[R1] Stand-alone Security Patch Available for Tenable.sc versions 5.22.0 to 6.0.0: SC-202302.2

R1 Stand-alone Security Patch Available for Tenable.sc versions 5.22.0 to 6.0.0: SC-202302.2 Arnie Cabral Tue, 02/21/2023 - 11:42 Tenable.sc leverages third-party software to help provide underlying functionality. One of the third-party components in use Apache was found to contain vulnerabilitie...

[R1] Stand-alone Security Patch Available for Tenable.sc versions 5.22.0 to 5.23.1: SC-202302.3

R1 Stand-alone Security Patch Available for Tenable.sc versions 5.22.0 to 5.23.1: SC-202302.3 Arnie Cabral Tue, 02/21/2023 - 10:20 Tenable.sc leverages third-party software to help provide underlying functionality. One of the third-party components in use libcurl was found to contain...

Security systems’ vulnerabilities and the assessment of those vulnerabilities using tools like Nessus, tenable.io, and tenable.sc—these are related to code errors that allow attackers to exploit their privileges.

Security system vulnerabilities and the assessment of those vulnerabilities using tools like Nessus, tenable.io, and tenable.sc are related to errors in code. Exploiting such vulnerabilities can allow attackers, who operate remotely, to gain increased privileges...

CVE-2023-24494

A stored cross-site scripting XSS vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users. An authenticated, remote attacker can exploit this by convincing a user to click a specially crafted URL, to execute arbitrary script code in a user...

CVE-2023-24493

A formula injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users. An authenticated attacker could leverage the reporting system to export reports containing formulas, which would then require a victim to approve and execute on a...

CVE-2023-24495

A Server Side Request Forgery SSRF vulnerability exists in Tenable.sc due to improper validation of session & user-accessible input data. A privileged, authenticated remote attacker could interact with external and internal services covertly...

CVE-2023-0476

A LDAP injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users. An authenticated attacker could generate data in Active Directory using the application account through blind LDAP injection...

CVE-2023-0476

A LDAP injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users. An authenticated attacker could generate data in Active Directory using the application account through blind LDAP injection...

Design/Logic Flaw

A formula injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users. An authenticated attacker could leverage the reporting system to export reports containing formulas, which would then require a victim to approve and execute on a...

Design/Logic Flaw

A LDAP injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users. An authenticated attacker could generate data in Active Directory using the application account through blind LDAP injection...

Server side request forgery (ssrf)

A Server Side Request Forgery SSRF vulnerability exists in Tenable.sc due to improper validation of session & user-accessible input data. A privileged, authenticated remote attacker could interact with external and internal services covertly...

Cross site scripting

A stored cross-site scripting XSS vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users. An authenticated, remote attacker can exploit this by convincing a user to click a specially crafted URL, to execute arbitrary script code in a user...

CVE-2023-24494

A stored cross-site scripting XSS vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users. An authenticated, remote attacker can exploit this by convincing a user to click a specially crafted URL, to execute arbitrary script code in a user...

CVE-2023-24493

CVE-2023-24493 (Tenable.sc) is a formula injection vulnerability caused by improper validation of user-supplied input in the reporting system. An authenticated attacker could export reports containing formulas, which would then require a victim to approve and execute on a host. If exploited, this...

CVE-2023-24495

A Server Side Request Forgery SSRF vulnerability exists in Tenable.sc due to improper validation of session & user-accessible input data. A privileged, authenticated remote attacker could interact with external and internal services covertly...

PT-2023-16291 · Tenable · Tenable.Sc

Name of the Vulnerable Software and Affected Versions: Tenable.sc affected versions not specified Description: A LDAP injection issue exists due to improper validation of user-supplied input. An authenticated attacker could generate data in Active Directory using the application account through...

CVE-2023-0476

CVE-2023-0476 is an LDAP injection vulnerability in Tenable.sc caused by improper validation of user input. An authenticated attacker could use the application account to generate data in Active Directory via blind LDAP injection. Affected product is Tenable.sc (vulnerable at least before 6.0.0)....

CVE-2023-24494

Tenable.sc versions prior to 6.0.0 are affected by a stored XSS vulnerability (CVE-2023-24494) due to improper validation of user-supplied input. An authenticated attacker can entice a user to click a crafted URL, causing script execution in the user’s browser session. The issue is rooted in inpu...

CVE-2023-0476

A LDAP injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users. An authenticated attacker could generate data in Active Directory using the application account through blind LDAP injection...

CVE-2023-24495

The CVE-2023-24495 SSRF issue in Tenable.sc arises from improper validation of session and user-accessible input data, enabling a privileged, authenticated attacker to interact with external and internal services. Public sources in the connected documents confirm that Tenable.sc prior to version ...