Overview 147 matches · 0 in Waratek scope · 0 protected · 2 exploited · 0 CISA KEV · 6 public PoC · 0 EPSS ≥ 0.5
147matches
0in Waratek scope0.0%
0protected0.0%
2exploited1.4%
0CISA KEV0.0%
6public PoC4.1%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
147
100.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
147
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 28 / year
20131
Not applicable1
Medium1
not blocked1
No public exploit1
20143
Not applicable3
Medium3
not blocked3
Working exploit published1
No public exploit2
20150
20161
Not applicable1
Critical1
not blocked1
No public exploit1
201714
Not applicable14
Critical1
High6
Medium7
not blocked14
Exploited1
Working exploit published1
No public exploit12
20187
Not applicable7
High3
Medium4
not blocked7
No public exploit7
201917
Not applicable17
Critical2
High3
Medium11
Low1
not blocked17
Proof of concept only1
No public exploit16
202014
Not applicable14
Critical1
High6
Medium7
not blocked14
No public exploit14
202116
Not applicable16
Critical1
High5
Medium10
not blocked16
Proof of concept only1
No public exploit15
202214
Not applicable14
Critical3
High7
Medium4
not blocked14
Exploited1
No public exploit13
202317
Not applicable17
High8
Medium9
not blocked17
No public exploit17
20249
Not applicable9
High4
Medium5
not blocked9
No public exploit9
20256
Not applicable6
High6
not blocked6
No public exploit6
202628
Not applicable28
Critical9
High10
Medium5
Low4
not blocked28
Working exploit published3
No public exploit25
2014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-19682 | Critical | 2026-08-14 | Not applicable | No public exploit | A command injection vulnerability exists in Security Center where a remote, unauthenticated attacker could exploit this issue to execute arbitrary commands on the underlying operating system with the privileges of the service account. |
| CVE-2026-19681 | Critical | 2026-08-14 | Not applicable | Working exploit published | An authenticated command injection vulnerability exists in Security Center related to file upload processing. An attacker could exploit this issue by uploading a specially crafted file, potentially resulting in arbitrary command execution on the underlying operating system. |
| CVE-2026-19680 | High | 2026-08-14 | Not applicable | No public exploit | A SQL injection vulnerability exists in Security Center that could allow an attacker to access unauthorized data from the application's database. |
| CVE-2026-19679 | High | 2026-08-14 | Not applicable | No public exploit | An input validation vulnerability exists in Security Center's file upload handling, where insufficient sanitization of uploaded filenames could contribute to a downstream command injection issue. |
| CVE-2026-19639 | Medium | 2026-08-14 | Not applicable | No public exploit | An improper access control vulnerability exists where an authenticated non-administrative application user could potentially view settings outside of their assigned scope. |
| CVE-2026-19636 | Medium | 2026-08-14 | Not applicable | No public exploit | An issue was identified in which CSRF tokens were generated using a predictable method, potentially reducing their effectiveness as a security control. This has been addressed by improving the randomness and entropy of token generation. |
| CVE-2026-19635 | High | 2026-08-14 | Not applicable | No public exploit | A local privilege escalation vulnerability exists in Security Center. An attacker with write access to a specific configuration file could achieve arbitrary code execution with elevated privileges, without requiring further user or victim interaction. |
| CVE-2026-19631 | Medium | 2026-08-14 | Not applicable | No public exploit | A SQL injection vulnerability exists in Security Center that could allow an authenticated administrator to execute arbitrary SQL queries, potentially resulting in unauthorized access to sensitive data, including credentials. |
| CVE-2026-19629 | High | 2026-08-14 | Not applicable | No public exploit | A privilege escalation vulnerability exists in Tenable Security Center that allows a user with "Security Manager" role and "manage user" permission on a single group to modify users belonging to other groups. This bypasses the intended access control restrictions and enables unauthorized cross-group user management. |
| CVE-2026-19628 | High | 2026-08-14 | Not applicable | No public exploit | A command injection vulnerability exists in Tenable Security Center. An authenticated administrator could modify application configuration values to achieve arbitrary command execution on the underlying operating system when specific backend operations are triggered. |
