CVE-2012-6494

CVE-2012-6494 affects Rapid7 Nexpose (Nexpose Security Console) prior to version 5.5.4. The vulnerability is a session hijacking flaw that allows remote attackers to capture a logged-in user’s session and gain unauthorized access. Proof-of-concept and exploitation details are described in vendor ...

CVE-2022-0758

CVE-2022-0758 affects Rapid7 Nexpose versions 6.6.129 and earlier, within the shared scan configuration component. A reflected cross-site scripting vulnerability arises when an attacker can pass literal values as test credentials, enabling a potential XSS attack. The issue is mitigated by upgradi...

CVE-2021-3535

Rapid7 Nexpose Security Console is affected by a non-persistent Cross‑Site Scripting (XSS) vulnerability in the Filtered Asset Search feature. A specific combination of search criteria and operators could allow code to be passed through the search field. Affected versions are 6.6.80 and earlier; ...

CVE-2022-4261

Rapid7 Nexpose and InsightVM before 6.6.178 are affected by a certificate validation issue in the update process. The vulnerability arises from failing to validate the update server’s certificate when downloading updates, potentially enabling an attacker with network access (including through a c...

CVE-2023-1699

Rapid7 Nexpose: Vulnerable in versions 6.6.186 and earlier to a forced browsing issue that allows an attacker to manipulate URLs to reach administrative pages. Root cause and affected components are described as a forced browsing vulnerability; impact is access to admin pages. The issue is fixed ...

CVE-2020-7383

CVE-2020-7383 is a SQL injection vulnerability in Rapid7 Nexpose prior to 6.6.49. It could allow an authenticated user with low privileges to access resources and make changes they should not be able to access. Publicly documented remediation states that Nexpose 6.6.49 fixes the issue (updates re...

CVE-2017-5264

CVE-2017-5264 affects Nexpose prior to 6.4.66, where the Automated Actions web application fails to validate the HTTP request source, enabling CSRF. Affected versions include 6.4.65 and older branches listed in public advisories; impact is cross-site request forgery affecting authenticated users....

CVE-2020-7382

CVE-2020-7382 affects Rapid7 Nexpose installer prior to version 6.6.40. The root cause is an Unquoted Search Path in the installer, which can allow a local attacker to cause the executable to load a malicious file placed in the path, enabling local privilege escalation. Affected version range is

CVE-2021-31868

CVE-2021-31868 affects Rapid7 Nexpose (Security Console) up to version 6.6.95. Authenticated users can view and edit any ticket in the legacy ticketing feature regardless of assignment. The issue is fixed in 6.6.96 (released Aug 4, 2021).

CVE-2019-5640

CVE-2019-5640 affects Rapid7 Nexpose

CVE-2020-7381

The CVE-2020-7381 issue affects Rapid7 Nexpose installer versions before 6.6.40, where the installer executes a binary that can be replaced by an attacker with local access. This could cause the installer to treat a malicious executable with the same name as legitimate during Security Console ins...