Tenable: >> Security Center >> 5.19.0 Security Vulnerabilities
A remote code execution vulnerability exists in Tenable Security Center's report generation functionality. An authenticated, non-administrative user could exploit this issue by supplying specially crafted input that is later processed unsafely during server-side report rendering, resulting in arbitrary code execution with the privileges of the service account.
CVSS Score
9.4
EPSS Score
0.014
Published
2026-08-14
An improper access control vulnerability exists where an authenticated user could access areas outside of their authorized scope.
CVSS Score
5.7
EPSS Score
0.002
Published
2026-02-23
An Indirect Object Reference (IDOR) in Security Center allows an authenticated remote attacker to escalate privileges via the 'owner' parameter.
CVSS Score
2.1
EPSS Score
0.002
Published
2026-02-23
An improper privilege management vulnerability exists in Tenable Security Center where an authenticated, remote attacker could view unauthorized objects and launch scans without having the required privileges
CVSS Score
5.4
EPSS Score
0.003
Published
2024-06-12
A stored cross site scripting vulnerability exists in Tenable Security Center where an authenticated, remote attacker could inject HTML code into a web application scan result page.
CVSS Score
3.5
EPSS Score
0.003
Published
2024-06-12
A command injection vulnerability exists where an authenticated, remote attacker with administrator privileges on the Security Center application could modify Logging parameters, which could lead to the execution of arbitrary code on the Security Center host.
CVSS Score
7.2
EPSS Score
0.016
Published
2024-02-14
An HTML injection vulnerability exists where an authenticated, remote attacker with administrator privileges on the Security Center application could modify Repository parameters, which could lead to HTML redirection attacks.
CVSS Score
5.9
EPSS Score
0.004
Published
2024-02-14
Page 2