CVE-2017-11508

SecurityCenter 5.5.0–5.5.2 contain a SQL Injection vulnerability exploitable by an authenticated user with sufficient privileges to run diagnostic scans. An attacker could insert a crafted SQL query into the password field of a diagnostic scan, potentially gaining unauthorized access to the Secur...

CVE-2017-11508

SecurityCenter versions 5.5.0, 5.5.1 and 5.5.2 contain a SQL Injection vulnerability that could be exploited by an authenticated user with sufficient privileges to run diagnostic scans. An attacker could exploit this vulnerability by entering a crafted SQL query into the password field of a...

Tenable SecurityCenter 5.5.0 <= 5.5.2 SQLi (TNS-2017-13)

According to its self-reported version, the Tenable SecurityCenter application installed on the remote host is affected by a SQL injection flaw. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number. TRUSTED...

[R1] SecurityCenter 5.6.0 Fixes One Vulnerability

SecurityCenter versions 5.5.0, 5.5.1 and 5.5.2 contain a SQL Injection vulnerability that could be exploited by an authenticated user with sufficient privileges to run diagnostic scans. An attacker could exploit this vulnerability by entering a crafted SQL query into the password field of a...

[R1] SecurityCenter 5.3.2, 5.4.0, 5.4.2, 5.4.5, 5.5.0, and 5.5.1 Fixes Multiple Vulnerabilities

Tenable has released updates for SecurityCenter 5.3.2, 5.4.0, 5.4.2, 5.4.5, 5.5.0, and 5.5.1 to bring the version of PHP included with them to 5.6.31. PHP 5.6.31 addresses multiple vulnerabilities: CVE-2017-11142: In PHP before 5.6.31, 7.x before 7.0.17, and 7.1.x before 7.1.3, remote attackers...

Tenable SecurityCenter PHP < 5.6.31 Multiple Vulnerabilities (TNS-2017-12

The Tenable SecurityCenter application installed on the remote host is missing a security patch. It is, therefore, affected by multiple vulnerabilities in the bundled version of PHP : - An out-of-bounds read error exists in the PCRE library in the compilebracketmatchingpath function within file...

Tenable SecurityCenter PHP < 5.6.25 Multiple Vulnerabilities (TNS-2016-09)

The Tenable SecurityCenter application installed on the remote host is missing a security patch. It is, therefore, affected by multiple vulnerabilities in the bundled version of PHP : - An unspecified flaw exists in the objectcommon2 function in varunserializer.c that occurs when handling objects...

Tenable SecurityCenter OpenSSL 1.0.1 < 1.0.1u Multiple Vulnerabilities (SWEET32)

The Tenable SecurityCenter application installed on the remote host is missing a security patch. It is, therefore, affected by multiple vulnerabilities in the bundled version of OpenSSL : - Multiple integer overflow conditions exist in s3srvr.c, sslsess.c, and t1lib.c due to improper use of point...

Tenable SecurityCenter PHP < 5.6.26 Multiple Vulnerabilities

The Tenable SecurityCenter application installed on the remote host is missing a security patch. It is, therefore, affected by multiple vulnerabilities in the bundled version of PHP : - A flaw exists in ext/standard/varunserializer.re when destroying deserialized objects due to improper validatio...

Tenable SecurityCenter PHP < 5.6.30 Multiple Vulnerabilities (TNS-2017-04)

The Tenable SecurityCenter application installed on the remote host is missing a security patch. It is, therefore, affected by multiple vulnerabilities in the bundled version of PHP : - A seg fault when loading hostile phar could be used to crash the PHP interpreter or potentially disclose...

Tenable SecurityCenter OpenSSL 1.0.2 < 1.0.2k Multiple Vulnerabilities (TNS-2017-04)

The Tenable SecurityCenter application installed on the remote host is missing a security patch. It is, therefore, affected by multiple vulnerabilities in the bundled version of OpenSSL : - A carry propagation error exists in the Broadwell-specific Montgomery multiplication procedure when handlin...

Tenable SecurityCenter 5.4.x <= 5.4.3 PHP Object Deserialization Remote File Deletion (TNS-2017-05)

According to its version, the installation of Tenable SecurityCenter on the remote host is affected by a PHP object deserialization vulnerability in the PluginParser.php script. An authenticated, remote attacker can exploit this, by uploading a specially crafted PHP object, to delete arbitrary...

Tenable SecurityCenter < 5.4.1 Multiple Vulnerabilities (TNS-2016-19)

According to its self-reported version, the Tenable SecurityCenter application installed on the remote host is prior to 5.4.1. It is, therefore, affected by multiple vulnerabilities : - A denial of service vulnerability exists in x509vfy.c due to improper handling of certificate revocation lists...

Tenable SecurityCenter < 5.3.0 Multiple Vulnerabilities (TNS-2016-04)

The Tenable SecurityCenter application installed on the remote host is either prior to version 5.3.0 or is missing a security patch. It is, therefore, affected by multiple vulnerabilities in the Perl-Compatible Regular Expressions PCRE library bundled with PHP : - An overflow condition exists in...

Tenable SecurityCenter < 5.4.0 Multiple Vulnerabilities (TNS-2016-12)

According to its self-reported version, the Tenable SecurityCenter application installed on the remote host is prior to 5.4.0. It is, therefore, affected by multiple vulnerabilities : - An arbitrary code execution vulnerability exists in the bundled version of libcurl due to using an insecure pat...

Tenable SecurityCenter < 5.3.2 Multiple Vulnerabilities (TNS-2016-09)

The Tenable SecurityCenter application installed on the remote host is either prior to version 5.3.2 or is missing a security patch. It is, therefore, affected by multiple vulnerabilities in the bundled version of PHP : - A signedness error exists in the GD Graphics library in gdgd2.c due to...

Tenable SecurityCenter 5.2.x / 5.3.x < 5.3.1 Multiple Vulnerabilities (TNS-2016-07)

According to its version, the Tenable SecurityCenter application installed on the remote host is 5.2.x or 5.3.x prior to 5.3.1. It is, therefore, affected by multiple vulnerabilities : - Multiple cross-site scripting XSS vulnerabilities exist due to a failure to properly validate input before...

Tenable SecurityCenter 5.0.2 Audit File XSS (TNS-2015-12)

According to its version, the Tenable SecurityCenter application installed on the remote host is affected by a cross-site scripting XSS vulnerability due to improper validation of uploaded .audit files before they are rendered on the scan results page. An authenticated, remote attacker can exploi...

Tenable SecurityCenter PHP Character Handling (TNS-2015-09)

The SecurityCenter application installed on the remote host contains a bundled version of PHP that is prior to 5.4.43. It is, therefore, affected by an exclamation mark character handling issue in the escapeshellcmd and escapeshellarg PHP functions. A remote attacker can exploit this to substitut...

Tenable SecurityCenter OpenSSL ASN.1 Signature Verification Routine DoS (TNS-2016-01)

The SecurityCenter application installed on the remote host is affected by a denial of service vulnerability in the bundled OpenSSL library. The library is version 1.0.1 or later but prior to 1.0.1q. It is, therefore, affected by a NULL pointer dereference flaw in file rsaameth.c due to improper...