CVE-2004-2722

Nessus 2.0.10a stores account passwords in plaintext in .nessusrc files, enabling local users to obtain passwords. This issue is noted with vendor dispute. A remediation suggestion is to restrict access to .nessusrc files; no fixed version is provided in the sources.

Directory traversal

The SCANCTRL.ScanCtrlCtrl.1 ActiveX control in scan.dll in Nessus Vulnerability Scanner 3.0.6 allows remote attackers to delete arbitrary files via unspecified vectors involving the deleteNessusRC method, probably a directory traversal vulnerability...

PT-2004-3612 · Tenable · Nessus

Name of the Vulnerable Software and Affected Versions: Nessus version 2.0.10a Description: The issue concerns the storage of account passwords in plaintext within .nessusrc files. This allows local users to obtain these passwords. It is noted that the vendor has disputed this issue...