CVE-2019-11049

CVE-2019-11049 affects PHP 7.3.x with versions below 7.3.13 and PHP 7.4.0 on Windows. The issue arises when supplying custom headers to mail() with the header in lowercase, which can cause double-free of memory locations. There are no exploitation details in the provided documents beyond this des...

CVE-2019-11050

CVE-2019-11050 concerns the PHP EXIF extension: when parsing EXIF data via exif_read_data(), PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13, and 7.4.0 allow data to read beyond the allocated buffer, leading to potential information disclosure or a crash. Connected advisories confirm the vuln...

CVE-2019-11045

In PHP, DirectoryIterator vulnerability CVE-2019-11045 affects PHP 7.2.x < 7.2.26, 7.3.x

CVE-2019-11046

Summary (CVE-2019-11046) : PHP versions affected are 7.2.x below 7.2.26, 7.3.x below 7.3.13, and 7.4.0. The vulnerability is in the bcmath extension where a string containing characters identified as numeric by the OS but not ASCII digits can cause reading beyond allocated space, potentially disc...

CVE-2019-11044

The CVE-2019-11044 issue affects PHP when running on Windows, where the link() function accepts filenames with embedded null bytes and treats them as terminating at that byte. Affected PHP versions are 7.2.x below 7.2.26, 7.3.x below 7.3.13, and 7.4.0 on Windows. The underlying cause is null-byte...

CVE-2026-19626

CVE-2026-19626 is a remote code execution vulnerability affecting Tenable Security Center via its report generation functionality. An authenticated, non-administrative user can supply specially crafted input that is processed unsafely during server-side report rendering, leading to arbitrary code...

CVE-2026-19681

CVE-2026-19681 is an authenticated command-injection vulnerability in Security Center tied to file upload processing. The issue could allow arbitrary OS command execution after uploading a crafted file, with impact on confidentiality, integrity, and availability reported as High. Tenable’s adviso...

CVE-2024-1891

The CVE-2024-1891 entry describes a stored cross-site scripting vulnerability in Tenable Security Center. A authenticated, remote attacker could inject HTML code into a web application scan result page due to inadequate input handling in the affected component/file. Relevant details show impact c...

CVE-2026-19682

CVE-2026-19682 is an OS command injection in Security Center. The CVE description states a remote, unauthenticated attacker can execute arbitrary commands on the underlying OS with the service account privileges. The Tenable advisory for Security Center 6.9.0 notes this vulnerability among others...

CVE-2018-1154

The CVE-2018-1154 issue affects SecurityCenter prior to version 5.7.0, where an unauthenticated attacker could enumerate username aliases by brute-forcing responses, potentially leading to unauthorized access. The issue’s root cause is a username enumeration mechanism; mitigation configured in th...

CVE-2024-1471

CVE-2024-1471 is an HTML injection vulnerability affecting Tenable Security Center (prior to 6.3.0). An authenticated administrator could modify Repository parameters, potentially causing HTML redirection. Impact is described as Medium (per CVSS metrics: AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N or I:L...

CVE-2024-1367

Summary: CVE-2024-1367 is a command-injection vulnerability in Tenable Security Center. An authenticated, remote attacker with administrator privileges could modify Logging parameters, potentially executing arbitrary code on the Security Center host. The issue is mitigated by the Security Center ...

CVE-2026-2697

CVE-2026-2697 is an IDOR vulnerability in Tenable Security Center prior to 6.8.0 where an authenticated remote attacker can escalate privileges via the owner parameter. Multiple sources (NVD, Red Hat, CVE listings, and Tenable advisory) confirm the issue and its association with Security Center. ...

CVE-2018-1155

Tenable SecurityCenter (pre-5.7.0) is affected by an XSS vulnerability in the Reports feature: an authenticated attacker can inject JavaScript via the image filename parameter due to insufficient input validation. The issue is addressed in versions 5.7.0 and later through updated input validation...

CVE-2026-19628

CVE-2026-19628: A command injection vulnerability exists in Tenable Security Center. An authenticated administrator could modify application configuration values to achieve arbitrary command execution on the underlying OS when specific backend operations are triggered. Supported metrics show a Hi...

CVE-2026-19639

CVE-2026-19639 is an Improper Access Control vulnerability affecting Tenable Security Center. The issue allows an authenticated non-administrative application user to view settings outside their assigned scope. Tenable’s advisory (TENABLE:20EF43...) indicates the fix is delivered with Security Ce...

CVE-2026-19629

CVE-2026-19629 describes a privilege-escalation in Tenable Security Center where a user with the Security Manager role and “manage user” permission on a single group can modify users in other groups, bypassing cross-group access controls. The issue affects the Security Center component and is cla...

CVE-2026-19635

CVE-2026-19635 is a local privilege escalation in Security Center. The advisory states: an attacker with write access to a specific configuration file can achieve arbitrary code execution with elevated privileges, without user interaction. The entry is listed in the Tenable advisory for Security ...

CVE-2026-19680

CVE-2026-19680 is a SQL injection vulnerability in Security Center that could allow an attacker to access unauthorized data from the application's database. The public records show a high-severity impact with CVSS metrics indicating network access and low privileges required. Tenable’s advisory f...

CVE-2026-19679

Affects Security Center; CVE-2026-19679 is described as an input validation issue in the file-upload handling where insufficient sanitization of filenames could contribute to a downstream command injection. Tenable’s advisory for Security Center version 6.9.0 notes fixes that upgrade core compone...

CVE-2026-2698

CVE-2026-2698 is an improper access control vulnerability described across multiple sources as allowing an authenticated user to access areas outside their authorized scope. Connected documents tie the issue to Tenable Security Center (and its 6.8.0 fix) and Red Hat/NVD entries, all noting the sa...

CVE-2026-19631

CVE-2026-19631 describes a SQL injection vulnerability in Security Center that could allow an authenticated administrator to execute arbitrary SQL queries and access sensitive data, including credentials. Tenable’s advisory indicates Security Center 6.9.0 fixes multiple vulnerabilities and lists ...

CVE-2026-19636

The CVE-2026-19636 issue concerns CSRF token generation using a predictable method. The connected documents confirm a fix that increases randomness and entropy in token generation, addressing the vulnerability. The description does not specify affected products, versions, or exploit details. The ...