CVSS: 3.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-12174
https://notcve.org/view.php?id=CVE-2024-12174
09 Dec 2024 — An Improper Certificate Validation vulnerability exists in Tenable Security Center where an authenticated, privileged attacker could intercept email messages sent from Security Center via a rogue SMTP server. • https://www.tenable.com/security/tns-2024-19 • CWE-295: Improper Certificate Validation •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-5759 – Improper privilege management
https://notcve.org/view.php?id=CVE-2024-5759
12 Jun 2024 — An improper privilege management vulnerability exists in Tenable Security Center where an authenticated, remote attacker could view unauthorized objects and launch scans without having the required privileges Existe una vulnerabilidad de administración de privilegios inadecuada en Tenable Security Center donde un atacante remoto autenticado podría ver objetos no autorizados e iniciar análisis sin tener los privilegios necesarios. • https://www.tenable.com/security/tns-2024-10 • CWE-269: Improper Privilege Management •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-1891 – Stored Cross Site Scripting
https://notcve.org/view.php?id=CVE-2024-1891
12 Jun 2024 — A stored cross site scripting vulnerability exists in Tenable Security Center where an authenticated, remote attacker could inject HTML code into a web application scan result page. Existe una vulnerabilidad de cross-site scripting almacenado en Tenable Security Center donde un atacante remoto autenticado podría inyectar código HTML en la página de resultados del análisis de una aplicación web. • https://www.tenable.com/security/tns-2024-10 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0CVE-2024-1471 – HTML Injection Vulnerability
https://notcve.org/view.php?id=CVE-2024-1471
14 Feb 2024 — An HTML injection vulnerability exists where an authenticated, remote attacker with administrator privileges on the Security Center application could modify Repository parameters, which could lead to HTML redirection attacks. Existe una vulnerabilidad de inyección de HTML en la que un atacante remoto autenticado con privilegios de administrador en la aplicación Security Center podría modificar los parámetros del repositorio, lo que podría provocar ataques de redirección de HTML. • https://www.tenable.com/security/tns-2024-02 • CWE-20: Improper Input Validation •
CVSS: 8.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-1367 – Command Injection Vulnerability in Tenable Security Center
https://notcve.org/view.php?id=CVE-2024-1367
14 Feb 2024 — A command injection vulnerability exists where an authenticated, remote attacker with administrator privileges on the Security Center application could modify Logging parameters, which could lead to the execution of arbitrary code on the Security Center host. Existe una vulnerabilidad de inyección de comandos donde un atacante remoto autenticado con privilegios de administrador en la aplicación Security Center podría modificar los parámetros de registro, lo que podría conducir a la ejecución de código arbit... • https://www.tenable.com/security/tns-2024-02 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 0CVE-2023-1522
https://notcve.org/view.php?id=CVE-2023-1522
05 Apr 2023 — SQL Injection in the Hardware Inventory report of Security Center 5.11.2. • https://www.genetec.com/blog/data-protection/high-severity-vulnerability-affecting-the-hardware-inventory-report-task-of-security-center • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-25045
https://notcve.org/view.php?id=CVE-2020-25045
02 Sep 2020 — Installers of Kaspersky Security Center and Kaspersky Security Center Web Console prior to 12 & prior to 12 Patch A were vulnerable to a DLL hijacking attack that allowed an attacker to elevate privileges in the system. Los instaladores de Kaspersky Security Center y Kaspersky Security Center Web Console versiones anteriores a 12 y anteriores a 12 Parche A, eran vulnerables a un ataque de secuestro de DLL que permitía a un atacante elevar los privilegios en el sistema • https://support.kaspersky.com/general/vulnerability.aspx?el=12430#290720 • CWE-427: Uncontrolled Search Path Element •
CVSS: 10.0EPSS: 70%CPEs: 10EXPL: 1CVE-2007-2584 – McAfee Security Center IsOldAppInstalled - ActiveX Buffer Overflow
https://notcve.org/view.php?id=CVE-2007-2584
09 May 2007 — Buffer overflow in the IsOldAppInstalled function in the McSubMgr.McSubMgr Subscription Manager ActiveX control (MCSUBMGR.DLL) in McAfee SecurityCenter before 6.0.25 and 7.x before 7.2.147 allows remote attackers to execute arbitrary code via a crafted argument. Desbordamiento de búfer en la función IsOldAppInstalled del control ActiveX McSubMgr.McSubMgr Subscription Manager (MCSUBMGR.DLL) en McAfee SecurityCenter anterior a 6.0.25 y 7.x anterior a 7.2.147 permite a atacantes remotos ejecutar código de su e... • https://www.exploit-db.com/exploits/3893 •
CVSS: 9.8EPSS: 82%CPEs: 25EXPL: 1CVE-2006-3961 – McAfee Subscription Manager - Remote Stack Buffer Overflow
https://notcve.org/view.php?id=CVE-2006-3961
01 Aug 2006 — Buffer overflow in McSubMgr ActiveX control (mcsubmgr.dll) in McAfee Security Center 6.0.23 for Internet Security Suite 2006, Wireless Home Network Security, Personal Firewall Plus, VirusScan, Privacy Service, SpamKiller, AntiSpyware, and QuickClean allows remote user-assisted attackers to execute arbitrary commands via long string parameters, which are later used in vsprintf. Desbordamiento de búfer en control ActiveX McSubMgr (mcsubmgr.dll) en McAfee Security Center 6.0.23 para Internet Security Suite 200... • https://www.exploit-db.com/exploits/16510 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •