January 2023 CPU advisory. Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 13.4.0.0 and 13.5.0.0 versions of Enterprise Manager Base Platform installed on the remote host are affected by a vulnerability as referenced in the January 2023 CPU advisory.

  - Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component:
    Management Agent). Supported versions that are affected are 13.4.0.0 and 13.5.0.0. Apache Commons Text performs     variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for     interpolation is '${prefix:name}', where 'prefix' is used to locate an instance of     org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with version 1.5 and     continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary     code execution or contact with remote servers. These lookups are: - 'script' - execute expressions using the JVM     script execution engine (javax.script) - 'dns' - resolve dns records - 'url' - load values from urls, including     from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to     remote code execution or unintentional contact with remote servers if untrusted configuration values are used.     (CVE-2022-42889)

    Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 13.4.0.0 and 13.5.0.0 versions of Enterprise Manager Base Platform installed on the remote host are affected by a vulnerabiliy in the Application Config Console (Google Gson) component as referenced in the January 2023 CPU advisory.
Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Enterprise Manager Base Platform.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 12.4.0.0 versions of Enterprise Manager Ops Center installed on the remote host are affected by a vulnerability as referenced in the January 2023 CPU advisory.

  - Vulnerability in the Enterprise Manager Ops Center product of Oracle Enterprise Manager (component: Update     Provisioning (Apache HTTP Server)). The supported version that is affected is 12.4.0.0. Difficult to     exploit vulnerability allows high privileged attacker with logon to the infrastructure where Enterprise     Manager Ops Center executes to compromise Enterprise Manager Ops Center. Successful attacks of this     vulnerability can result in takeover of Enterprise Manager Ops Center. (CVE-2022-31813)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle Access Manager installed on the remote host is affected by the following vulnerability as noted in the January 2023 CPU advisory:

  - Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware     (component: Authentication Engine). The supported version that is affected is     12.2.1.4.0. Easily exploitable vulnerability allows high privileged attacker     with logon to the infrastructure where Oracle Access Manager executes to     compromise Oracle Access Manager. Successful attacks of this vulnerability can     result in unauthorized access to critical data or complete access to all Oracle     Access Manager accessible data.

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is affected by multiple vulnerabilities as referenced in the January 2023 CPU advisory:

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE     (component: Serialization). Supported versions that are affected are Oracle Java SE: 8u351, 8u351-perf;
    Oracle GraalVM Enterprise Edition: 20.3.8 and 21.3.4. Easily exploitable vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle     GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update,     insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data.
    (CVE-2023-21830)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE     (component: JSSE). Supported versions that are affected are Oracle Java SE: 11.0.17, 17.0.5, 19.0.1;
    Oracle GraalVM Enterprise Edition: 20.3.8, 21.3.4 and 22.3.0. Easily exploitable vulnerability allows     unauthenticated attacker with network access via DTLS to compromise Oracle Java SE, Oracle GraalVM     Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a     partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition.
    (CVE-2023-21835)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE     (component: Sound). Supported versions that are affected are Oracle Java SE: 8u351, 8u351-perf, 11.0.17,     17.0.5, 19.0.1; Oracle GraalVM Enterprise Edition: 20.3.8, 21.3.4 and 22.3.0. Difficult to exploit     vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise     Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition     accessible data. (CVE-2023-21843)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle TimesTen installed on the remote host is prior to 11.2.2.8.65 or 22.x prior to 22.1.1.5.0.
It is, therefore, affected by a buffer overflow vulnerability as referenced in the January 2023 CPU advisory

  - Vulnerability in Oracle TimesTen In-Memory Database (component: In-Memory Database (zlib)). Supported versions that     are affected are Prior to 11.2.2.8.65 and 22.x prior to 22.1.1.5.0. Easily exploitable vulnerability allows low     privileged attacker with network access via Oracle Net to compromise Oracle TimesTen In-Memory Database. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash     (complete DOS) of Oracle TimesTen In-Memory Database.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The 5.9.0.0 and 6.4.0.0 versions of Oracle Business Intelligence Enterprise Edition installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2023 CPU advisory.

  - Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: Security).
    Supported versions that are affected are 5.9.0.0.0, 6.4.0.0.0 and 12.2.1.4.0. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     Oracle BI Publisher. Successful attacks of this vulnerability can result in takeover of Oracle BI     Publisher. (CVE-2023-21832)

  - Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: Security).
    Supported versions that are affected are 5.9.0.0.0, 6.4.0.0.0 and 12.2.1.4.0. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     Oracle BI Publisher. Successful attacks of this vulnerability can result in takeover of Oracle BI     Publisher. (CVE-2023-21846)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 12.2.1.4.0 version of WebCenter Sites installed on the remote host is affected by multiple vulnerabilities as referenced in the January 2023 CPU advisory.

  - Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter     Sites (Apache PDFBox)). The supported version that is affected is 12.2.1.4.0. Easily exploitable     vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle WebCenter     Sites executes to compromise Oracle WebCenter Sites. Successful attacks require human interaction from a     person other than the attacker. Successful attacks of this vulnerability can result in unauthorized     ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebCenter Sites.
    (CVE-2021-31812)

  - Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter     Sites (Apache Shiro)). The supported version that is affected is 12.2.1.4.0. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter     Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites.
    (CVE-2022-40664)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Oracle Business Intelligence Enterprise Edition (OAS) installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2023 CPU advisory.

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware     (component: Analytics Server (Apache Commons Text)). Supported versions that are affected are 5.9.0.0.0     and 6.4.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via     HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this     vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. (CVE-2022-42889)   
  - Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: Security).
    Supported versions that are affected are 5.9.0.0.0, 6.4.0.0.0 and 12.2.1.4.0. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     Oracle BI Publisher. Successful attacks of this vulnerability can result in takeover of Oracle BI     Publisher. (CVE-2023-21832)

  - Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: Security).
    Supported versions that are affected are 5.9.0.0.0, 6.4.0.0.0 and 12.2.1.4.0. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     Oracle BI Publisher. Successful attacks of this vulnerability can result in takeover of Oracle BI     Publisher. (CVE-2023-21846)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of MySQL Server installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2022, October 2022 and January 2023 CPU advisories.

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Packaging (OpenSSL)).
    Supported versions that are affected are 5.7.37 and prior and 8.0.28 and prior. Easily exploitable vulnerability     allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash     (complete DOS) of MySQL Server. (CVE-2022-0778)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Compiling (protobuf)).
    Supported versions that are affected are 8.0.28 and prior. Easily exploitable vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of MySQL Server. (CVE-2021-22570)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication Plugin).
    Supported versions that are affected are 8.0.28 and prior. Easily exploitable vulnerability allows low     privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of MySQL Server. (CVE-2022-21454)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of MySQL Enterprise Monitor installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2023 CPU advisory.

  - Vulnerability in the MySQL Enterprise Monitor product of Oracle MySQL (component: Monitoring: General     (Spring Security)). Supported versions that are affected are 8.0.32 and prior. Easily exploitable     vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise     MySQL Enterprise Monitor. Successful attacks of this vulnerability can result in takeover of MySQL     Enterprise Monitor. (CVE-2022-31692)

  - Vulnerability in the MySQL Enterprise Monitor product of Oracle MySQL (component: Monitoring: General     (Apache Tomcat)). Supported versions that are affected are 8.0.32 and prior. Easily exploitable     vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise     MySQL Enterprise Monitor. Successful attacks of this vulnerability can result in unauthorized creation,     deletion or modification access to critical data or all MySQL Enterprise Monitor accessible data.
    (CVE-2022-42252)

  - Vulnerability in the MySQL Enterprise Monitor product of Oracle MySQL (component: Monitoring: General     (Spring Framework)). Supported versions that are affected are 8.0.32 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     MySQL Enterprise Monitor. Successful attacks of this vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete DOS) of MySQL Enterprise Monitor. (CVE-2022-22971)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of MySQL Server installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2022 and January 2023 CPU advisories.

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions     that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows low privileged attacker     with network access via multiple protocols to compromise MySQL Server. Successful attacks of this     vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS)     of MySQL Server. (CVE-2022-39408)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that     are affected are 8.0.30 and prior. Easily exploitable vulnerability allows low privileged attacker with network     access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in     unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2022-39410)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Packaging (OpenSSL)). Supported     versions that are affected are 5.7.39 and prior and 8.0.30 and prior. Easily exploitable vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks     of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. (CVE-2022-2097)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of MySQL Server installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2022, October 2022 and January 2023 CPU advisories.

