TE
Product
Tenable.sc
On CISA KEVExploited in the wildRansomware-linked
46
CVEs
2
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 11High 16Medium 18Low 1
Watch
Add Tenable.sc to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-24495 | 6.5 | Jan 26 | A Server Side Request Forgery (SSRF) vulnerability exists in Tenable.sc due to improper validation of session & user-accessible input data Affected: through 5.23.1 |
| CVE-2023-0476 | 6.5 | Jan 26 | A LDAP injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users Affected: through 5.23.1 |
| CVE-2020-7069 | 6.5 | Oct 2 | In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of… Affected: before 5.19.0 |
| CVE-2021-41184 | 6.1 | Oct 26 | jQuery-UI is the official jQuery user interface library Affected: before 5.21.0 |
| CVE-2021-41183 | 6.1 | Oct 26 | jQuery-UI is the official jQuery user interface library Affected: before 5.21.0 |
| CVE-2021-41182 | 6.1 | Oct 26 | jQuery-UI is the official jQuery user interface library Affected: before 5.21.0 |
| CVE-2019-8331 | 6.1 | Feb 20 | In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute Affected: before 5.19.0 |
| CVE-2021-3449 | 5.9 | Mar 25 | NULL pointer deref in signature_algorithms processing Affected: 5.13.0 through 5.17.0 |
| CVE-2021-23841 | 5.9 | Feb 16 | The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509… Affected: 5.13.0 through 5.17.0 |
| CVE-2023-24493 | 5.7 | Jan 26 | A formula injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users Affected: through 5.23.1 |
| CVE-2019-19645 | 5.5 | Dec 9 | alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements Affected: before 5.19.0 |
| CVE-2023-24494 | 5.4 | Jan 26 | A stored cross-site scripting (XSS) vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users Affected: through 5.23.1 |
| CVE-2020-5737 | 5.4 | Apr 17 | Stored XSS in Tenable.Sc before 5.14.0 could allow an authenticated remote attacker to craft a request to execute arbitrary script code in a user's browser session Affected: 5.14.0; 5.14.1 |
| CVE-2020-7064 | 5.4 | Apr 1 | In PHP versions 7.2.x below 7.2.9, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while parsing EXIF data with exif_read_data() function, it is possible for malicious data to cause PHP… Affected: before 5.19.0 |
| CVE-2021-21707 | 5.3 | Nov 29 | In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode the filename passed to them Affected: before 5.21.0 |
| CVE-2020-7070 | 5.3 | Oct 2 | In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded Affected: before 5.19.0 |
| CVE-2020-7063 | 5.3 | Feb 27 | In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when creating PHAR archive using PharData::buildFromIterator() function, the files are added with… Affected: before 5.19.0 |
| CVE-2020-7066 | 4.3 | Apr 1 | In PHP versions 7.2.x below 7.2.29, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using get_headers() with user-supplied URL, if the URL contains zero (\0) character, the URL… Affected: before 5.19.0; 5.19.0 |
Showing 18