tenable tenable.sc - vulnerabilities and exploits

(subscribe to this query)

5.4

CVSSv3

Stored XSS in Tenable.Sc prior to 5.14.0 could allow an authenticated remote malicious user to craft a request to execute arbitrary script code in a user's browser session. Updated input validation techniques have been implemented to correct this issue.

Tenable Tenable.sc 5.14.0 Tenable Tenable.sc 5.14.1

8.8

CVSSv3

As part of our Security Development Lifecycle, a potential privilege escalation issue was identified internally. This could allow a malicious actor with sufficient permissions to modify environment variables and abuse an impacted plugin in order to escalate privileges. We have re...

Tenable Nessus -Tenable Tenable.io -Tenable Tenable.sc -

5.4

CVSSv3

A stored cross-site scripting (XSS) vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users. An authenticated, remote attacker can exploit this by convincing a user to click a specially crafted URL, to execute arbitrary sc...

Tenable Tenable.sc

6.5

CVSSv3

A Server Side Request Forgery (SSRF) vulnerability exists in Tenable.sc due to improper validation of session & user-accessible input data. A privileged, authenticated remote attacker could interact with external and internal services covertly.

Tenable Tenable.sc

8.8

CVSSv3

Tenable.sc and Tenable.sc Core versions 5.13.0 up to and including 5.17.0 were found to contain a vulnerability that could allow an authenticated, unprivileged user to perform Remote Code Execution (RCE) on the Tenable.sc server via Hypertext Preprocessor unserialization.

Tenable Tenable.sc

5.7

CVSSv3

A formula injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users. An authenticated attacker could leverage the reporting system to export reports containing formulas, which would then require a victim to approve...

Tenable Tenable.sc

6.5

CVSSv3

A LDAP injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users. An authenticated attacker could generate data in Active Directory using the application account through blind LDAP injection.

Tenable Tenable.sc

7.5

CVSSv3

In certain scenarios in Tenable.sc before 5.17.0, a scanner could potentially be used outside the user's defined scan zone without a particular zone being specified within the Automatic Distribution configuration.

Tenable Tenable.sc

8.1

CVSSv3

Tenable.sc versions 5.14.0 up to and including 5.19.1 were found to contain a remote code execution vulnerability which could allow a remote, unauthenticated malicious user to execute code under special circumstances. An attacker would first have to stage a specific file type in ...

Tenable Tenable.sc

9.8

CVSSv3

Composer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install untrusted dependencies are subject to command injection and should upgrade their composer version. Other OSs and WSL are not affected. The issue has ...

Getcomposer Composer Tenable Tenable.sc

Get Started

1 2 3 4 5 6 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook