TE
Product
Tenable.sc
On CISA KEVExploited in the wildRansomware-linked
46
CVEs
2
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 11High 16Medium 18Low 1
Watch
Add Tenable.sc to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-0524 | 8.8 | Feb 1 | As part of our Security Development Lifecycle, a potential privilege escalation issue was identified internally Affected: All versions, or not specified |
| CVE-2022-24828 | 8.8 | Apr 13 | Composer is a dependency manager for the PHP programming language Affected: before 5.21.0 |
| CVE-2021-20076 | 8.8 | Mar 3 | Tenable.sc and Tenable.sc Core versions 5.13.0 through 5.17.0 were found to contain a vulnerability that could allow an authenticated, unprivileged user to perform Remote Code… Affected: 5.13.0 through 5.17.0 |
| CVE-2020-7065 | 8.8 | Apr 1 | In PHP versions 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using mb_strtolower() function with UTF-32LE encoding, certain invalid strings could cause PHP to overwrite… Affected: before 5.19.0 |
| CVE-2021-44224 | 8.2 | Dec 20 | A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy… Affected: 5.14.0 before 5.20.0; 5.16.0 before 202201.1 |
| CVE-2022-0130 | 8.1 | Jan 14 | Tenable.sc versions 5.14.0 through 5.19.1 were found to contain a remote code execution vulnerability which could allow a remote, unauthenticated attacker to execute code under… Affected: 5.14.0 through 5.19.1 |
| CVE-2022-24785 | 7.5 | Apr 4 | Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates Affected: before 5.21.0 |
| CVE-2021-34798 | 7.5 | Sep 16 | Malformed requests may cause the server to dereference a NULL pointer Affected: through 5.19.1 |
| CVE-2021-33193 | 7.5 | Aug 16 | A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning Affected: through 5.19.1 |
| CVE-2020-5808 | 7.5 | Dec 21 | In certain scenarios in Tenable.sc prior to 5.17.0, a scanner could potentially be used outside the user's defined scan zone without a particular zone being specified within the… Affected: before 5.17.0 |
| CVE-2020-7067 | 7.5 | Apr 27 | In PHP versions 7.2.x below 7.2.30, 7.3.x below 7.3.17 and 7.4.x below 7.4.5, if PHP is compiled with EBCDIC support (uncommon), urldecode() function can be made to access… Affected: before 5.19.0 |
| CVE-2020-11655 | 7.5 | Apr 9 | SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's initialization is… Affected: before 5.19.0 |
| CVE-2021-3712 | 7.4 | Aug 24 | ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length Affected: 5.16.0 through 5.19.1 |
| CVE-2021-23358 | 7.2 | Mar 29 | The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a… Affected: through 5.18.0 |
| CVE-2019-11042 | 7.1 | Aug 9 | When PHP EXIF extension is parsing EXIF information from an image, e.g Affected: before 5.19.0 |
| CVE-2019-11041 | 7.1 | Aug 9 | When PHP EXIF extension is parsing EXIF information from an image, e.g Affected: before 5.19.0 |
Showing 16