Tenable Nessus vulnerabilities, page 2
72 vulnerabilities
Known vulnerabilities in Tenable Nessus, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2025-36625tenablenessus
EPSS score0.29%
In Nessus versions prior to 10.8.4, a non-authenticated attacker could alter Nessus logging entries by manipulating http requests to the application.CVE-2025-24914tenablenessusEPSS score0.15%
When installing Nessus to a non-default location on a Windows host, Nessus versions prior to 10.8.4 did not enforce secure permissions for sub-directories. This could allow for local privilege escalation if users had not secured the directories in the non-default installation location. - CVE-2025-24914CVE-2020-5793tenablenessus+1EPSS score0.40%
A vulnerability in Nessus versions 8.9.0 through 8.12.0 for Windows & Nessus Agent 8.0.0 and 8.1.0 for Windows could allow an authenticated local attacker to copy user-supplied files to a specially constructed path in a specifically named user directory. An attacker could exploit this vulnerability by creating a malicious file and copying the file to a system directory. The attacker needs valid credentials on the Windows system to exploit this vulnerability.CVE-2020-5765tenablenessusEPSS score1.10%
Nessus 8.10.0 and earlier were found to contain a Stored XSS vulnerability due to improper validation of input during scan configuration. An authenticated, remote attacker could potentially exploit this vulnerability to execute arbitrary code in a user's session. Tenable has implemented additional input validation mechanisms to correct this issue in Nessus 8.11.0.CVE-2020-5774tenablenessusEPSS score0.35%
Nessus versions 8.11.0 and earlier were found to maintain sessions longer than the permitted period in certain scenarios. The lack of proper session expiration could allow attackers with local access to login into an existing browser session.CVE-2014-2848tenablenessus+1EPSS score0.24%
A race condition in the wmi_malware_scan.nbin plugin before 201402262215 for Nessus 5.2.1 allows local users to gain privileges by replacing the dissolvable agent executable in the Windows temp directory with a Trojan horse program.CVE-2014-4980tenablenessus+1EPSS score1.70%
The /server/properties resource in Tenable Web UI before 2.3.5 for Nessus 5.2.3 through 5.2.7 allows remote attackers to obtain sensitive information via the token parameter.CVE-2022-0778alpinelibretls+170EPSS score73.19%
The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has invalid explicit curve parameters. Since certificate parsing happens prior to verification of the certificate signature, any process that parses an externally supplied certificate may thus be subject to a denial of service attack. The infinite loop can also be reached when parsing crafted private keys as they can contain explicit elliptic curve parameters. Thus vulnerable situations include: - TLS clients consuming server certificates - TLS servers consuming client certificates - Hosting providers taking certificates or private keys from customers - Certificate authorities parsing certification requests from subscribers - Anything else which parses ASN.1 elliptic curve parameters Also any other applications that use the BN_mod_sqrt() where the attacker can control the parameter values are vulnerable to this DoS issue. In the OpenSSL 1.0.2 version the public key is not parsed during initial parsing of the certificate which makes it slightly harder to trigger the infinite loop. However any operation which requires the public key from the certificate will trigger the infinite loop. In particular the attacker can use a self-signed certificate to trigger the loop during verification of the certificate signature. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0. It was addressed in the releases of 1.1.1n and 3.0.2 on the 15th March 2022. Fixed in OpenSSL 3.0.2 (Affected 3.0.0,3.0.1). Fixed in OpenSSL 1.1.1n (Affected 1.1.1-1.1.1m). Fixed in OpenSSL 1.0.2zd (Affected 1.0.2-1.0.2zc).CVE-2022-4313tenablenessus+1EPSS score1.24%
A vulnerability was reported where through modifying the scan variables, an authenticated user in Tenable products, that has Scan Policy Configuration roles, could manipulate audit policy variables to execute arbitrary commands on credentialed scan targets.CVE-2022-22824alpineexpat+23EPSS score3.60%
defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.CVE-2022-22826alpineexpat+23EPSS score2.96%
nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.CVE-2022-22827alpineexpat+23EPSS score2.96%
storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.CVE-2022-22825alpineexpat+23EPSS score2.79%
lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.CVE-2022-22822alpineexpat+23EPSS score5.10%
addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.CVE-2022-22823alpineexpat+23EPSS score3.60%
build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.CVE-2022-32973tenablenessusEPSS score1.36%
An authenticated attacker could create an audit file that bypasses PowerShell cmdlet checks and executes commands with administrator privileges.CVE-2022-32974tenablenessusEPSS score0.74%
An authenticated attacker could read arbitrary files from the underlying operating system of the scanner using a custom crafted compliance audit file without providing any valid SSH credentials.CVE-2022-3499tenablenessusEPSS score0.86%
An authenticated attacker could utilize the identical agent and cluster node linking keys to potentially allow for a scenario where unauthorized disclosure of agent logs and data is present.CVE-2022-33757tenable, inc.tenable nessus+1EPSS score0.86%
An authenticated attacker could read Nessus Debug Log file attachments from the web UI without having the correct privileges to do so. This may lead to the disclosure of information on the scan target and/or the Nessus scan to unauthorized parties able to reach the Nessus instance.CVE-2022-23990alpineexpat+18EPSS score4.69%
Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.