In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.

The versions of Oracle Siebel CRM installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2025 CPU advisory.

  - Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely     rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those     rewrite rules effectively enforced security constraints, those constraints could be bypassed. (CVE-2025-31651)

  - Uncontrolled Resource Consumption vulnerability in Apache Commons IO. The org.apache.commons.io.input.XmlStreamReader     class may excessively consume CPU resources when processing maliciously crafted input. (CVE-2024-47554)

  - Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority     headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such     requests could trigger an OutOfMemoryException resulting in a denial of service. (CVE-2025-31650)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Oracle Siebel CRM installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2025 CPU advisory.

  - An excessive memory use issue (CWE-770) exists in Email-MIME, before version 1.954, which can cause denial of service     when parsing multipart MIME messages. The patch set (from 2020 and 2024) limits excessive depth and the total number     of parts. (CVE-2024-4140)

  - In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon     receiving a large invalid TLS frame. (CVE-2021-28165)

  - Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request     URIs passed to the library as java.net.URI object and pick the wrong target host for request execution. (CVE-2020-13956)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns     for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected     unless it is listed with both upper and lower case for the first character of the field, including upper     and lower case for the first character of all nested fields within the property path. (CVE-2022-22968)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of MySQL Enterprise Monitor installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2022 CPU advisory.

  - Vulnerability in the MySQL Enterprise Monitor product of Oracle MySQL (component: Monitoring: General     (Apache Log4j)). Supported versions that are affected are 8.0.29 and prior. Easily exploitable     vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise     MySQL Enterprise Monitor. Successful attacks of this vulnerability can result in takeover of MySQL     Enterprise Monitor. (CVE-2022-23305)

  - Vulnerability in the MySQL Enterprise Monitor product of Oracle MySQL (component: Monitoring: General     (Spring Framework)). Supported versions that are affected are 8.0.29 and prior. Easily exploitable     vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise     MySQL Enterprise Monitor. Successful attacks of this vulnerability can result in takeover of MySQL     Enterprise Monitor. (CVE-2022-22965)

  - Vulnerability in the MySQL Enterprise Monitor product of Oracle MySQL (component: Monitoring: General     (Apache Tomcat)). Supported versions that are affected are 8.0.29 and prior. Easily exploitable     vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise     MySQL Enterprise Monitor. Successful attacks of this vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete DOS) of MySQL Enterprise Monitor. (CVE-2021-42340)

  - Vulnerability in the MySQL Enterprise Monitor product of Oracle MySQL (component: Monitoring: General     (Spring Framework)). Supported versions that are affected are 8.0.29 and prior. The patterns for     disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is     listed with both upper and lower case for the first character of the field, including upper and lower case for the      first character of all nested fields within the property path. (CVE-2022-22968)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
271381	Oracle Siebel Server prior to 25.8 (October 2025 CPU)	Nessus	Misc.	medium
271379	Oracle Siebel Server prior to 25.7 (October 2025 CPU)	Nessus	Misc.	high
253274	Linux Distros Unpatched Vulnerability : CVE-2022-22968	Nessus	Misc.	medium
159917	Oracle MySQL Enterprise Monitor (Apr 2022 CPU)	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2022-22968

medium

Tenable Plugins

medium

high

medium

critical