Tenable Vulnerabilities and Affected Products
Vulnerabilities associated with SecurityCenter.
Products
Clear product- Nessus20 vulnerabilities
- Security Center10 vulnerabilities
- Nessus Agent7 vulnerabilities
- Alcatel Lucent I-240W-Q GPON ONT6 vulnerabilities
- ASUSTOR Data Master6 vulnerabilities
- Agent4 vulnerabilities
- Nessus Network Monitor4 vulnerabilities
- nessus_agent4 vulnerabilities
- Tenable Identity Exposure4 vulnerabilities
- Tenable Nessus4 vulnerabilities
- LabKey Server Community Edition3 vulnerabilities
- nessus_network_monitor3 vulnerabilities
- SecurityCenter3 vulnerabilities
- Terrascan3 vulnerabilities
- Network Monitor2 vulnerabilities
- security_center2 vulnerabilities
- Burp Suite Community Edition1 vulnerability
- Check_MK1 vulnerability
- Grandstream GWN70001 vulnerability
- identity_exposure1 vulnerability
- integration-jira-cloud1 vulnerability
- libjpeg-turbo1 vulnerability
- MikroTik RouterOS1 vulnerability
- Tenable Appliance1 vulnerability
- Tenable Identity Exposure Secure Relay1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2018-1155MEDIUM | In SecurityCenter versions prior to 5.7.0, a cross-site scripting (XSS) issue could allow an authenticated attacker to inject JavaScript code into an image filename parameter within the Reports feature area. Properly updated input validation techniques have been implemented to correct this issue. CWE-79Aug 2, 2018 | CVSS5.4v3.0 | EPSS0.569% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2018-1154HIGH | In SecurityCenter versions prior to 5.7.0, a username enumeration issue could allow an unauthenticated attacker to automate the discovery of username aliases via brute force, ultimately facilitating unauthorized access. Server response output has been unified to correct this issue. Aug 2, 2018 | CVSS8.8v3.0 | EPSS0.673% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2017-11508HIGH | SecurityCenter versions 5.5.0, 5.5.1 and 5.5.2 contain a SQL Injection vulnerability that could be exploited by an authenticated user with sufficient privileges to run diagnostic scans. An attacker could exploit this vulnerability by entering a crafted SQL query into the password field of a diagnostic scan within SecurityCenter. Successful exploitation of this vulnerability could allow an attacker to gain unauthorized access. CWE-89Nov 2, 2017 | CVSS8.8v3.0 | EPSS1.2% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |