Tenable: >> Security Center >> 5.5.1 Security Vulnerabilities
A remote code execution vulnerability exists in Tenable Security Center's report generation functionality. An authenticated, non-administrative user could exploit this issue by supplying specially crafted input that is later processed unsafely during server-side report rendering, resulting in arbitrary code execution with the privileges of the service account.
CVSS Score
9.4
EPSS Score
0.014
Published
2026-08-14
An improper access control vulnerability exists where an authenticated user could access areas outside of their authorized scope.
CVSS Score
5.7
EPSS Score
0.002
Published
2026-02-23
An Indirect Object Reference (IDOR) in Security Center allows an authenticated remote attacker to escalate privileges via the 'owner' parameter.
CVSS Score
2.1
EPSS Score
0.002
Published
2026-02-23
An improper privilege management vulnerability exists in Tenable Security Center where an authenticated, remote attacker could view unauthorized objects and launch scans without having the required privileges
CVSS Score
5.4
EPSS Score
0.003
Published
2024-06-12
A stored cross site scripting vulnerability exists in Tenable Security Center where an authenticated, remote attacker could inject HTML code into a web application scan result page.
CVSS Score
3.5
EPSS Score
0.003
Published
2024-06-12
A command injection vulnerability exists where an authenticated, remote attacker with administrator privileges on the Security Center application could modify Logging parameters, which could lead to the execution of arbitrary code on the Security Center host.
CVSS Score
7.2
EPSS Score
0.016
Published
2024-02-14
An HTML injection vulnerability exists where an authenticated, remote attacker with administrator privileges on the Security Center application could modify Repository parameters, which could lead to HTML redirection attacks.
CVSS Score
5.9
EPSS Score
0.004
Published
2024-02-14
In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.
CVSS Score
3.7
EPSS Score
0.088
Published
2019-12-23
In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP bcmath extension functions on some systems, including Windows, can be tricked into reading beyond the allocated space by supplying it with string containing characters that are identified as numeric by the OS but aren't ASCII numbers. This can read to disclosure of the content of some memory locations.
CVSS Score
3.7
EPSS Score
0.041
Published
2019-12-23
In PHP versions 7.3.x below 7.3.13 and 7.4.0 on Windows, when supplying custom headers to mail() function, due to mistake introduced in commit 78f4b4a2dcf92ddbccea1bb95f8390a18ac3342e, if the header is supplied in lowercase, this can result in double-freeing certain memory locations.
CVSS Score
6.5
EPSS Score
0.042
Published
2019-12-23