A security issue was found in Netplex Json-smart 2.5.0 through 2.5.1. When loading a specially crafted JSON input, containing a large number of ’{’, a stack exhaustion can be trigger, which could allow an attacker to cause a Denial of Service (DoS). This issue exists because of an incomplete fix for CVE-2023-1370.

oracle CPUJan2026: Business Intelligence Enterprise Edition

The version of Atlassian Jira Service Management Data Center and Server (Jira Service Desk) running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16510 advisory.

  - A security issue was found in Netplex Json-smart 2.5.0 through 2.5.1. When loading a specially crafted     JSON input, containing a large number of '{', a stack exhaustion can be trigger, which could allow an     attacker to cause a Denial of Service (DoS). This issue exists because of an incomplete fix for     CVE-2023-1370. (CVE-2024-57699)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle Business Intelligence Enterprise Edition 12.2.1.4 installed on the remote host is affected by multiple vulnerabilities as referenced in the January 2026 CPU advisory.

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Analytics Server (json-smart)). Supported versions that are affected are 7.6.0.0.0, 8.2.0.0.0     and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via     HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this     vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete     DOS) of Oracle Business Intelligence Enterprise Edition. (CVE-2024-57699)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Analytics Server (Apache POI)). Supported versions that are affected are 7.6.0.0.0, 8.2.0.0.0     and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via     multiple protocols to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of     this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS)     of Oracle Business Intelligence Enterprise Edition. (CVE-2025-31672)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Platform Security (Apache Commons Lang)). Supported versions that are affected are 7.6.0.0.0,     8.2.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network     access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this     vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of     Oracle Business Intelligence Enterprise Edition. (CVE-2025-48924)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 versions of WebLogic Server installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2025 CPU advisory.

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized     Thirdparty Jars (Spring Framework)). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and     14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via     HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in     unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data.     (CVE-2024-38819)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console     (Apache Commons BeanUtils)). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily     exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise     Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle     WebLogic Server. (CVE-2025-48734)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web     Container). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Oracle WebLogic Server. Successful attacks require human interaction from a person other than the     attacker and while the vulnerability is in Oracle WebLogic Server, attacks may significantly impact     additional products (scope change). Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Oracle WebLogic Server accessible data as well as unauthorized     read access to a subset of Oracle WebLogic Server accessible data. (CVE-2025-50073)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of IBM Engineering Requirements Management DOORS (formerly IBM Rational DOORS) installed on the remote host is 9.7.2.9 prior to 9.7.2.10. It is, therefore, affected by multiple vulnerabilities as referenced in the 7238992 advisory.

  - CKEditor4 is an open source WYSIWYG HTML editor. In affected version a vulnerability has been discovered in the     core HTML processing module and may affect all plugins used by CKEditor 4. The vulnerability allowed to inject     malformed comments HTML bypassing content sanitization, which could result in executing JavaScript code. It     affects all users using the CKEditor 4 at version < 4.17.0. The problem has been recognized and patched. The     fix will be available in version 4.17.0. (CVE-2021-41165)

  - CKEditor4 is an open source WYSIWYG HTML editor. In affected versions a vulnerability has been discovered in the     Advanced Content Filter (ACF) module and may affect all plugins used by CKEditor 4. The vulnerability allowed to     inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. It affects     all users using the CKEditor 4 at version < 4.17.0. The problem has been recognized and patched. The fix will be     available in version 4.17.0. (CVE-2021-41164)

  - It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted     text into the Styles input of specific dialogs (in the Advanced Tab for Dialogs plugin). (CVE-2021-26271)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:10119 advisory.

    Jenkins is a continuous integration server that monitors executions of     repeated jobs, such as building a software project or jobs run by cron.

