CVE-2022-28291

The CVE-2022-28291 entry describes an information-disclosure vulnerability in Tenable Nessus (Essentials and Professional). An authenticated user with debug privileges can dump the nessusd process and read Nessus policy credentials in cleartext, enabling access to credentials stored in Nessus sca...

CVE-2024-0955

CVE-2024-0955 is a stored XSS in Tenable Nessus where an authenticated administrator could alter proxy settings, potentially causing remote script execution. Affected software: Nessus (prior to 10.7.0). Impact per sources: proxy configuration manipulation leading to remote arbitrary scripts. Miti...

CVE-2016-1000029

Tenable Nessus before version 6.8 is affected by a stored cross-site scripting (XSS) vulnerability. The issue stems from insufficient input filtering in Nessus UI, enabling an authenticated administrator to inject script code that could affect other admins. This CVE (CVE-2016-1000029) is document...

CVE-2017-7849

CVE-2017-7849 affects Nessus Agent 6.10.x prior to 6.10.5. The vulnerability arises from insecure permissions in agent mode, allowing an authenticated, remote attacker to trigger a DoS by causing the agent to fail to conduct scans. The issue is documented alongside a related CVE-2017-7850 local p...

CVE-2017-6543

The CVE-2017-6543 entry refers to Tenable Nessus prior to 6.10.2 (and Tenable Appliance prior to 4.5.0) on Windows, with an arbitrary file upload flaw that a remote, authenticated attacker could exploit to write files anywhere and potentially gain elevated privileges after reboot. The connected N...

CVE-2014-2848

CVE-2014-2848 describes a local privilege-escalation flaw in Nessus 5.2.1, caused by a race condition in the wmi_malware_scan.nbin plugin before 201402262215. Attackers could replace the dissolvable agent executable in the Windows Temp directory with a Trojan horse to gain privileges. Connected s...

CVE-2017-7199

CVE-2017-7199 concerns Nessus Agent mode local privilege escalation. Affected: Nessus, versions 6.6.2 through 6.10.3. Root cause: insecure permissions allow a local attacker to escalate privileges when Nessus runs in Agent Mode. Impact: local elevation of privileges with full system compromise po...

CVE-2020-5765

CVE-2020-5765 affects Tenable Nessus versions prior to 8.11.0, where a Stored XSS vulnerability arises from improper validation of input during scan configuration. An authenticated, remote attacker could exploit this to run arbitrary code in a user’s session. Tenable addressed the issue with inpu...

CVE-2016-1000028

CVE-2016-1000028 : A stored XSS in Tenable Nessus prior to 6.8 affects the Nessus UI. The issue requires authentication (admin-level access) and could potentially impact other admins. Affected software is Nessus 6.x before 6.8; root cause relates to improper input filtering in UI handling. The co...

CVE-2020-5774

CVE-2020-5774 concerns Tenable Nessus. The affected products are Nessus versions prior to 8.11.1, where sessions could be kept longer than permitted in certain scenarios, enabling a local attacker to log into an existing browser session due to improper session expiration. The issue is described a...

CVE-2026-57588

CVE-2026-57588 is a SQL injection vulnerability in Nessus. A crafted malicious scan result file, when imported by a privileged user, injects SQL into the scan results database, potentially exfiltrating scan data. The vulnerability affects Nessus in scenarios where a scan-result file is imported b...

CVE-2014-4980

The CVE-2014-4980 entry affects Tenable Nessus/Web UI, specifically Nessus versions 5.2.3–5.2.7. The issue is an information-disclosure vulnerability in the Web UI: the /server/properties endpoint can disclose sensitive data via the token parameter due to insufficient parameter checking. Reported...

CVE-2016-9259

CVE-2016-9259 refers to a cross-site scripting (XSS) vulnerability in Tenable Nessus prior to version 6.9.1. Connected sources describe it as a stored XSS flaw caused by improper validation of user-supplied input, exploitable by an authenticated remote attacker via specially crafted requests to e...

CVE-2017-5179

CVE-2017-5179 is a stored XSS vulnerability in Tenable Nessus prior to 6.9.3. An authenticated user can inject arbitrary script/HTML into Nessus pages, potentially causing the victim’s browser to execute code in the context of the logged-in user. Affected product/version: Nessus before 6.9.3. Roo...

CVE-2017-7850

CVE-2017-7850 affects Nessus Agent 6.10.x prior to 6.10.5 running in Agent Mode. The issue is a local privilege escalation caused by insecure permissions in agent mode, enabling an authenticated local attacker to gain elevated privileges (high impact). Tenable and NVD list this alongside a relate...

CVE-2021-20106

CVE-2021-20106 affects Tenable Nessus Agent versions 8.2.5 and earlier. Root cause is insufficient validation during file uploads, enabling a Nessus administrator to upload a crafted file that escalates privileges on the Nessus host. Affected component: Nessus Agent (Windows/Linux/macOS as deploy...

CVE-2023-2005

This CVE affects Tenable.Io, Nessus, and Tenable Security Center prior to Plugin Feed ID #202306261202. The issue enables a user with scan-target permissions to place a binary in a specific filesystem location to escalate privileges via the impacted plugin. Remediation per PT-2023-17405 recommend...

CVE-2026-57587

The CVE-2026-57587 entry describes a SQL injection in Nessus affecting the scan results database. An unauthenticated remote attacker who controls reverse DNS records for a scanned host can inject malicious SQL, potentially exfiltrating scan-result data. The connected documents specify Nessus as t...