| CVE-2026-19626 | Critical | 2026-08-14 | Not applicable | Working exploit published | A remote code execution vulnerability exists in Tenable Security Center's report generation functionality. An authenticated, non-administrative user could exploit this issue by supplying specially crafted input that is later processed unsafely during server-side report rendering, resulting in arbitrary code execution with the privileges of the service account. |
| CVE-2026-64881 | High | 2026-07-21 | Not applicable | No public exploit | The audit file upload handler does not sanitize filenames, allowing shell metacharacters to flow into system command execution. This input validation failure enables command injection when chained with a related vulnerability. |
| CVE-2026-64880 | High | 2026-07-21 | Not applicable | No public exploit | Unsanitized user-supplied input in report filtering parameters is concatenated directly into SQL queries without proper escaping or parameterized queries, enabling blind SQL injection and unauthorized database read access. |
| CVE-2026-64879 | Critical | 2026-07-21 | Not applicable | No public exploit | A filename supplied during file upload is not properly sanitized before being used in system command execution, allowing an attacker to inject shell metacharacters and achieve command injection via the audit file upload functionality. |
| CVE-2026-64878 | Critical | 2026-07-21 | Not applicable | No public exploit | Unvalidated input in asset filter parameters allows shell metacharacters to escape command argument handling, resulting in remote code execution as a low-privileged OS user via the Analysis REST endpoint. |
| CVE-2026-64877 | Critical | 2026-07-21 | Not applicable | No public exploit | An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API to access sensitive data stored in the appliance database. |
| CVE-2026-15265 | Critical | 2026-07-14 | Not applicable | No public exploit | A path traversal vulnerability in Tenable Agent 11.2.0 and 11.1.3 and lower allows a privileged attacker to write arbitrary files outside the intended plugin directory, potentially leading to remote code execution. |
| CVE-2026-57588 | Low | 2026-06-25 | Not applicable | Working exploit published | A SQL injection vulnerability in Nessus allows an attacker to craft a malicious scan result file that, when imported by a privileged user, injects malicious SQL into the scan results database, potentially enabling exfiltration of scan-result data. |
| CVE-2026-57587 | Low | 2026-06-25 | Not applicable | No public exploit | A SQL injection vulnerability in Nessus allows a remote, unauthenticated attacker who controls reverse DNS records for a scanned host to inject malicious SQL into the scan results database, potentially enabling exfiltration of scan-result data. |
| CVE-2026-13007 | High | 2026-06-23 | Not applicable | No public exploit | Tenable Identity Exposure contains multiple unauthenticated API endpoints under /w/api/* that expose sensitive application configuration data including cleartext LDAP credentials, SAML configuration, user accounts, and directory settings to unauthenticated remote attackers. Affected responses are served with Cache-Control: public headers and without Vary: Cookie, allowing reverse proxies and CDNs to cache and serve sensitive data to unauthenticated users even after authentication is applied. |
| CVE-2026-47358 | Critical | 2026-05-19 | Not applicable | No public exploit | Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via external URL resolution in uploaded IaC templates when running in server mode. When Terrascan parses uploaded ARM templates or CloudFormation templates, it resolves external URLs referenced within those templates via hashicorp/go-getter with all default detectors enabled, including FileDetector. An unauthenticated remote attacker can upload an ARM template containing a templateLink.uri or parametersLink.uri field, or a CloudFormation template containing an AWS::CloudFormation::Stack TemplateURL field, pointing to an attacker-controlled URL. Terrascan will fetch the attacker-controlled URL server-side. Unlike SSRF via the remote scan endpoint, file:// URLs are directly usable without requiring an X-Terraform-Get redirect, enabling local file read. This affects deployments running terrascan in server mode (terrascan server), which binds to 0.0.0.0 with no authentication. Note: Terrascan was archived in August 2023 and no patch will be released. |
