CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2025-1091 – Broken Authorization Schema
https://notcve.org/view.php?id=CVE-2025-1091
25 Feb 2025 — A Broken Authorization schema exists where any authenticated user could download IOA script and configuration files if the URL is known. • https://www.tenable.com/security/tns-2025-01 • CWE-862: Missing Authorization •
CVSS: 3.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-12174
https://notcve.org/view.php?id=CVE-2024-12174
09 Dec 2024 — An Improper Certificate Validation vulnerability exists in Tenable Security Center where an authenticated, privileged attacker could intercept email messages sent from Security Center via a rogue SMTP server. • https://www.tenable.com/security/tns-2024-19 • CWE-295: Improper Certificate Validation •
CVSS: 8.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-9158 – XSS
https://notcve.org/view.php?id=CVE-2024-9158
30 Sep 2024 — A stored cross site scripting vulnerability exists in Nessus Network Monitor where an authenticated, privileged local attacker could inject arbitrary code into the NNM UI via the local CLI. • https://www.tenable.com/security/tns-2024-17 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.6EPSS: 0%CPEs: 3EXPL: 0CVE-2024-3232 – Formula Injection Vulnerability
https://notcve.org/view.php?id=CVE-2024-3232
16 Jul 2024 — A formula injection vulnerability exists in Tenable Identity Exposure where an authenticated remote attacker with administrative privileges could manipulate application form fields in order to trick another administrator into executing CSV payloads. - CVE-2024-3232 • https://www.tenable.com/security/tns-2024-04 • CWE-1236: Improper Neutralization of Formula Elements in a CSV File •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-5759 – Improper privilege management
https://notcve.org/view.php?id=CVE-2024-5759
12 Jun 2024 — An improper privilege management vulnerability exists in Tenable Security Center where an authenticated, remote attacker could view unauthorized objects and launch scans without having the required privileges Existe una vulnerabilidad de administración de privilegios inadecuada en Tenable Security Center donde un atacante remoto autenticado podría ver objetos no autorizados e iniciar análisis sin tener los privilegios necesarios. • https://www.tenable.com/security/tns-2024-10 • CWE-269: Improper Privilege Management •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-1891 – Stored Cross Site Scripting
https://notcve.org/view.php?id=CVE-2024-1891
12 Jun 2024 — A stored cross site scripting vulnerability exists in Tenable Security Center where an authenticated, remote attacker could inject HTML code into a web application scan result page. Existe una vulnerabilidad de cross-site scripting almacenado en Tenable Security Center donde un atacante remoto autenticado podría inyectar código HTML en la página de resultados del análisis de una aplicación web. • https://www.tenable.com/security/tns-2024-10 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.2EPSS: 0%CPEs: 1EXPL: 0CVE-2024-3292 – Race Condition
https://notcve.org/view.php?id=CVE-2024-3292
17 May 2024 — A race condition vulnerability exists where an authenticated, local attacker on a Windows Nessus Agent host could modify installation parameters at installation time, which could lead to the execution of arbitrary code on the Nessus host. - CVE-2024-3292 Existe una vulnerabilidad de condición de ejecución donde un atacante local autenticado en un host de Nessus Agent de Windows podría modificar los parámetros de instalación en el momento de la instalación, lo que podría conducir a la ejecución de código arb... • https://www.tenable.com/security/tns-2024-09 • CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-3291 – Privilege Escalation
https://notcve.org/view.php?id=CVE-2024-3291
17 May 2024 — When installing Nessus Agent to a directory outside of the default location on a Windows host, Nessus Agent versions prior to 10.6.4 did not enforce secure permissions for sub-directories. This could allow for local privilege escalation if users had not secured the directories in the non-default installation location. Al instalar Nessus Agent en un directorio fuera de la ubicación predeterminada en un host de Windows, las versiones de Nessus Agent anteriores a la 10.6.4 no aplicaban permisos seguros para lo... • https://www.tenable.com/security/tns-2024-09 • CWE-281: Improper Preservation of Permissions •
CVSS: 8.2EPSS: 0%CPEs: 1EXPL: 0CVE-2024-3290 – Race Condition
https://notcve.org/view.php?id=CVE-2024-3290
17 May 2024 — A race condition vulnerability exists where an authenticated, local attacker on a Windows Nessus host could modify installation parameters at installation time, which could lead to the execution of arbitrary code on the Nessus host Existe una vulnerabilidad de condición de ejecución donde un atacante local autenticado en un host Nessus de Windows podría modificar los parámetros de instalación en el momento de la instalación, lo que podría llevar a la ejecución de código arbitrario en el host Nessus. • https://www.tenable.com/security/tns-2024-08 • CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-3289
https://notcve.org/view.php?id=CVE-2024-3289
17 May 2024 — When installing Nessus to a directory outside of the default location on a Windows host, Nessus versions prior to 10.7.3 did not enforce secure permissions for sub-directories. This could allow for local privilege escalation if users had not secured the directories in the non-default installation location. Al instalar Nessus en un directorio fuera de la ubicación predeterminada en un host de Windows, las versiones de Nessus anteriores a la 10.7.3 no aplicaban permisos seguros para los subdirectorios. Esto p... • https://www.tenable.com/security/tns-2024-08 • CWE-281: Improper Preservation of Permissions •