Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container. An application can be vulnerable when all the following are true: * the application is deployed as a WAR or with an embedded Servlet container * the Servlet container does not reject suspicious sequences https://jakarta.ee/specifications/servlet/6.1/jakarta-servlet-spec-6.1.html#uri-path-canonicalization * the application serves static resources https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title with Spring resource handling We have verified that applications deployed on Apache Tomcat or Eclipse Jetty are not vulnerable, as long as default security features are not disabled in the configuration. Because we cannot check exploits against all Servlet containers and configuration variants, we strongly recommend upgrading your application.

The version of AOS installed on the remote host is prior to 7.5.0.5. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-7.5.0.5 advisory.

  - Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. Tomcat did     not escape ANSI escape sequences in log messages. If Tomcat was running in a console on a Windows     operating system, and the console supported ANSI escape sequences, it was possible for an attacker to use     a specially crafted URL to inject ANSI escape sequences to manipulate the console and the clipboard and     attempt to trick an administrator into running an attacker controlled command. While no attack vector was     found, it may have been possible to mount this attack on other operating systems. This issue affects     Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.40 through     9.0.108. The following versions were EOL at the time the CVE was created but are known to be affected:
    8.5.60 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade     to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue. (CVE-2025-55754)

  - Spring Framework MVC applications can be vulnerable to a Path Traversal Vulnerability when deployed on a     non-compliant Servlet container. An application can be vulnerable when all the following are true: * the     application is deployed as a WAR or with an embedded Servlet container * the Servlet container does not     reject suspicious sequences https://jakarta.ee/specifications/servlet/6.1/jakarta-servlet-     spec-6.1.html#uri-path-canonicalization * the application serves static resources     https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title     with Spring resource handling We have verified that applications deployed on Apache Tomcat or Eclipse     Jetty are not vulnerable, as long as default security features are not disabled in the configuration.
    Because we cannot check exploits against all Servlet containers and configuration variants, we strongly     recommend upgrading your application. (CVE-2025-41242)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u461,     8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM     Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion     or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. (CVE-2025-53057)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u461,     8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM     Enterprise Edition: 21.3.15. Easily exploitable vulnerability allows unauthenticated attacker with network     access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical     data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition     accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g.,     through a web service which supplies data to the APIs. This vulnerability also applies to Java     deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets,     that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox     for security. (CVE-2025-53066)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 21.0.8 and     25; Oracle GraalVM for JDK: 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Difficult to exploit     vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise     Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this     vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle     GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web     Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from     the internet) and rely on the Java sandbox for security. (CVE-2025-61748)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 7.3.1.4. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-7.3.1.4 advisory.

  - Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker     to inject forged data into the cache. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0     through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1     through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1. (CVE-2025-40778)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u461,     8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM     Enterprise Edition: 21.3.15. Easily exploitable vulnerability allows unauthenticated attacker with network     access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical     data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition     accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g.,     through a web service which supplies data to the APIs. This vulnerability also applies to Java     deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets,     that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox     for security. (CVE-2025-53066)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u461,     8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM     Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion     or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. (CVE-2025-53057)

  - Spring Framework MVC applications can be vulnerable to a Path Traversal Vulnerability when deployed on a     non-compliant Servlet container. An application can be vulnerable when all the following are true: * the     application is deployed as a WAR or with an embedded Servlet container * the Servlet container does not     reject suspicious sequences https://jakarta.ee/specifications/servlet/6.1/jakarta-servlet-     spec-6.1.html#uri-path-canonicalization * the application serves static resources     https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title     with Spring resource handling We have verified that applications deployed on Apache Tomcat or Eclipse     Jetty are not vulnerable, as long as default security features are not disabled in the configuration.
    Because we cannot check exploits against all Servlet containers and configuration variants, we strongly     recommend upgrading your application. (CVE-2025-41242)

  - libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small     document that is submitted for parsing. (CVE-2025-59375)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 7.0.1.13. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-7.0.1.13 advisory.

  - Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker     to inject forged data into the cache. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0     through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1     through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1. (CVE-2025-40778)

  - The Spring Framework annotation detection mechanism may not correctly resolve annotations on methods     within type hierarchies with a parameterized super type with unbounded generics. This can be an issue if     such annotations are used for authorization decisions. Your application may be affected by this if you are     using Spring Security's @EnableMethodSecurity feature. You are not affected by this if you are not using     @EnableMethodSecurity or if you do not use security annotations on methods in generic superclasses or     generic interfaces. This CVE is published in conjunction with CVE-2025-41248     https://spring.io/security/cve-2025-41248 . (CVE-2025-41249)