| CVE-2026-47357 | Critical | 2026-05-19 | Not applicable | No public exploit | Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via the remote_url parameter in the remote directory scan endpoint (POST /v1/{iac}/{iacVersion}/{cloud}/remote/dir/scan) when running in server mode. An unauthenticated remote attacker can supply an attacker-controlled HTTP URL as remote_url with remote_type set to "http". The URL is passed directly to hashicorp/go-getter (v1.7.5) without validation. Go-getter's HttpGetter supports the X-Terraform-Get response header, allowing the attacker's server to redirect the download to a file:// URL, enabling local file read. Additionally, HttpGetter has Netrc set to true, causing it to read ~/.netrc and send stored credentials to attacker-controlled hostnames. This affects deployments running terrascan in server mode (terrascan server), which binds to 0.0.0.0 with no authentication. Note: Terrascan was archived in August 2023 and no patch will be released. |
| CVE-2026-47356 | High | 2026-05-19 | Not applicable | No public exploit | Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via the webhook_url parameter in the file scan endpoint (POST /v1/{iac}/{iacVersion}/{cloud}/local/file/scan) when running in server mode. An unauthenticated remote attacker can supply an arbitrary URL as the webhook_url multipart form parameter. After scanning the uploaded file, Terrascan sends an HTTP POST request to the attacker-controlled URL containing the full scan results as a JSON body, with the attacker-supplied webhook_token forwarded as a Bearer token in the Authorization header. The retryable HTTP client retries up to 10 times on failure. This affects deployments running terrascan in server mode (terrascan server), which binds to 0.0.0.0 with no authentication. Note: Terrascan was archived in August 2023 and no patch will be released. |
| CVE-2026-33694 | High | 2026-04-23 | Not applicable | No public exploit | This vulnerability allows an attacker to create a junction, enabling the deletion of arbitrary files with SYSTEM privileges. As a result, this condition potentially facilitates arbitrary code execution, whereby an attacker may exploit the vulnerability to execute malicious code with elevated SYSTEM privileges. |
| CVE-2026-4433 | Low | 2026-03-24 | Not applicable | No public exploit | An SSH misconfigurations exists in Tenable OT that led to the potential exfiltration of socket, port, and service information via the ostunnel user and GatewayPorts. This could be used to potentially glean information about the underlying system and give an attacker information that could be used to attempt to compromise the host. |
| CVE-2026-2698 | Medium | 2026-02-23 | Not applicable | No public exploit | An improper access control vulnerability exists where an authenticated user could access areas outside of their authorized scope. |
| CVE-2026-2697 | Low | 2026-02-23 | Not applicable | No public exploit | An Indirect Object Reference (IDOR) in Security Center allows an authenticated remote attacker to escalate privileges via the 'owner' parameter. |
| CVE-2026-2026 | Medium | 2026-02-13 | Not applicable | No public exploit | A vulnerability has been identified where weak file permissions in the Nessus Agent directory on Windows hosts could allow unauthorized access, potentially permitting Denial of Service (DoS) attacks. |
| CVE-2025-36630 | High | 2025-07-02 | Not applicable | No public exploit | In Tenable Nessus versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could overwrite arbitrary local system files with log content at SYSTEM privilege. |
| CVE-2025-36632 | High | 2025-06-16 | Not applicable | No public exploit | In Tenable Agent versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could execute code with SYSTEM privilege. |
| CVE-2025-36633 | High | 2025-06-13 | Not applicable | No public exploit | In Tenable Agent versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could arbitrarily delete local system files with SYSTEM privilege, potentially leading to local privilege escalation. |
| CVE-2025-36631 | High | 2025-06-13 | Not applicable | No public exploit | In Tenable Agent versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could overwrite arbitrary local system files with log content at SYSTEM privilege. |
| CVE-2025-24917 | High | 2025-05-23 | Not applicable | No public exploit | In Tenable Network Monitor versions prior to 6.5.1 on a Windows host, it was found that a non-administrative user could stage files in a local directory to run arbitrary code with SYSTEM privileges, potentially leading to local privilege escalation. |
