CVE Database and Vulnerability Search

Browse vendorsBrowse ecosystems

Search CVE and GHSA vulnerability records by identifier, title, vendor, product, package, or CWE. Filter by severity, CISA KEV, ransomware association, linked artifacts, and Nuclei templates; sort by publication date, CVSS, or EPSS.

Vulnerabilities
381,276
with PoCs
37,250
CISA KEV
1,665
Ransomware
606
with Nuclei
4,342
Advanced

Showing 4 vulnerabilities on this page

Signals CISA KEV Ransomware Nuclei
VulnerabilityTitle and contextCVSSEPSSPoCsSignals

XSS

A stored cross site scripting vulnerability exists in Nessus Network Monitor where an authenticated, privileged local attacker could inject arbitrary code into the NNM UI via the local CLI.

CWE-79Sep 30, 2024
CVSS8.4v3.1EPSS0.308%PoCs0SignalsSTIX

Blind SQL Injection

Under certain conditions, Nessus Network Monitor was found to not properly enforce input validation. This could allow an admin user to alter parameters that could potentially allow a blindSQL injection.

CWE-20Oct 26, 2023
CVSS7.2v3.1EPSS0.484%PoCs0SignalsSTIX

Privilege Escalation

NNM failed to properly set ACLs on its installation directory, which could allow a low privileged user to run arbitrary code with SYSTEM privileges where NNM is installed to a non-standard location

CWE-276CWE-94Oct 26, 2023
CVSS7.0v3.1EPSS0.151%PoCs0SignalsSTIX

Privilege Escalation

Under certain conditions, Nessus Network Monitor could allow a low privileged user to escalate privileges to NT AUTHORITY\SYSTEM on Windows hosts by replacing a specially crafted file.

CWE-269Oct 26, 2023
CVSS7.1v3.1EPSS0.471%PoCs0SignalsSTIX