Tenable Vulnerabilities and Affected Products
Vulnerabilities associated with Tenable Nessus.
Products
Clear product- Nessus20 vulnerabilities
- Security Center10 vulnerabilities
- Nessus Agent7 vulnerabilities
- Alcatel Lucent I-240W-Q GPON ONT6 vulnerabilities
- ASUSTOR Data Master6 vulnerabilities
- Agent4 vulnerabilities
- Nessus Network Monitor4 vulnerabilities
- nessus_agent4 vulnerabilities
- Tenable Identity Exposure4 vulnerabilities
- Tenable Nessus4 vulnerabilities
- LabKey Server Community Edition3 vulnerabilities
- nessus_network_monitor3 vulnerabilities
- SecurityCenter3 vulnerabilities
- Terrascan3 vulnerabilities
- Network Monitor2 vulnerabilities
- security_center2 vulnerabilities
- Burp Suite Community Edition1 vulnerability
- Check_MK1 vulnerability
- Grandstream GWN70001 vulnerability
- identity_exposure1 vulnerability
- integration-jira-cloud1 vulnerability
- libjpeg-turbo1 vulnerability
- MikroTik RouterOS1 vulnerability
- Tenable Appliance1 vulnerability
- Tenable Identity Exposure Secure Relay1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2019-3961MEDIUM | Nessus versions 8.4.0 and earlier were found to contain a reflected XSS vulnerability due to improper validation of user-supplied input. An unauthenticated, remote attacker could potentially exploit this vulnerability via a specially crafted request to execute arbitrary script code in a users browser session. CWE-79Jun 25, 2019 | CVSS6.1v3.0 | EPSS1.48% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2019-3923MEDIUM | Nessus versions 8.2.1 and earlier were found to contain a stored XSS vulnerability due to improper validation of user-supplied input. An authenticated, remote attacker could potentially exploit this vulnerability via a specially crafted request to execute arbitrary script code in a user's browser session. Tenable has released Nessus 8.2.2 to address this issue. CWE-79Feb 12, 2019 | CVSS5.4v3.0 | EPSS0.879% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2018-1148MEDIUM | In Nessus before 7.1.0, Session Fixation exists due to insufficient session management within the application. An authenticated attacker could maintain system access due to session fixation after a user password change. CWE-384May 18, 2018 | CVSS6.5v3.0 | EPSS0.76% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2018-1147MEDIUM | In Nessus before 7.1.0, a XSS vulnerability exists due to improper input validation. A remote authenticated attacker could create and upload a .nessus file, which may be viewed by an administrator allowing for the execution of arbitrary script code in a user's browser session. In other scenarios, XSS could also occur by altering variables from the Advanced Settings. CWE-79May 18, 2018 | CVSS5.4v3.0 | EPSS1.15% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |