CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2023-5624 – Blind SQL Injection
https://notcve.org/view.php?id=CVE-2023-5624
Under certain conditions, Nessus Network Monitor was found to not properly enforce input validation. This could allow an admin user to alter parameters that could potentially allow a blindSQL injection. Bajo ciertas condiciones, se descubrió que Nessus Network Monitor no aplicaba adecuadamente la validación de entrada. Esto podría permitir a un usuario administrador modificar parámetros que potencialmente podrían permitir una inyección blindSQL. • https://www.tenable.com/security/tns-2023-34 • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-5623 – Privilege Escalation
https://notcve.org/view.php?id=CVE-2023-5623
NNM failed to properly set ACLs on its installation directory, which could allow a low privileged user to run arbitrary code with SYSTEM privileges where NNM is installed to a non-standard location NNM no pudo configurar correctamente las ACL en su directorio de instalación, lo que podría permitir a un usuario con pocos privilegios ejecutar código arbitrario con privilegios de SYSTEM cuando NNM está instalado en una ubicación no estándar. • https://www.tenable.com/security/tns-2023-34 • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-276: Incorrect Default Permissions •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-5622 – Privilege Escalation
https://notcve.org/view.php?id=CVE-2023-5622
Under certain conditions, Nessus Network Monitor could allow a low privileged user to escalate privileges to NT AUTHORITY\SYSTEM on Windows hosts by replacing a specially crafted file. Bajo ciertas condiciones, Nessus Network Monitor podría permitir que un usuario con pocos privilegios escale privilegios a NT AUTHORITY\SYSTEM en hosts de Windows reemplazando un archivo especialmente manipulado. This vulnerability allows local attackers to escalate privileges on affected installations of Tenable Nessus Network Monitor. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the configuration of OpenSSL. The process loads an OpenSSL configuration file from an unsecured location. • https://www.tenable.com/security/tns-2023-34 • CWE-269: Improper Privilege Management •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-3253 – Improper authorization in Nessus
https://notcve.org/view.php?id=CVE-2023-3253
An improper authorization vulnerability exists where an authenticated, low privileged remote attacker could view a list of all the users available in the application. • https://www.tenable.com/security/tns-2023-29 • CWE-863: Incorrect Authorization •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-3252 – Arbitrary File Write
https://notcve.org/view.php?id=CVE-2023-3252
An arbitrary file write vulnerability exists where an authenticated, remote attacker with administrator privileges could alter logging variables to overwrite arbitrary files on the remote host with log data, which could lead to a denial of service condition. • https://www.tenable.com/security/tns-2023-29 • CWE-427: Uncontrolled Search Path Element •