In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol allowing to store git pack files in an Amazon S3 bucket, are vulnerable to XML External Entity (XXE) attacks when parsing XML files. This vulnerability can lead to information disclosure, denial of service, and other security issues.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:22775 advisory.

    Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly     application runtime. This release of Red Hat JBoss Enterprise Application Platform 8.0.11 serves as a     replacement for Red Hat JBoss Enterprise Application Platform 8.0.10, and includes bug fixes and     enhancements. See the Red Hat JBoss Enterprise Application Platform 8.0.11 Release Notes for information     about the most significant bug fixes and enhancements included in this release.

    Security Fix(es):

    * undertow: OutOfMemory when parsing form data encoding with application/x-www-form-urlencoded [eap-8.0.z]     (CVE-2024-3884)

    * org.eclipse.jgit: XXE vulnerability in Eclipse JGit [eap-8.0.z] (CVE-2025-4949)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:22773 advisory.

    Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly     application runtime. This release of Red Hat JBoss Enterprise Application Platform 8.0.11 serves as a     replacement for Red Hat JBoss Enterprise Application Platform 8.0.10, and includes bug fixes and     enhancements. See the Red Hat JBoss Enterprise Application Platform 8.0.11 Release Notes for information     about the most significant bug fixes and enhancements included in this release.

    Security Fix(es):

    * undertow: OutOfMemory when parsing form data encoding with application/x-www-form-urlencoded [eap-8.0.z]     (CVE-2024-3884)

    * org.eclipse.jgit: XXE vulnerability in Eclipse JGit [eap-8.0.z] (CVE-2025-4949)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:22187 advisory.

    Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly     application runtime. This release of Red Hat JBoss Enterprise Application Platform 8.1.2 serves as a     replacement for Red Hat JBoss Enterprise Application Platform 8.1.1, and includes bug fixes and     enhancements. See the Red Hat JBoss Enterprise Application Platform 8.1.2 Release Notes for information     about the most significant bug fixes and enhancements included in this release.

    Security Fix(es):

    * org.eclipse.jgit: XXE vulnerability in Eclipse JGit [eap-8.1.z] (CVE-2025-4949)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:22188 advisory.

    Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly     application runtime. This release of Red Hat JBoss Enterprise Application Platform 8.1.2 serves as a     replacement for Red Hat JBoss Enterprise Application Platform 8.1.1, and includes bug fixes and     enhancements. See the Red Hat JBoss Enterprise Application Platform 8.1.2 Release Notes for information     about the most significant bug fixes and enhancements included in this release.

    Security Fix(es):

    * org.eclipse.jgit: XXE vulnerability in Eclipse JGit [eap-8.1.z] (CVE-2025-4949)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2025 CPU advisory.

  - Vulnerability in the SQLcl (jgit) component of Oracle Database Server. Supported versions that are     affected are 23.4-23.9. Difficult to exploit vulnerability allows low privileged attacker having Valid     account privilege with network access via HTTP to compromise SQLcl (jgit). Successful attacks require     human interaction from a person other than the attacker. Successful attacks of this vulnerability can     result in unauthorized access to critical data or complete access to all SQLcl (jgit) accessible data.
    (CVE-2025-4949)

  - Vulnerability in the RDBMS (Python) component of Oracle Database Server. Supported versions that are     affected are 21.3-21.19 and 23.4-23.9. Easily exploitable vulnerability allows low privileged attacker     having Authenticated User privilege with logon to the infrastructure where RDBMS (Python) executes to     compromise RDBMS (Python). Successful attacks require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can result in takeover of RDBMS (Python).
    (CVE-2024-12254, CVE-2024-12718, CVE-2024-6923, CVE-2024-8088, CVE-2025-1795, CVE-2025-4138,     CVE-2025-4330, CVE-2025-4435, CVE-2025-4517)

  - Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are     19.3-19.28, 21.3-21.19 and 23.4-23.9. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via Oracle Net to compromise Java VM. Successful attacks of this vulnerability can     result in unauthorized creation, deletion or modification access to critical data or all Java VM     accessible data. (CVE-2025-61881)

  - Vulnerability in the Portable Clusterware component of Oracle Database Server. Supported versions that are     affected are 19.3-19.28, 21.3-21.19 and 23.4-23.9. Easily exploitable vulnerability allows unauthenticated     attacker with network access via Bonjour to compromise Portable Clusterware. While the vulnerability is in     Portable Clusterware, attacks may significantly impact additional products (scope change). Successful     attacks of this vulnerability can result in unauthorized read access to a subset of Portable Clusterware     accessible data. (CVE-2025-53047)

  - Vulnerability in the Unified Audit component of Oracle Database Server. Supported versions that are     affected are 23.4-23.9. Easily exploitable vulnerability allows high privileged attacker having DBA     privilege with network access via Oracle Net to compromise Unified Audit. Successful attacks of this     vulnerability can result in unauthorized update, insert or delete access to some of Unified Audit     accessible data. (CVE-2025-61749)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command     and the AmazonS3 class used to implement the experimental amazons3 git transport protocol allowing to     store git pack files in an Amazon S3 bucket, are vulnerable to XML External Entity (XXE) attacks when     parsing XML files. This vulnerability can lead to information disclosure, denial of service, and other     security issues. (CVE-2025-4949)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:02762-1 advisory.

    - CVE-2025-4949: Fixed the XXE vulnerability in ManifestParser and AmazonS3 class (bsc#1243647).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
277503	RHEL 9 : Red Hat JBoss Enterprise Application Platform 8.0.11 (RHSA-2025:22775)	Nessus	Red Hat Local Security Checks	medium
277474	RHEL 8 : Red Hat JBoss Enterprise Application Platform 8.0.11 (RHSA-2025:22773)	Nessus	Red Hat Local Security Checks	medium
277218	RHEL 8 : Red Hat JBoss Enterprise Application Platform 8.1.2 (RHSA-2025:22187)	Nessus	Red Hat Local Security Checks	medium
277205	RHEL 9 : Red Hat JBoss Enterprise Application Platform 8.1.2 Security update (Moderate) (RHSA-2025:22188)	Nessus	Red Hat Local Security Checks	medium
271256	Oracle Database Server (October 2025 CPU)	Nessus	Databases	high
259091	Linux Distros Unpatched Vulnerability : CVE-2025-4949	Nessus	Misc.	medium
249214	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : eclipse-jgit (SUSE-SU-2025:02762-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2025-4949

medium

Tenable Plugins

medium

medium

medium

medium

high

medium

medium