| CVE-2025-24916 | High | 2025-05-23 | Not applicable | No public exploit | When installing Tenable Network Monitor to a non-default location on a Windows host, Tenable Network Monitor versions prior to 6.5.1 did not enforce secure permissions for sub-directories. This could allow for local privilege escalation if users had not secured the directories in the non-default installation location. |
| CVE-2024-9158 | High | 2024-09-30 | Not applicable | No public exploit | A stored cross site scripting vulnerability exists in Nessus Network Monitor where an authenticated, privileged local attacker could inject arbitrary code into the NNM UI via the local CLI. |
| CVE-2024-3232 | High | 2024-07-16 | Not applicable | No public exploit | A formula injection vulnerability exists in Tenable Identity Exposure where an authenticated remote attacker with administrative privileges could manipulate application form fields in order to trick another administrator into executing CSV payloads. - CVE-2024-3232 |
| CVE-2024-5759 | Medium | 2024-06-12 | Not applicable | No public exploit | An improper privilege management vulnerability exists in Tenable Security Center where an authenticated, remote attacker could view unauthorized objects and launch scans without having the required privileges |
| CVE-2024-1891 | Medium | 2024-06-12 | Not applicable | No public exploit | A stored cross site scripting vulnerability exists in Tenable Security Center where an authenticated, remote attacker could inject HTML code into a web application scan result page. |
| CVE-2024-1683 | High | 2024-02-23 | Not applicable | No public exploit | A DLL injection vulnerability exists where an authenticated, low-privileged local attacker could modify application files on the TIE Secure Relay host, which could allow for overriding of the configuration and running of new Secure Relay services. |
| CVE-2024-1471 | Medium | 2024-02-14 | Not applicable | No public exploit | An HTML injection vulnerability exists where an authenticated, remote attacker with administrator privileges on the Security Center application could modify Repository parameters, which could lead to HTML redirection attacks. |
| CVE-2024-1367 | High | 2024-02-14 | Not applicable | No public exploit | A command injection vulnerability exists where an authenticated, remote attacker with administrator privileges on the Security Center application could modify Logging parameters, which could lead to the execution of arbitrary code on the Security Center host. |
| CVE-2024-0971 | Medium | 2024-02-07 | Not applicable | No public exploit | A SQL injection vulnerability exists where an authenticated, low-privileged remote attacker could potentially alter scan DB content. |
| CVE-2024-0955 | Medium | 2024-02-07 | Not applicable | No public exploit | A stored XSS vulnerability exists where an authenticated, remote attacker with administrator privileges on the Nessus application could alter Nessus proxy settings, which could lead to the execution of remote arbitrary scripts. |
| CVE-2023-6178 | Medium | 2023-11-20 | Not applicable | No public exploit | An arbitrary file write vulnerability exists where an authenticated attacker with privileges on the managing application could alter Nessus Rules variables to overwrite arbitrary files on the remote host, which could lead to a denial of service condition. |
| CVE-2023-6062 | Medium | 2023-11-20 | Not applicable | No public exploit | An arbitrary file write vulnerability exists where an authenticated, remote attacker with administrator privileges on the Nessus application could alter Nessus Rules variables to overwrite arbitrary files on the remote host, which could lead to a denial of service condition. |
| CVE-2023-5847 | High | 2023-11-01 | Not applicable | No public exploit | Under certain conditions, a low privileged attacker could load a specially crafted file during installation or upgrade to escalate privileges on Windows and Linux hosts. |
| CVE-2023-5624 | High | 2023-10-26 | Not applicable | No public exploit | Under certain conditions, Nessus Network Monitor was found to not properly enforce input validation. This could allow an admin user to alter parameters that could potentially allow a blindSQL injection. |
| CVE-2023-5623 | High | 2023-10-26 | Not applicable | No public exploit | NNM failed to properly set ACLs on its installation directory, which could allow a low privileged user to run arbitrary code with SYSTEM privileges where NNM is installed to a non-standard location |
