The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-3645 advisory.

    - Resolves: RHEL-82946       tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT     (CVE-2025-24813)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:3608 advisory.

    Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web     applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster),     the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.

    This release of Red Hat JBoss Web Server 6.1.0 serves as a replacement for Red Hat JBoss Web Server 6.0.5.
    This release includes bug fixes, enhancements and component upgrades, which are documented in the Release     Notes that are linked to in the References section.

    Security Fix(es):

    * org.apache.tomcat/tomcat: Apache Tomcat: Authentication bypass when using Jakarta Authentication API     [jws-6] (CVE-2024-52316)
    * tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT     [jws-6] (CVE-2025-24813)
    * tomcat: Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame [jws-6] (CVE-2025-31650)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2025:0954-1 advisory.

    - CVE-2025-24813: Fixed potential RCE and/or information disclosure/corruption with partial PUT     (bsc#1239302)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:7497 advisory.

    * tomcat: Apache Tomcat: Authentication bypass when using Jakarta Authentication API (CVE-2024-52316)

    * tomcat: Apache Tomcat: DoS in examples web application (CVE-2024-54677)

    * tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT     (CVE-2025-24813)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-7494 advisory.

    [1:9.0.87-5]
    - Resolves: RHEL-82927       tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT     (CVE-2025-24813)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 6.10.1.7. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-6.10.1.7 advisory.

  - Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information     disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache     Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34,     from 9.0.0.M1 through 9.0.98. The following versions were EOL at the time the CVE was created but are     known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. If all of the     following were true, a malicious user was able to view security sensitive files and/or inject content into     those files: - writes enabled for the default servlet (disabled by default) - support for partial PUT     (enabled by default) - a target URL for security sensitive uploads that was a sub-directory of a target     URL for public uploads - attacker knowledge of the names of security sensitive files being uploaded - the     security sensitive files also being uploaded via partial PUT If all of the following were true, a     malicious user was able to perform remote code execution: - writes enabled for the default servlet     (disabled by default) - support for partial PUT (enabled by default) - application was using Tomcat's file     based session persistence with the default storage location - application included a library that may be     leveraged in a deserialization attack Users are recommended to upgrade to version 11.0.3, 10.1.35 or     9.0.99, which fixes the issue. (CVE-2025-24813)

  - libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and     xmlSchemaBubbleIDCNodeTables in xmlschemas.c. To exploit this, a crafted XML document must be validated     against an XML schema with certain identity constraints, or a crafted XML schema must be used.
    (CVE-2024-56171)

  - libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements     in valid.c. To exploit this, DTD validation must occur for an untrusted document or untrusted DTD. NOTE:
    this is similar to CVE-2017-9047. (CVE-2025-24928)

  - The ipaddress module contained incorrect information about whether certain IPv4 and IPv6 addresses were     designated as globally reachable or private. This affected the is_private and is_global properties of     the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and ipaddress.IPv6Network     classes, where values wouldn't be returned in accordance with the latest information from the IANA     Special-Purpose Address Registries. CPython 3.12.4 and 3.13.0a6 contain updated information from these     registries and thus have the intended behavior. (CVE-2024-4032)

  - A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote     code execution via its download functions. These functions, which are used to download packages from URLs     provided by users or retrieved from package index servers, are susceptible to code injection. If these     functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands     on the system. The issue is fixed in version 70.0. (CVE-2024-6345)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0225 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2025-24813:
    Path Equivalence: 'file.Name' (Internal Dot) leading toRemote Code Execution and/or Information     disclosureand/or malicious content added to uploaded files via write enabledDefault Servletin Apache     Tomcat.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from     9.0.0.M1 through 9.0.98.

    If all of the following were true, a malicious user was able to view       security sensitive files and/or     inject content into those files:
    -writes enabled for the default servlet (disabled by default)
    - support for partial PUT (enabled by default)
    - a target URL for security sensitive uploads that was a sub-directory ofa target URL for public uploads
    -attacker knowledge of the names of security sensitive files beinguploaded
    -the security sensitive files also being uploaded via partial PUT

    If all of the following were true, a malicious user was able to       perform remote code execution:
    - writes enabled for the default servlet (disabled by default)
    -support for partial PUT (enabled by default)
    -application was using Tomcat's file based session persistence with thedefault storage location
    -application included a library that may be leveraged in adeserialization attack

    Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.98, which fixes the issue.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2025-9846:02 advisory.

    * tomcat: RCE due to TOCTOU issue in JSP compilation (CVE-2024-50379)
      * tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT     (CVE-2025-24813)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
233976	Oracle Linux 9 : tomcat (ELSA-2025-3645)	Nessus	Oracle Linux Local Security Checks	4/7/2025	1/21/2026	critical
234285	RHEL 8 / 9 : Red Hat JBoss Web Server 6.1.0 (RHSA-2025:3608)	Nessus	Red Hat Local Security Checks	4/13/2025	8/15/2025	high
233004	SUSE SLES12: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (SUSE-SU-2025:0954-1)	Nessus	SuSE Local Security Checks	3/20/2025	6/26/2026	critical
266642	RockyLinux 10 : tomcat (RLSA-2025:7497)	Nessus	Rocky Linux Local Security Checks	10/6/2025	10/6/2025	critical
240927	Oracle Linux 10 : tomcat9 (ELSA-2025-7494)	Nessus	Oracle Linux Local Security Checks	6/30/2025	1/21/2026	critical
242590	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.10.1.7)	Nessus	Misc.	7/22/2025	9/1/2025	critical
276259	TencentOS Server 3: tomcat (TSSA-2025:0225)	Nessus	Tencent Local Security Checks	11/20/2025	3/11/2026	critical
283109	MiracleLinux 8 : tomcat-9.0.87-1.el8_10.3 (AXSA:2025-9846:02)	Nessus	Miracle Linux Local Security Checks	1/13/2026	1/16/2026	critical

Detections

Analytics

Plugins Search

critical

high

critical

critical

critical

critical

critical

critical