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Packaging (OpenSSL)).
    Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise MySQL Server.
    Successful attacks of this vulnerability can result in takeover of MySQL Server. (CVE-2022-1292)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Packaging (cURL)). Supported     versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks require     human interaction from a person other than the attacker. Successful attacks of this vulnerability can result     in unauthorized creation, deletion or modification access to critical data or all MySQL Server accessible     data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL     Server. (CVE-2022-27778)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Compiling (zlib)). Supported     versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of     this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash     (complete DOS) of MySQL Server. (CVE-2018-25032)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Primavera Unifier installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2023 CPU advisory.

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: User     Interface (UnderscoreJS)). Supported versions that are affected are 18.8, 19.12, 20.12, 21.12 and 22.12.
    Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to     compromise Primavera Unifier. Successful attacks of this vulnerability can result in unauthorized update,     insert or delete access to some of Primavera Unifier accessible data as well as unauthorized read access     to a subset of Primavera Unifier accessible data. (CVE-2021-23358)     
  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Event     Streams and Communications (Apache Kafka)). Supported versions that are affected are 18.8, 19.12, 20.12,     21.12 and 22.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via     HTTP to compromise Primavera Unifier. Successful attacks of this vulnerability can result in unauthorized     ability to cause a hang or frequently repeatable crash (complete DOS) of Primavera Unifier.
    (CVE-2022-34917)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Document     Management (jackson-databind)). Supported versions that are affected are 18.8, 19.12, 20.12, 21.12 and     22.12. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to     compromise Primavera Unifier. Successful attacks require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of Primavera Unifier. (CVE-2022-42003)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The installation of Oracle Global Lifecycle Management (OPatch) installed on the remote host is affected by multiple vulnerabilities as referenced in the January 2023 CPU advisory.

  - Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion     Middleware (component: NextGen Installer issues (jackson-databind)). Supported versions that are affected     are Prior to 13.9.4.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network     access via HTTP to compromise Oracle Global Lifecycle Management NextGen OUI Framework. Successful attacks     of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash     (complete DOS) of Oracle Global Lifecycle Management NextGen OUI Framework. (CVE-2022-42003)

  - Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion     Middleware (component: NextGen Installer issues (Apache Mina SSHD)). Supported versions that are affected     are Prior to 13.9.4.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network     access via HTTP to compromise Oracle Global Lifecycle Management NextGen OUI Framework. Successful attacks     of this vulnerability can result in takeover of Oracle Global Lifecycle Management NextGen OUI Framework.
    (CVE-2022-45047)

  - Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion     Middleware (component: NextGen Installer issues). Supported versions that are affected are Prior to     13.9.4.2.11. Easily exploitable vulnerability allows low privileged attacker with logon to the     infrastructure where Oracle Global Lifecycle Management NextGen OUI Framework executes to compromise     Oracle Global Lifecycle Management NextGen OUI Framework. Successful attacks require human interaction     from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of     Oracle Global Lifecycle Management NextGen OUI Framework. (CVE-2023-21894)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2023 CPU advisory.

  - Vulnerability in the Oracle Database - Machine Learning for Python (Python) component of Oracle Database     Server. The supported version that is affected is 21c. Easily exploitable vulnerability allows low     privileged attacker having Database User privilege with network access via Oracle Net to compromise Oracle     Database - Machine Learning for Python (Python). Successful attacks of this vulnerability can result in     unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Database -     Machine Learning for Python (Python). (CVE-2021-3737)

  - Vulnerability in the Oracle Database RDBMS Security component of Oracle Database Server. Supported     versions that are affected are 19c and 21c. Easily exploitable vulnerability allows low privileged     attacker having Create Session privilege with network access via Oracle Net to compromise Oracle Database     RDBMS Security. Successful attacks require human interaction from a person other than the attacker.
    Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification     access to critical data or all Oracle Database RDBMS Security accessible data as well as unauthorized read     access to a subset of Oracle Database RDBMS Security accessible data. (CVE-2023-21829)

  - Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are     19c and 21c. Easily exploitable vulnerability allows low privileged attacker having Create Procedure     privilege with network access via Oracle Net to compromise Java VM. Successful attacks of this     vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of     Java VM. (CVE-2022-39429)

  - Vulnerability in the Oracle Database Data Redaction component of Oracle Database Server. Supported     versions that are affected are 19c and 21c. Easily exploitable vulnerability allows low privileged     attacker having Create Session privilege with network access via Oracle Net to compromise Oracle Database     Data Redaction. Successful attacks of this vulnerability can result in unauthorized read access to a     subset of Oracle Database Data Redaction accessible data. (CVE-2023-21827)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Primavera Gateway installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2023 CPU advisory.

  - Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: Admin     (Google Protobuf-Java)). Supported versions that are affected are 18.8.0-18.8.15, 19.12.0-19.12.15,     20.12.0-20.12.10 and 21.12.0-21.12.8. Easily exploitable vulnerability allows unauthenticated attacker     with network access via HTTP to compromise Primavera Gateway. Successful attacks of this vulnerability can     result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Primavera     Gateway (CVE-2022-3171)     
  - Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: Admin     (jackson-databind)). Supported versions that are affected are 18.8.0-18.8.15, 19.12.0-19.12.15,     20.12.0-20.12.10 and 21.12.0-21.12.8. Easily exploitable vulnerability allows unauthenticated attacker     with network access via HTTP to compromise Primavera Gateway. Successful attacks of this vulnerability can     result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Primavera     Gateway. (CVE-2022-42003)

  - Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: Admin     (Apache Commons Text)). Supported versions that are affected are 18.8.0-18.8.15, 19.12.0-19.12.15,     20.12.0-20.12.10 and 21.12.0-21.12.8. Easily exploitable vulnerability allows unauthenticated attacker     with network access via HTTP to compromise Primavera Gateway. Successful attacks of this vulnerability can     result in takeover of Primavera Gateway. (CVE-2022-42889)

  - Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: WebUI).
    Supported versions that are affected are 18.8.0-18.8.15, 19.12.0-19.12.15, 20.12.0-20.12.10 and     21.12.0-21.12.8. Easily exploitable vulnerability allows low privileged attacker with network access via     HTTP to compromise Primavera Gateway. Successful attacks require human interaction from a person other     than the attacker and while the vulnerability is in Primavera Gateway, attacks may significantly impact     additional products (scope change). Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Primavera Gateway accessible data as well as unauthorized read     access to a subset of Primavera Gateway accessible data. (CVE-2023-21888)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Oracle E-Business Suite installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2023 CPU advisory.

  - Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite     (component: Download). Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable     vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Web     Applications Desktop Integrator. Successful attacks require human interaction from a person other than     the attacker and while the vulnerability is in Oracle Web Applications Desktop Integrator, attacks may     significantly impact additional products (scope change). Successful attacks of this vulnerability can     result in unauthorized update, insert or delete access to some of Oracle Web Applications Desktop     Integrator accessible data as well as unauthorized read access to a subset of Oracle Web Applications     Desktop Integrator accessible data. (CVE-2023-21847)

  - Vulnerability in the Oracle Applications DBA product of Oracle E-Business Suite (component: Java utils).
    Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Oracle Applications DBA. Successful     attacks of this vulnerability can result in unauthorized creation, deletion or modification access to     critical data or all Oracle Applications DBA accessible data. (CVE-2023-21849)

  - Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing     Administration). Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Marketing.
    Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification     access to critical data or all Oracle Marketing accessible data. (CVE-2023-21851)

  - Vulnerability in the Oracle Sales Offline product of Oracle E-Business Suite (component: Core Components).
    Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Oracle Sales Offline. Successful     attacks of this vulnerability can result in unauthorized creation, deletion or modification access to     critical data or all Oracle Sales Offline accessible data. (CVE-2023-21854)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2023 CPU advisory.

  - Vulnerability in the Oracle Data Provider for .NET component of Oracle Database Server. Supported versions     that are affected are 19c and 21c. Difficult to exploit vulnerability allows unauthenticated attacker with     network access via TCPS to compromise Oracle Data Provider for .NET. Successful attacks require human     interaction from a person other than the attacker. Successful attacks of this vulnerability can result in     takeover of Oracle Data Provider for .NET. Note: Applies also to Database client-only on Windows platform.
    (CVE-2023-21893)

  - Vulnerability in the Oracle Database - Machine Learning for Python (Python) component of Oracle Database     Server. The supported version that is affected is 21c. Easily exploitable vulnerability allows low     privileged attacker having Database User privilege with network access via Oracle Net to compromise Oracle     Database - Machine Learning for Python (Python). Successful attacks of this vulnerability can result in     unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Database -     Machine Learning for Python (Python). (CVE-2021-3737)

  - Vulnerability in the Oracle Database RDBMS Security component of Oracle Database Server. Supported     versions that are affected are 19c and 21c. Easily exploitable vulnerability allows low privileged     attacker having Create Session privilege with network access via Oracle Net to compromise Oracle Database     RDBMS Security. Successful attacks require human interaction from a person other than the attacker.
    Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification     access to critical data or all Oracle Database RDBMS Security accessible data as well as unauthorized read     access to a subset of Oracle Database RDBMS Security accessible data. (CVE-2023-21829)

  - Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are     19c and 21c. Easily exploitable vulnerability allows low privileged attacker having Create Procedure     privilege with network access via Oracle Net to compromise Java VM. Successful attacks of this     vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of     Java VM. (CVE-2022-39429)

  - Vulnerability in the Oracle Database Data Redaction component of Oracle Database Server. Supported     versions that are affected are 19c and 21c. Easily exploitable vulnerability allows low privileged     attacker having Create Session privilege with network access via Oracle Net to compromise Oracle Database     Data Redaction. Successful attacks of this vulnerability can result in unauthorized read access to a     subset of Oracle Database Data Redaction accessible data. (CVE-2023-21827)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
170198	Oracle MySQL Python Connector (Jan 2023 CPU)	Nessus	Misc.	2023/1/20	2023/11/1	high
170200	Oracle MySQL NET Connector (Jan 2023 CPU)	Nessus	Misc.	2023/1/20	2023/11/1	high
170199	Oracle MySQL ODBC and C++ Connectors (Jan 2023 CPU)	Nessus	Misc.	2023/1/20	2023/11/1	high
192753	Oracle Enterprise Manager Agent (January 2023 CPU)	Nessus	Misc.	2024/4/2	2024/4/3	critical
170135	Oracle Enterprise Manager Cloud Control (Jan 2023 CPU)	Nessus	Misc.	2023/1/18	2023/10/24	high
170160	Oracle Enterprise Manager Ops Center UCE Patches (Jan 2023 CPU)	Nessus	Misc.	2023/1/19	2023/9/7	critical
170203	Oracle Access Manager Elevation of Privilege (Jan 2023 CPU)	Nessus	Misc.	2023/1/20	2023/1/23	medium
170161	Oracle Java SE Multiple Vulnerabilities (January 2023 CPU)	Nessus	Misc.	2023/1/19	2023/1/23	medium
187745	Oracle TimesTen < 11.2.2.8.65, 22.x < 22.1.1.5.0 Buffer Overflow (January 2023 CPU)	Nessus	Misc.	2024/1/9	2024/1/10	critical
170495	Oracle Business Intelligence Publisher (OBIEE) (Jan 2023 CPU)	Nessus	Windows	2023/1/24	2023/1/25	high
170197	Oracle WebCenter Sites (Jan 2023 CPU)	Nessus	Windows	2023/1/20	2023/10/24	critical
170496	Oracle Business Intelligence Publisher (OAS) (Jan 2023 CPU)	Nessus	Misc.	2023/1/24	2024/1/22	critical
159977	Oracle MySQL Server (Apr 2022 CPU)	Nessus	Databases	2022/4/20	2023/11/1	high
170195	Oracle MySQL Enterprise Monitor (Jan 2023 CPU)	Nessus	CGI abuses	2023/1/20	2023/11/1	critical
166310	Oracle MySQL Server (Oct 2022 CPU)	Nessus	Databases	2022/10/20	2023/11/1	medium
163332	Oracle MySQL Server (Jul 2022 CPU)	Nessus	Databases	2022/7/21	2023/11/1	critical
170193	Oracle Primavera Unifier (Jan 2023 CPU)	Nessus	CGI abuses	2023/1/20	2023/10/24	high
178010	Oracle Global Lifecycle Management (OPatch) (Jan 2023 CPU)	Nessus	Misc.	2023/7/6	2023/7/7	critical
170191	Oracle Database Server for Unix (Jan 2023 CPU)	Nessus	Databases	2023/1/20	2023/10/24	high
170194	Oracle Primavera Gateway (Jan 2023 CPU)	Nessus	CGI abuses	2023/1/20	2024/1/22	critical
170140	Oracle E-Business Suite (Jan 2023 CPU)	Nessus	Misc.	2023/1/18	2023/4/20	high
170192	Oracle Database Server for Windows (Jan 2023 CPU)	Nessus	Databases	2023/1/20	2023/10/24	high

偵測

搜尋 Plugin

high

high

high

critical

high

critical

medium

medium

critical

high

critical

critical

high

critical

medium

critical

high

critical

high

critical

high

high