| CVE-2023-5622 | High | 2023-10-26 | Not applicable | No public exploit | Under certain conditions, Nessus Network Monitor could allow a low privileged user to escalate privileges to NT AUTHORITY\SYSTEM on Windows hosts by replacing a specially crafted file. |
| CVE-2023-3253 | Medium | 2023-08-29 | Not applicable | No public exploit | An improper authorization vulnerability exists where an authenticated, low privileged remote attacker could view a list of all the users available in the application. |
| CVE-2023-3252 | Medium | 2023-08-29 | Not applicable | No public exploit | An arbitrary file write vulnerability exists where an authenticated, remote attacker with administrator privileges could alter logging variables to overwrite arbitrary files on the remote host with log data, which could lead to a denial of service condition. |
| CVE-2023-3251 | Medium | 2023-08-29 | Not applicable | No public exploit | A pass-back vulnerability exists where an authenticated, remote attacker with administrator privileges could uncover stored SMTP credentials within the Nessus application.This issue affects Nessus: before 10.6.0. |
| CVE-2023-2005 | High | 2023-06-26 | Not applicable | No public exploit | Vulnerability in Tenable Tenable.Io, Tenable Nessus, Tenable Security Center.This issue affects Tenable.Io: before Plugin Feed ID #202306261202 ; Nessus: before Plugin Feed ID #202306261202 ; Security Center: before Plugin Feed ID #202306261202 . This vulnerability could allow a malicious actor with sufficient permissions on a scan target to place a binary in a specific filesystem location, and abuse the impacted plugin in order to escalate privileges. |
| CVE-2022-4313 | High | 2023-03-15 | Not applicable | No public exploit | A vulnerability was reported where through modifying the scan variables, an authenticated user in Tenable products, that has Scan Policy Configuration roles, could manipulate audit policy variables to execute arbitrary commands on credentialed scan targets. |
| CVE-2023-0524 | High | 2023-02-01 | Not applicable | No public exploit | As part of our Security Development Lifecycle, a potential privilege escalation issue was identified internally. This could allow a malicious actor with sufficient permissions to modify environment variables and abuse an impacted plugin in order to escalate privileges. We have resolved the issue and also made several defense-in-depth fixes alongside. While the probability of successful exploitation is low, Tenable is committed to securing our customers’ environments and our products. The updates have been distributed via the Tenable plugin feed in feed serial numbers equal to or greater than #202212212055. |
| CVE-2023-24495 | Medium | 2023-01-26 | Not applicable | No public exploit | A Server Side Request Forgery (SSRF) vulnerability exists in Tenable.sc due to improper validation of session & user-accessible input data. A privileged, authenticated remote attacker could interact with external and internal services covertly. |
| CVE-2023-24494 | Medium | 2023-01-26 | Not applicable | No public exploit | A stored cross-site scripting (XSS) vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users. An authenticated, remote attacker can exploit this by convincing a user to click a specially crafted URL, to execute arbitrary script code in a user's browser session. |
| CVE-2023-24493 | Medium | 2023-01-26 | Not applicable | No public exploit | A formula injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users. An authenticated attacker could leverage the reporting system to export reports containing formulas, which would then require a victim to approve and execute on a host. |
| CVE-2023-0476 | Medium | 2023-01-26 | Not applicable | No public exploit | A LDAP injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users. An authenticated attacker could generate data in Active Directory using the application account through blind LDAP injection. |
| CVE-2023-0101 | High | 2023-01-20 | Not applicable | No public exploit | A privilege escalation vulnerability was identified in Nessus versions 8.10.1 through 8.15.8 and 10.0.0 through 10.4.1. An authenticated attacker could potentially execute a specially crafted file to obtain root or NT AUTHORITY / SYSTEM privileges on the Nessus host. |
| CVE-2022-3499 | Medium | 2022-10-31 | Not applicable | No public exploit | An authenticated attacker could utilize the identical agent and cluster node linking keys to potentially allow for a scenario where unauthorized disclosure of agent logs and data is present. |
