In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.

The version of IBM Engineering Requirements Management DOORS (formerly IBM Rational DOORS) installed on the remote host is 9.6.1.1 prior or equal to 9.6.1.13 or 9.7.2.1 prior or equal to 9.7.2.11. It is, therefore, affected by multiple vulnerabilities as referenced in the 7279145 advisory.

  - IBM DOORS Web Access do not limit the length of a connection which could allow for a Slowloris HTTP denial     of service attack to take place. This can cause the web server to become unresponsive. (CVE-2024-25039)

  - IBM DOORS Web Access is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated     attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality     potentially leading to credentials disclosure within a trusted session. (CVE-2025-0152)

  - IBM DOORS Web Access could allow a remote attacker to obtain sensitive information when a detailed     technical error message is returned in the browser. This information could be used in further attacks     against the system. (CVE-2020-4984)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Oracle Siebel CRM installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2025 CPU advisory.

  - Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely     rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those     rewrite rules effectively enforced security constraints, those constraints could be bypassed. (CVE-2025-31651)

  - Uncontrolled Resource Consumption vulnerability in Apache Commons IO. The org.apache.commons.io.input.XmlStreamReader     class may excessively consume CPU resources when processing maliciously crafted input. (CVE-2024-47554)

  - Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority     headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such     requests could trigger an OutOfMemoryException resulting in a denial of service. (CVE-2025-31650)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Oracle Siebel CRM installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2025 CPU advisory.

  - An excessive memory use issue (CWE-770) exists in Email-MIME, before version 1.954, which can cause denial of service     when parsing multipart MIME messages. The patch set (from 2020 and 2024) limits excessive depth and the total number     of parts. (CVE-2024-4140)

  - In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon     receiving a large invalid TLS frame. (CVE-2021-28165)

  - Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request     URIs passed to the library as java.net.URI object and pick the wrong target host for request execution. (CVE-2020-13956)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns     for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected     unless it is listed with both upper and lower case for the first character of the field, including upper     and lower case for the first character of all nested fields within the property path. (CVE-2022-22968)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns
    for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected
    unless it is listed with both upper and lower case for the first character of the field, including upper
    and lower case for the first character of all nested fields within the property path. (CVE-2022-22968)

The version of MySQL Enterprise Monitor installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2022 CPU advisory.

  - Vulnerability in the MySQL Enterprise Monitor product of Oracle MySQL (component: Monitoring: General     (Apache Log4j)). Supported versions that are affected are 8.0.29 and prior. Easily exploitable     vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise     MySQL Enterprise Monitor. Successful attacks of this vulnerability can result in takeover of MySQL     Enterprise Monitor. (CVE-2022-23305)

  - Vulnerability in the MySQL Enterprise Monitor product of Oracle MySQL (component: Monitoring: General     (Spring Framework)). Supported versions that are affected are 8.0.29 and prior. Easily exploitable     vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise     MySQL Enterprise Monitor. Successful attacks of this vulnerability can result in takeover of MySQL     Enterprise Monitor. (CVE-2022-22965)

  - Vulnerability in the MySQL Enterprise Monitor product of Oracle MySQL (component: Monitoring: General     (Apache Tomcat)). Supported versions that are affected are 8.0.29 and prior. Easily exploitable     vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise     MySQL Enterprise Monitor. Successful attacks of this vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete DOS) of MySQL Enterprise Monitor. (CVE-2021-42340)

  - Vulnerability in the MySQL Enterprise Monitor product of Oracle MySQL (component: Monitoring: General     (Spring Framework)). Supported versions that are affected are 8.0.29 and prior. The patterns for     disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is     listed with both upper and lower case for the first character of the field, including upper and lower case for the      first character of all nested fields within the property path. (CVE-2022-22968)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
333335	IBM Engineering Requirements Management DOORS 9.6.1.1 <= 9.6.1.13 / 9.7.2.1 < 9.7.2.11 Multiple Vulnerabilities (7279145)	Nessus	Windows	Local	high
271381	Oracle Siebel Server prior to 25.8 (October 2025 CPU)	Nessus	Misc.	Local	medium
271379	Oracle Siebel Server prior to 25.7 (October 2025 CPU)	Nessus	Misc.	Local	high
253274	Linux Distros Unpatched Vulnerability : CVE-2022-22968	Nessus	Misc.	Local	medium
414900	SCA: security update for org.springframework:spring-context (GHSA-g5mm-vmx4-3rg7)	Tenable Cloud Security	SCA Checks	Local	medium
414900	SCA: security update for org.springframework:spring-context (GHSA-g5mm-vmx4-3rg7)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
159917	Oracle MySQL Enterprise Monitor (Apr 2022 CPU)	Nessus	CGI abuses	Combined	critical

Detections

Analytics

CVE-2022-22968

medium

Tenable Plugins

high

medium

high

medium

medium

medium

critical