  - Apache CXF stores large stream based messages as temporary files on the local filesystem. A bug was     introduced which means that the entire temporary file is read into memory and then logged. An attacker     might be able to exploit this to cause a denial of service attack by causing an out of memory exception.
    In addition, it is possible to configure CXF to encrypt temporary files to prevent sensitive credentials     from being cached unencrypted on the local filesystem, however this bug means that the cached files are     written out to logs unencrypted. Users are recommended to upgrade to versions 3.5.11, 3.6.6, 4.0.7 or     4.1.1, which fixes this issue. (CVE-2025-48795)

  - Spring Framework MVC applications can be vulnerable to a Path Traversal Vulnerability when deployed on a     non-compliant Servlet container. An application can be vulnerable when all the following are true: * the     application is deployed as a WAR or with an embedded Servlet container * the Servlet container does not     reject suspicious sequences https://jakarta.ee/specifications/servlet/6.1/jakarta-servlet-     spec-6.1.html#uri-path-canonicalization * the application serves static resources     https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title     with Spring resource handling We have verified that applications deployed on Apache Tomcat or Eclipse     Jetty are not vulnerable, as long as default security features are not disabled in the configuration.
    Because we cannot check exploits against all Servlet containers and configuration variants, we strongly     recommend upgrading your application. (CVE-2025-41242)

  - libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small     document that is submitted for parsing. (CVE-2025-59375)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Primavera Unifier installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2026 CPU advisory.

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component:
    Integration (Apache Tika)). Supported versions that are affected are 21.12.0-21.12.17, 22.12.0-22.12.15,     23.12.0-23.12.16, 24.12.0-24.12.12 and 25.12.0. Easily exploitable vulnerability allows unauthenticated     attacker with network access via HTTP to compromise Primavera Unifier. While the vulnerability is in     Primavera Unifier, attacks may significantly impact additional products (scope change). Successful attacks     of this vulnerability can result in unauthorized update, insert or delete access to some of Primavera     Unifier accessible data as well as unauthorized read access to a subset of Primavera Unifier accessible     data and unauthorized ability to cause a partial denial of service (partial DOS) of Primavera Unifier.
    (CVE-2025-66516)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Reports     (iTextPDF)). Supported versions that are affected are 21.12.0-21.12.17, 22.12.0-22.12.15,     23.12.0-23.12.16, 24.12.0-24.12.12 and 25.12.0. Easily exploitable vulnerability allows unauthenticated     attacker with network access via HTTPS to compromise Primavera Unifier. Successful attacks of this     vulnerability can result in takeover of Primavera Unifier. (CVE-2021-43113)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component:
    Integration (Spring Framework)). Supported versions that are affected are 22.12.0-22.12.15,     23.12.0-23.12.16, 24.12.0-24.12.12 and 25.12.0. Easily exploitable vulnerability allows unauthenticated     attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks of this     vulnerability can result in unauthorized access to critical data or complete access to all Primavera     Unifier accessible data. (CVE-2025-41242, CVE-2025-41249)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Spring Framework MVC applications can be vulnerable to a Path Traversal Vulnerability when deployed on a     non-compliant Servlet container. An application can be vulnerable when all the following are true: * the     application is deployed as a WAR or with an embedded Servlet container * the Servlet container does not     reject suspicious sequences https://jakarta.ee/specifications/servlet/6.1/jakarta-servlet-     spec-6.1.html#uri-path-canonicalization * the application serves static resources     https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title     with Spring resource handling We have verified that applications deployed on Apache Tomcat or Eclipse     Jetty are not vulnerable, as long as default security features are not disabled in the configuration.
    Because we cannot check exploits against all Servlet containers and configuration variants, we strongly     recommend upgrading your application. (CVE-2025-41242)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Spring Framework installed on the remote host is 5.3.x prior to 5.3.44, 6.1.x prior to 6.1.22, or 6.2.x prior to 6.2.810. It is, therefore, affected by a path traversal vulnerability:

  - Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a     non-compliant Servlet container. An application can be vulnerable when all the following are true:
      * the application is deployed as a WAR or with an embedded Servlet container
      * the Servlet container does not reject suspicious sequences 
      * the application serves static resources with Spring resource handling     We have verified that applications deployed on Apache Tomcat or Eclipse Jetty are not vulnerable, as long as default     security features are not disabled in the configuration. Because we cannot check exploits against all Servlet     containers and configuration variants, we strongly recommend upgrading your application.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
299031	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.5.0.5)	Nessus	Misc.	high
299029	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.3.1.4)	Nessus	Misc.	high
299020	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.0.1.13)	Nessus	Misc.	high
295029	Oracle Primavera Unifier (January 2026 CPU)	Nessus	CGI abuses	critical
260137	Linux Distros Unpatched Vulnerability : CVE-2025-41242	Nessus	Misc.	medium
253510	Spring Framework 5.3.x < 5.3.44 / 6.1.x < 6.1.22 / 6.2.x < 6.2.10 Path Traversal (CVE-2025-41242)	Nessus	Misc.	medium

Detections

Analytics

CVE-2025-41242

medium

Tenable Plugins

high

high

high

critical

medium

medium