| CVE-2022-33757 | Medium | 2022-10-25 | Not applicable | No public exploit | An authenticated attacker could read Nessus Debug Log file attachments from the web UI without having the correct privileges to do so. This may lead to the disclosure of information on the scan target and/or the Nessus scan to unauthorized parties able to reach the Nessus instance. |
| CVE-2022-28291 | Medium | 2022-10-17 | Not applicable | No public exploit | Insufficiently Protected Credentials: An authenticated user with debug privileges can retrieve stored Nessus policy credentials from the “nessusd” process in cleartext via process dumping. The affected products are all versions of Nessus Essentials and Professional. The vulnerability allows an attacker to access credentials stored in Nessus scanners, potentially compromising its customers’ network of assets. |
| CVE-2022-32974 | Medium | 2022-06-21 | Not applicable | No public exploit | An authenticated attacker could read arbitrary files from the underlying operating system of the scanner using a custom crafted compliance audit file without providing any valid SSH credentials. |
| CVE-2022-32973 | High | 2022-06-21 | Not applicable | No public exploit | An authenticated attacker could create an audit file that bypasses PowerShell cmdlet checks and executes commands with administrator privileges. |
| CVE-2022-24828 | High | 2022-04-13 | Not applicable | No public exploit | Composer is a dependency manager for the PHP programming language. Integrators using Composer code to call `VcsDriver::getFileContent` can have a code injection vulnerability if the user can control the `$file` or `$identifier` argument. This leads to a vulnerability on packagist.org for example where the composer.json's `readme` field can be used as a vector for injecting parameters into hg/Mercurial via the `$file` argument, or git via the `$identifier` argument if you allow arbitrary data there (Packagist does not, but maybe other integrators do). Composer itself should not be affected by the vulnerability as it does not call `getFileContent` with arbitrary data into `$file`/`$identifier`. To the best of our knowledge this was not abused, and the vulnerability has been patched on packagist.org and Private Packagist within a day of the vulnerability report. |
| CVE-2022-24785 | High | 2022-04-04 | Not applicable | Exploited | Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js. |
| CVE-2022-0130 | High | 2022-01-14 | Not applicable | No public exploit | Tenable.sc versions 5.14.0 through 5.19.1 were found to contain a remote code execution vulnerability which could allow a remote, unauthenticated attacker to execute code under special circumstances. An attacker would first have to stage a specific file type in the web server root of the Tenable.sc host prior to remote exploitation. |
| CVE-2022-22827 | High | 2022-01-10 | Not applicable | No public exploit | storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. |
| CVE-2022-22826 | High | 2022-01-10 | Not applicable | No public exploit | nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. |
| CVE-2022-22825 | High | 2022-01-10 | Not applicable | No public exploit | lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. |
| CVE-2022-22824 | Critical | 2022-01-10 | Not applicable | No public exploit | defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. |
| CVE-2022-22823 | Critical | 2022-01-10 | Not applicable | No public exploit | build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. |
| CVE-2022-22822 | Critical | 2022-01-10 | Not applicable | No public exploit | addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. |
| CVE-2021-21707 | Medium | 2021-11-29 | Not applicable | No public exploit | In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode the filename passed to them. If that filename contains URL-encoded NUL character, this may cause the function to interpret this as the end of the filename, thus interpreting the filename differently from what the user intended, which may lead it to reading a different file than intended. |
| CVE-2021-20135 | Medium | 2021-11-03 | Not applicable | No public exploit | Nessus versions 8.15.2 and earlier were found to contain a local privilege escalation vulnerability which could allow an authenticated, local administrator to run specific executables on the Nessus Agent host. Tenable has included a fix for this issue in Nessus 10.0.0. The installation files can be obtained from the Tenable Downloads Portal (https://www.tenable.com/downloads/nessus). |
