BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same.

The version of Atlassian Jira Service Management Data Center and Server (Jira Service Desk) running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16310 advisory.

  - BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than     72 characters as long as the first 72 characters are the same. (CVE-2025-22228)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of IBM Engineering Requirements Management DOORS (formerly IBM Rational DOORS) installed on the remote host is 9.7.2.9 prior to 9.7.2.10. It is, therefore, affected by multiple vulnerabilities as referenced in the 7238992 advisory.

  - CKEditor4 is an open source WYSIWYG HTML editor. In affected version a vulnerability has been discovered in the     core HTML processing module and may affect all plugins used by CKEditor 4. The vulnerability allowed to inject     malformed comments HTML bypassing content sanitization, which could result in executing JavaScript code. It     affects all users using the CKEditor 4 at version < 4.17.0. The problem has been recognized and patched. The     fix will be available in version 4.17.0. (CVE-2021-41165)

  - CKEditor4 is an open source WYSIWYG HTML editor. In affected versions a vulnerability has been discovered in the     Advanced Content Filter (ACF) module and may affect all plugins used by CKEditor 4. The vulnerability allowed to     inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. It affects     all users using the CKEditor 4 at version < 4.17.0. The problem has been recognized and patched. The fix will be     available in version 4.17.0. (CVE-2021-41164)

  - It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted     text into the Styles input of specific dialogs (in the Advanced Tab for Dialogs plugin). (CVE-2021-26271)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:10119 advisory.

    Jenkins is a continuous integration server that monitors executions of     repeated jobs, such as building a software project or jobs run by cron.

    Security Fix(es):

    * jenkins-2-plugins: Potential DoS via stack exhaustion (incomplete fix for     CVE-2023-1370) (CVE-2024-57699)
    * jenkins: CVE-2025-22228: Spring Security BCryptPasswordEncoder does not     enforce maximum password length (CVE-2025-22228)
    * jenkins: Jetty HTTP/2 Header List Size Vulnerability (CVE-2025-1948)
    * jenkins: jackson-core Potential StackoverflowError (CVE-2025-52999)
    * jenkins-2-plugins: jackson-core Potential StackoverflowError     (CVE-2025-52999)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:10097 advisory.

    Jenkins is a continuous integration server that monitors executions of     repeated jobs, such as building a software project or jobs run by cron.

    Security Fix(es):

    * jenkins-2-plugins: Potential DoS via stack exhaustion (incomplete fix for     CVE-2023-1370) (CVE-2024-57699)
    * jenkins: CVE-2025-22228: Spring Security BCryptPasswordEncoder does not     enforce maximum password length (CVE-2025-22228)
    * jenkins: Jetty HTTP/2 Header List Size Vulnerability (CVE-2025-1948)
    * jenkins: jackson-core Potential StackoverflowError (CVE-2025-52999)
    * jenkins-2-plugins: jackson-core Potential StackoverflowError     (CVE-2025-52999)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:10118 advisory.

    Jenkins is a continuous integration server that monitors executions of     repeated jobs, such as building a software project or jobs run by cron.

    Security Fix(es):

    * jenkins-2-plugins: Potential DoS via stack exhaustion (incomplete fix for     CVE-2023-1370) (CVE-2024-57699)
    * jenkins: CVE-2025-22228: Spring Security BCryptPasswordEncoder does not     enforce maximum password length (CVE-2025-22228)
    * jenkins: Jetty HTTP/2 Header List Size Vulnerability (CVE-2025-1948)
    * jenkins: jackson-core Potential StackoverflowError (CVE-2025-52999)
    * jenkins-2-plugins: jackson-core Potential StackoverflowError     (CVE-2025-52999)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:10120 advisory.

    Jenkins is a continuous integration server that monitors executions of     repeated jobs, such as building a software project or jobs run by cron.

    Security Fix(es):

    * jenkins-2-plugins: Potential DoS via stack exhaustion (incomplete fix for     CVE-2023-1370) (CVE-2024-57699)
    * jenkins: CVE-2025-22228: Spring Security BCryptPasswordEncoder does not     enforce maximum password length (CVE-2025-22228)
    * jenkins: Jetty HTTP/2 Header List Size Vulnerability (CVE-2025-1948)
    * jenkins: jackson-core Potential StackoverflowError (CVE-2025-52999)
    * jenkins-2-plugins: jackson-core Potential StackoverflowError     (CVE-2025-52999)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:10104 advisory.

    Jenkins is a continuous integration server that monitors executions of     repeated jobs, such as building a software project or jobs run by cron.

