8.3Alta
SQL Injection
Tenable, Inc. Nessus
An SQL injection vulnerability could allow an authenticated user to read or modify data stored by Nessus.
Vulnerabilidades de Tenable, Inc. Nessus (CVE)
Registros CVE publicados para Tenable, Inc. Nessus, los más recientes primero. Siga el producto para recibir un correo con cada nueva.
3.3Baja
SQL Injection in Nessus via Malicious Scan Result File Import
tenable Nessus
A SQL injection vulnerability in Nessus allows an attacker to craft a malicious scan result file that, when imported by a privileged user, injects malicious SQL into the scan results database, potentially enabling exfiltration of scan-result data.
5.3Media
SQL Injection in Nessus via Reverse DNS Lookup
tenable Nessus
A SQL injection vulnerability in Nessus allows a remote, unauthenticated attacker who controls reverse DNS records for a scanned host to inject malicious SQL into the scan results database, potentially enabling exfiltration of scan-result data.
7.4Alta
Junction File Manipulation
Tenable, Inc. Tenable Nessus, Tenable Nessus Agent
This vulnerability allows an attacker to create a junction, enabling the deletion of arbitrary files with SYSTEM privileges. As a result, this condition potentially facilitates arbitrary code execution, whereby an attacker may exploit the vulnerability to exe…
8.4Alta
Local Privilege Escalation
Tenable Nessus
In Tenable Nessus versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could overwrite arbitrary local system files with log content at SYSTEM privilege.
4.3Media
Log Poisoning in Nessus
Tenable Nessus
In Nessus versions prior to 10.8.4, a non-authenticated attacker could alter Nessus logging entries by manipulating http requests to the application.
7.8Alta
Local Priviledge Escalation
Tenable Nessus
When installing Nessus to a non-default location on a Windows host, Nessus versions prior to 10.8.4 did not enforce secure permissions for sub-directories. This could allow for local privilege escalation if users had not secured the directories in the non-def…