    Security Fix(es):

    * jenkins-2-plugins: Potential DoS via stack exhaustion (incomplete fix for     CVE-2023-1370) (CVE-2024-57699)
    * jenkins: CVE-2025-22228: Spring Security BCryptPasswordEncoder does not     enforce maximum password length (CVE-2025-22228)
    * jenkins: Jetty HTTP/2 Header List Size Vulnerability (CVE-2025-1948)
    * jenkins: jackson-core Potential StackoverflowError (CVE-2025-52999)
    * jenkins-2-plugins: jackson-core Potential StackoverflowError     (CVE-2025-52999)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:10097 advisory.

    Jenkins is a continuous integration server that monitors executions of     repeated jobs, such as building a software project or jobs run by cron.

    Security Fix(es):

    * jenkins-2-plugins: Potential DoS via stack exhaustion (incomplete fix for     CVE-2023-1370) (CVE-2024-57699)
    * jenkins: CVE-2025-22228: Spring Security BCryptPasswordEncoder does not     enforce maximum password length (CVE-2025-22228)
    * jenkins: Jetty HTTP/2 Header List Size Vulnerability (CVE-2025-1948)
    * jenkins: jackson-core Potential StackoverflowError (CVE-2025-52999)
    * jenkins-2-plugins: jackson-core Potential StackoverflowError     (CVE-2025-52999)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:10118 advisory.

    Jenkins is a continuous integration server that monitors executions of     repeated jobs, such as building a software project or jobs run by cron.

    Security Fix(es):

    * jenkins-2-plugins: Potential DoS via stack exhaustion (incomplete fix for     CVE-2023-1370) (CVE-2024-57699)
    * jenkins: CVE-2025-22228: Spring Security BCryptPasswordEncoder does not     enforce maximum password length (CVE-2025-22228)
    * jenkins: Jetty HTTP/2 Header List Size Vulnerability (CVE-2025-1948)
    * jenkins: jackson-core Potential StackoverflowError (CVE-2025-52999)
    * jenkins-2-plugins: jackson-core Potential StackoverflowError     (CVE-2025-52999)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:10120 advisory.

    Jenkins is a continuous integration server that monitors executions of     repeated jobs, such as building a software project or jobs run by cron.

    Security Fix(es):

    * jenkins-2-plugins: Potential DoS via stack exhaustion (incomplete fix for     CVE-2023-1370) (CVE-2024-57699)
    * jenkins: CVE-2025-22228: Spring Security BCryptPasswordEncoder does not     enforce maximum password length (CVE-2025-22228)
    * jenkins: Jetty HTTP/2 Header List Size Vulnerability (CVE-2025-1948)
    * jenkins: jackson-core Potential StackoverflowError (CVE-2025-52999)
    * jenkins-2-plugins: jackson-core Potential StackoverflowError     (CVE-2025-52999)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:10104 advisory.

    Jenkins is a continuous integration server that monitors executions of     repeated jobs, such as building a software project or jobs run by cron.

    Security Fix(es):

    * jenkins-2-plugins: Potential DoS via stack exhaustion (incomplete fix for     CVE-2023-1370) (CVE-2024-57699)
    * jenkins: CVE-2025-22228: Spring Security BCryptPasswordEncoder does not     enforce maximum password length (CVE-2025-22228)
    * jenkins: Jetty HTTP/2 Header List Size Vulnerability (CVE-2025-1948)
    * jenkins: jackson-core Potential StackoverflowError (CVE-2025-52999)
    * jenkins-2-plugins: jackson-core Potential StackoverflowError     (CVE-2025-52999)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:10098 advisory.

    Jenkins is a continuous integration server that monitors executions of     repeated jobs, such as building a software project or jobs run by cron.

    Security Fix(es):

    * jenkins-2-plugins: Potential DoS via stack exhaustion (incomplete fix for CVE-2023-1370)     (CVE-2024-57699)
    * jenkins: CVE-2025-22228: Spring Security BCryptPasswordEncoder does not enforce maximum password length     (CVE-2025-22228)
    * jenkins: Jetty HTTP/2 Header List Size Vulnerability (CVE-2025-1948)
    * jenkins: jackson-core Potential StackoverflowError (CVE-2025-52999)
    * jenkins-2-plugins: jackson-core Potential StackoverflowError (CVE-2025-52999)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:10092 advisory.

    Jenkins is a continuous integration server that monitors executions of     repeated jobs, such as building a software project or jobs run by cron.

    Security Fix(es):

    * jenkins-2-plugins: Potential DoS via stack exhaustion (incomplete fix for     CVE-2023-1370) (CVE-2024-57699)
    * jenkins: CVE-2025-22228: Spring Security BCryptPasswordEncoder does not     enforce maximum password length (CVE-2025-22228)
    * jenkins: Jetty HTTP/2 Header List Size Vulnerability (CVE-2025-1948)
    * jenkins: jackson-core Potential StackoverflowError (CVE-2025-52999)
    * jenkins-2-plugins: jackson-core Potential StackoverflowError     (CVE-2025-52999)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-99835 advisory.

  - A security issue was found in Netplex Json-smart 2.5.0 through 2.5.1. When loading a specially crafted     JSON input, containing a large number of '{', a stack exhaustion can be trigger, which could allow an     attacker to cause a Denial of Service (DoS). This issue exists because of an incomplete fix for     CVE-2023-1370. (CVE-2024-57699)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Atlassian Jira Service Management Data Center and Server (Jira Service Desk) running on the remote host is affected by a denial of service vulnerability as referenced in the JSDSERVER-16144 advisory.

  - A security issue was found in Netplex Json-smart 2.5.0 through 2.5.1. When loading a specially crafted     JSON input, containing a large number of '{', a stack exhaustion can be trigger, which could allow an     attacker to cause a Denial of Service (DoS). This issue exists because of an incomplete fix for     CVE-2023-1370. (CVE-2024-57699)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The versions of Primavera Unifier installed on the remote host are affected by a denial of service vulnerability as referenced in the April 2025 CPU advisory.

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform     (json-smart)). Supported versions that are affected are 21.12.0-21.12.17, 22.12.0-22.12.15,     23.12.0-23.12.13 and 24.12.0-24.12.3. Easily exploitable vulnerability allows unauthenticated attacker     with network access via HTTP to compromise Primavera Unifier. Successful attacks of this vulnerability can     result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Primavera     Unifier. (CVE-2024-38819)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The versions of Primavera Gateway installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2025 CPU advisory.

  - Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: Admin     (Google Protobuf-Java)). Supported versions that are affected are 20.12.0-20.12.17 and 21.12.0-21.12.15.
    Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to     compromise Primavera Gateway. Successful attacks of this vulnerability can result in unauthorized ability     to cause a hang or frequently repeatable crash (complete DOS) of Primavera Gateway. (CVE-2024-7254)

  - Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: Admin     (json-smart)). Supported versions that are affected are 20.12.0-20.12.17 and 21.12.0-21.12.15. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Primavera Gateway. Successful attacks of this vulnerability can result in unauthorized ability to cause a     hang or frequently repeatable crash (complete DOS) of Primavera Gateway. (CVE-2024-57699)

  - Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: Admin     (Apache Commons IO)). Supported versions that are affected are 20.12.0-20.12.17 and 21.12.0-21.12.15.
    Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to     compromise Primavera Gateway. Successful attacks require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial     denial of service (partial DOS) of Primavera Gateway. (CVE-2024-47554)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Oracle Application Testing Suite installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2025 CPU advisory.

  - Vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager (component:
    Load Testing for Web Apps (json-smart)). The supported version that is affected is 13.3.0.1. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Oracle Application Testing Suite. Successful attacks of this vulnerability can result in unauthorized     ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Application Testing     Suite. (CVE-2024-57699)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A security issue was found in Netplex Json-smart 2.5.0 through 2.5.1. When loading a specially crafted     JSON input, containing a large number of '{', a stack exhaustion can be trigger, which could allow an     attacker to cause a Denial of Service (DoS). This issue exists because of an incomplete fix for     CVE-2023-1370. (CVE-2024-57699)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A security issue was found in Netplex Json-smart 2.5.0 through 2.5.1. When loading a specially crafted
    JSON input, containing a large number of ’{’, a stack exhaustion can be trigger, which could allow an
    attacker to cause a Denial of Service (DoS). This issue exists because of an incomplete fix for
    CVE-2023-1370. (CVE-2024-57699)

ID	Name	Product	Family	Type	Severity
304391	Atlassian Jira Service Management Data Center and Server 5.12.29 < 10.3.17 / 10.4.x < 11.3.3 (JSDSERVER-16510)	Nessus	Misc.	Local	high
296369	Oracle Business Intelligence Enterprise Edition (12.2.1.4) (January 2026 CPU)	Nessus	Misc.	Local	medium
242331	Oracle WebLogic Server (July 2025 CPU)	Nessus	Misc.	Local	medium
242323	IBM Engineering Requirements Management DOORS 9.7.2.9 < 9.7.2.10 Multiple Vulnerabilities (7238992)	Nessus	Windows	Local	medium
241116	RHEL 8 : Red Hat Product OCP Tools 4.13 OpenShift Jenkins (RHSA-2025:10119)	Nessus	Red Hat Local Security Checks	Local	high
241114	RHEL 9 : Red Hat Product OCP Tools 4.17 OpenShift Jenkins (RHSA-2025:10097)	Nessus	Red Hat Local Security Checks	Local	high
241108	RHEL 8 : Red Hat Product OCP Tools 4.12 OpenShift Jenkins (RHSA-2025:10118)	Nessus	Red Hat Local Security Checks	Local	high
241105	RHEL 8 : Red Hat Product OCP Tools 4.14 OpenShift Jenkins (RHSA-2025:10120)	Nessus	Red Hat Local Security Checks	Local	high
241103	RHEL 8 : Red Hat Product OCP Tools 4.15 OpenShift Jenkins (RHSA-2025:10104)	Nessus	Red Hat Local Security Checks	Local	high
241102	RHEL 9 : Red Hat Product OCP Tools 4.16 OpenShift Jenkins (RHSA-2025:10098)	Nessus	Red Hat Local Security Checks	Local	high
241079	RHEL 9 : Red Hat Product OCP Tools 4.18 OpenShift Jenkins (RHSA-2025:10092)	Nessus	Red Hat Local Security Checks	Local	high
240758	Atlassian Confluence 7.19.x < 8.5.22 / 8.6.x < 9.2.4 / 9.3.x < 9.4.1 (CONFSERVER-99835)	Nessus	CGI abuses	Combined	high
236968	Atlassian Jira Service Management Data Center and Server 5.12.4 < 5.12.22 / 5.13.x < 10.3.5 / 10.4.x < 10.5.1 DoS (JSDSERVER-16144)	Nessus	Misc.	Local	high
234790	Oracle Primavera Unifier DoS (Apr 2025 CPU)	Nessus	CGI abuses	Remote	high
234550	Oracle Primavera Gateway (Apr 2025 CPU)	Nessus	CGI abuses	Remote	high
234548	Oracle Application Testing Suite (April 2025 CPU)	Nessus	Misc.	Local	high
231555	Linux Distros Unpatched Vulnerability : CVE-2024-57699	Nessus	Misc.	Local	high
420878	SCA: security update for net.minidev:json-smart (GHSA-pq2g-wx69-c263)	Tenable Cloud Security	SCA Checks	Local	high
420878	SCA: security update for net.minidev:json-smart (GHSA-pq2g-wx69-c263)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2024-57699

high

Tenable Plugins

Coming Soon

high

medium

medium

medium

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high