| CVE-2021-41116 | Critical | 2021-10-05 | Not applicable | No public exploit | Composer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install untrusted dependencies are subject to command injection and should upgrade their composer version. Other OSs and WSL are not affected. The issue has been resolved in composer versions 1.10.23 and 2.1.9. There are no workarounds for this issue. |
| CVE-2021-20118 | Medium | 2021-09-09 | Not applicable | No public exploit | Nessus Agent 8.3.0 and earlier was found to contain a local privilege escalation vulnerability which could allow an authenticated, local administrator to run specific executables on the Nessus Agent host. This is different than CVE-2021-20117. |
| CVE-2021-20117 | Medium | 2021-09-09 | Not applicable | No public exploit | Nessus Agent 8.3.0 and earlier was found to contain a local privilege escalation vulnerability which could allow an authenticated, local administrator to run specific executables on the Nessus Agent host. This is different than CVE-2021-20118. |
| CVE-2021-33193 | High | 2021-08-16 | Not applicable | No public exploit | A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning. This issue affects Apache HTTP Server 2.4.17 to 2.4.48. |
| CVE-2021-20106 | Medium | 2021-07-21 | Not applicable | No public exploit | Nessus Agent versions 8.2.5 and earlier were found to contain a privilege escalation vulnerability which could allow a Nessus administrator user to upload a specially crafted file that could lead to gaining administrator privileges on the Nessus host. |
| CVE-2021-20079 | Medium | 2021-06-29 | Not applicable | No public exploit | Nessus versions 8.13.2 and earlier were found to contain a privilege escalation vulnerability which could allow a Nessus administrator user to upload a specially crafted file that could lead to gaining administrator privileges on the Nessus host. |
| CVE-2021-20100 | Medium | 2021-06-28 | Not applicable | No public exploit | Nessus Agent 8.2.4 and earlier for Windows were found to contain multiple local privilege escalation vulnerabilities which could allow an authenticated, local administrator to run specific Windows executables as the Nessus host. This is different than CVE-2021-20099. |
| CVE-2021-20099 | Medium | 2021-06-28 | Not applicable | No public exploit | Nessus Agent 8.2.4 and earlier for Windows were found to contain multiple local privilege escalation vulnerabilities which could allow an authenticated, local administrator to run specific Windows executables as the Nessus host. This is different than CVE-2021-20100. |
| CVE-2021-23358 | High | 2021-03-29 | Not applicable | Proof of concept only | The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized. |
| CVE-2021-3450 | High | 2021-03-25 | Not applicable | No public exploit | The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to disallow certificates in the chain that have explicitly encoded elliptic curve parameters was added as an additional strict check. An error in the implementation of this check meant that the result of a previous check to confirm that certificates in the chain are valid CA certificates was overwritten. This effectively bypasses the check that non-CA certificates must not be able to issue other certificates. If a "purpose" has been configured then there is a subsequent opportunity for checks that the certificate is a valid CA. All of the named "purpose" values implemented in libcrypto perform this check. Therefore, where a purpose is set the certificate chain will still be rejected even when the strict flag has been used. A purpose is set by default in libssl client and server certificate verification routines, but it can be overridden or removed by an application. In order to be affected, an application must explicitly set the X509_V_FLAG_X509_STRICT verification flag and either not set a purpose for the certificate verification or, in the case of TLS client or server applications, override the default purpose. OpenSSL versions 1.1.1h and newer are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1h-1.1.1j). |
| CVE-2021-20077 | Medium | 2021-03-19 | Not applicable | No public exploit | Nessus Agent versions 7.2.0 through 8.2.2 were found to inadvertently capture the IAM role security token on the local host during initial linking of the Nessus Agent when installed on an Amazon EC2 instance. This could allow a privileged attacker to obtain the token. |
| CVE-2021-21371 | High | 2021-03-10 | Not applicable | No public exploit | Tenable for Jira Cloud is an open source project designed to pull Tenable.io vulnerability data, then generate Jira Tasks and sub-tasks based on the vulnerabilities' current state. It published in pypi as "tenable-jira-cloud". In tenable-jira-cloud before version 1.1.21, it is possible to run arbitrary commands through the yaml.load() method. This could allow an attacker with local access to the host to run arbitrary code by running the application with a specially crafted YAML configuration file. This is fixed in version 1.1.21 by using yaml.safe_load() instead of yaml.load(). |
| CVE-2021-20076 | High | 2021-03-03 | Not applicable | No public exploit | Tenable.sc and Tenable.sc Core versions 5.13.0 through 5.17.0 were found to contain a vulnerability that could allow an authenticated, unprivileged user to perform Remote Code Execution (RCE) on the Tenable.sc server via Hypertext Preprocessor unserialization. |
| CVE-2020-5812 | Medium | 2021-02-06 | Not applicable | No public exploit | Nessus AMI versions 8.12.0 and earlier were found to either not validate, or incorrectly validate, a certificate which could allow an attacker to spoof a trusted entity by using a man-in-the-middle (MITM) attack. |
| CVE-2020-5808 | High | 2020-12-21 | Not applicable | No public exploit | In certain scenarios in Tenable.sc prior to 5.17.0, a scanner could potentially be used outside the user's defined scan zone without a particular zone being specified within the Automatic Distribution configuration. |
| CVE-2020-5794 | High | 2020-11-06 | Not applicable | No public exploit | A vulnerability in Nessus Network Monitor versions 5.11.0, 5.11.1, and 5.12.0 for Windows could allow an authenticated local attacker to execute arbitrary code by copying user-supplied files to a specially constructed path in a specifically named user directory. The attacker needs valid credentials on the Windows system to exploit this vulnerability. |
| CVE-2020-5793 | High | 2020-11-05 | Not applicable | No public exploit | A vulnerability in Nessus versions 8.9.0 through 8.12.0 for Windows & Nessus Agent 8.0.0 and 8.1.0 for Windows could allow an authenticated local attacker to copy user-supplied files to a specially constructed path in a specifically named user directory. An attacker could exploit this vulnerability by creating a malicious file and copying the file to a system directory. The attacker needs valid credentials on the Windows system to exploit this vulnerability. |
| CVE-2020-7070 | Medium | 2020-10-02 | Not applicable | No public exploit | In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-8184 for more information. |
| CVE-2020-7068 | Medium | 2020-09-09 | Not applicable | No public exploit | In PHP versions 7.2.x below 7.2.33, 7.3.x below 7.3.21 and 7.4.x below 7.4.9, while processing PHAR files using phar extension, phar_parse_zipfile could be tricked into accessing freed memory, which could lead to a crash or information disclosure. |
| CVE-2020-5774 | High | 2020-08-21 | Not applicable | No public exploit | Nessus versions 8.11.0 and earlier were found to maintain sessions longer than the permitted period in certain scenarios. The lack of proper session expiration could allow attackers with local access to login into an existing browser session. |
| CVE-2020-5765 | Medium | 2020-07-15 | Not applicable | No public exploit | Nessus 8.10.0 and earlier were found to contain a Stored XSS vulnerability due to improper validation of input during scan configuration. An authenticated, remote attacker could potentially exploit this vulnerability to execute arbitrary code in a user's session. Tenable has implemented additional input validation mechanisms to correct this issue in Nessus 8.11.0. |
| CVE-2020-5737 | Medium | 2020-04-17 | Not applicable | No public exploit | Stored XSS in Tenable.Sc before 5.14.0 could allow an authenticated remote attacker to craft a request to execute arbitrary script code in a user's browser session. Updated input validation techniques have been implemented to correct this issue. |
| CVE-2020-11655 | High | 2020-04-09 | Not applicable | No public exploit | SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's initialization is mishandled. |
| CVE-2020-7066 | Medium | 2020-04-01 | Not applicable | No public exploit | In PHP versions 7.2.x below 7.2.29, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using get_headers() with user-supplied URL, if the URL contains zero (\0) character, the URL will be silently truncated at it. This may cause some software to make incorrect assumptions about the target of the get_headers() and possibly send some information to a wrong server. |