Product:

Tenable\.sc

(Tenable)
Repositories

Unknown:

This might be proprietary software.
#Vulnerabilities 44
Date Id Summary Products Score Patch Annotated
2021-10-26 CVE-2021-41184 jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector. A workaround is to not accept the value of the `of` option from untrusted sources. Drupal, Fedora, Jquery_ui, H300e_firmware, H300s_firmware, H410c_firmware, H410s_firmware, H500e_firmware, H500s_firmware, H700e_firmware, H700s_firmware, Agile_plm, Application_express, Banking_platform, Big_data_spatial_and_graph, Communications_interactive_session_recorder, Communications_operations_monitor, Hospitality_inventory_management, Hospitality_materials_control, Hospitality_suite8, Jd_edwards_enterpriseone_tools, Peoplesoft_enterprise_peopletools, Policy_automation, Primavera_unifier, Rest_data_services, Weblogic_server, Tenable\.sc 6.1
2022-01-14 CVE-2022-0130 Tenable.sc versions 5.14.0 through 5.19.1 were found to contain a remote code execution vulnerability which could allow a remote, unauthenticated attacker to execute code under special circumstances. An attacker would first have to stage a specific file type in the web server root of the Tenable.sc host prior to remote exploitation. Tenable\.sc 8.1
2019-08-09 CVE-2019-11041 When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash. Mac_os_x, Ubuntu_linux, Debian_linux, Leap, Php, Software_collections, Tenable\.sc 7.1
2019-08-09 CVE-2019-11042 When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash. Mac_os_x, Ubuntu_linux, Debian_linux, Leap, Php, Software_collections, Tenable\.sc 7.1
2021-11-29 CVE-2021-21707 In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode the filename passed to them. If that filename contains URL-encoded NUL character, this may cause the function to interpret this as the end of the filename, thus interpreting the filename differently from what the user intended, which may lead it to reading a different file than intended. Debian_linux, Clustered_data_ontap, Php, Tenable\.sc 5.3
2023-02-01 CVE-2023-0524 As part of our Security Development Lifecycle, a potential privilege escalation issue was identified internally. This could allow a malicious actor with sufficient permissions to modify environment variables and abuse an impacted plugin in order to escalate privileges. We have resolved the issue and also made several defense-in-depth fixes alongside. While the probability of successful exploitation is low, Tenable is committed to securing our customers’ environments and our products. The... Nessus, Tenable\.io, Tenable\.sc 8.8
2023-01-26 CVE-2023-0476 A LDAP injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users. An authenticated attacker could generate data in Active Directory using the application account through blind LDAP injection. Tenable\.sc 6.5
2023-01-26 CVE-2023-24495 A Server Side Request Forgery (SSRF) vulnerability exists in Tenable.sc due to improper validation of session & user-accessible input data. A privileged, authenticated remote attacker could interact with external and internal services covertly. Tenable\.sc 6.5
2023-01-26 CVE-2023-24493 A formula injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users. An authenticated attacker could leverage the reporting system to export reports containing formulas, which would then require a victim to approve and execute on a host. Tenable\.sc 5.7
2023-01-26 CVE-2023-24494 A stored cross-site scripting (XSS) vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users. An authenticated, remote attacker can exploit this by convincing a user to click a specially crafted URL, to execute arbitrary script code in a user's browser session. Tenable\.sc 5.4