    Security Fix(es):

    * jenkins-2-plugins: Potential DoS via stack exhaustion (incomplete fix for     CVE-2023-1370) (CVE-2024-57699)
    * jenkins: CVE-2025-22228: Spring Security BCryptPasswordEncoder does not     enforce maximum password length (CVE-2025-22228)
    * jenkins: Jetty HTTP/2 Header List Size Vulnerability (CVE-2025-1948)
    * jenkins: jackson-core Potential StackoverflowError (CVE-2025-52999)
    * jenkins-2-plugins: jackson-core Potential StackoverflowError     (CVE-2025-52999)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:10098 advisory.

    Jenkins is a continuous integration server that monitors executions of     repeated jobs, such as building a software project or jobs run by cron.

    Security Fix(es):

    * jenkins-2-plugins: Potential DoS via stack exhaustion (incomplete fix for CVE-2023-1370)     (CVE-2024-57699)
    * jenkins: CVE-2025-22228: Spring Security BCryptPasswordEncoder does not enforce maximum password length     (CVE-2025-22228)
    * jenkins: Jetty HTTP/2 Header List Size Vulnerability (CVE-2025-1948)
    * jenkins: jackson-core Potential StackoverflowError (CVE-2025-52999)
    * jenkins-2-plugins: jackson-core Potential StackoverflowError (CVE-2025-52999)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:10092 advisory.

    Jenkins is a continuous integration server that monitors executions of     repeated jobs, such as building a software project or jobs run by cron.

    Security Fix(es):

    * jenkins-2-plugins: Potential DoS via stack exhaustion (incomplete fix for     CVE-2023-1370) (CVE-2024-57699)
    * jenkins: CVE-2025-22228: Spring Security BCryptPasswordEncoder does not     enforce maximum password length (CVE-2025-22228)
    * jenkins: Jetty HTTP/2 Header List Size Vulnerability (CVE-2025-1948)
    * jenkins: jackson-core Potential StackoverflowError (CVE-2025-52999)
    * jenkins-2-plugins: jackson-core Potential StackoverflowError     (CVE-2025-52999)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-99921 advisory.

  - BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than     72 characters as long as the first 72 characters are the same. (CVE-2025-22228)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host contains a Spring Security version that is 5.7 prior to 5.7.16, 5.8 prior to 5.8.18, 6.0 prior to 6.0.16, 6.1 prior to 6.1.14, 6.2 prior to 6.2.10, or 6.3 prior to 6.3.8, 6.4 prior to 6.4.4. It may, therefore, be affected by an authentication bypass vulnerability. BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
243396	Atlassian Jira Service Management Data Center and Server 5.12.x < 5.12.24 / 10.3.x < 10.3.7 / 10.4.x < 10.7.1 (JSDSERVER-16310)	Nessus	Misc.	high
242323	IBM Engineering Requirements Management DOORS 9.7.2.9 < 9.7.2.10 Multiple Vulnerabilities (7238992)	Nessus	Windows	medium
241116	RHEL 8 : Red Hat Product OCP Tools 4.13 OpenShift Jenkins (RHSA-2025:10119)	Nessus	Red Hat Local Security Checks	high
241114	RHEL 9 : Red Hat Product OCP Tools 4.17 OpenShift Jenkins (RHSA-2025:10097)	Nessus	Red Hat Local Security Checks	high
241108	RHEL 8 : Red Hat Product OCP Tools 4.12 OpenShift Jenkins (RHSA-2025:10118)	Nessus	Red Hat Local Security Checks	high
241105	RHEL 8 : Red Hat Product OCP Tools 4.14 OpenShift Jenkins (RHSA-2025:10120)	Nessus	Red Hat Local Security Checks	high
241103	RHEL 8 : Red Hat Product OCP Tools 4.15 OpenShift Jenkins (RHSA-2025:10104)	Nessus	Red Hat Local Security Checks	high
241102	RHEL 9 : Red Hat Product OCP Tools 4.16 OpenShift Jenkins (RHSA-2025:10098)	Nessus	Red Hat Local Security Checks	high
241079	RHEL 9 : Red Hat Product OCP Tools 4.18 OpenShift Jenkins (RHSA-2025:10092)	Nessus	Red Hat Local Security Checks	high
240182	Atlassian Confluence 7.13.x < 8.5.23 / 8.6.x < 9.2.5 / 9.3.x < 9.5.1 (CONFSERVER-99921)	Nessus	CGI abuses	high
233464	Spring Security 5.7 < 5.7.16 / 5.8 < 5.8.18 / 6.0 < 6.0.16 / 6.1 < 6.1.14 / 6.2 < 6.2.10 / 6.3 < 6.3.8 / 6.4 < 6.4.4 Authentication Bypass (CVE-2025-22228)	Nessus	Misc.	high

Detections

Analytics

CVE-2025-22228

high

Tenable Plugins

high

medium

high

high

high

high

high

high

high

high

high