Security Center vulnerabilities
14 known vulnerabilities in Security Center from Tenable. 14 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.9 Critical severity
Security Center: Improper Neutralization of Special Elements used in an OS Command
A command injection vulnerability exists in Security Center where a remote, unauthenticated attacker could exploit this issue to execute arbitrary commands on the underlying operating system with the privileges of the service account.
- 9.9 Critical severity
Security Center: Improper Neutralization of Special Elements used in an OS Command
An authenticated command injection vulnerability exists in Security Center related to file upload processing. An attacker could exploit this issue by uploading a specially crafted file, potentially resulting in arbitrary command execution on the underlying ope
- 8.8 High severity
Security Center: Improper Neutralization of Special Elements used in an OS Command
An input validation vulnerability exists in Security Center's file upload handling, where insufficient sanitization of uploaded filenames could contribute to a downstream command injection issue.
- 8.8 High severity
Security Center: Improper Neutralization of Special Elements used in an OS Command
A local privilege escalation vulnerability exists in Security Center. An attacker with write access to a specific configuration file could achieve arbitrary code execution with elevated privileges, without requiring further user or victim interaction.
- 8.1 High severity
Security Center: Incorrect Authorization
A privilege escalation vulnerability exists in Tenable Security Center that allows a user with "Security Manager" role and "manage user" permission on a single group to modify users belonging to other groups. This bypasses the intended access control restricti
- 7.2 High severity
Security Center: Improper Neutralization of Special Elements used in an OS Command
A command injection vulnerability exists in Tenable Security Center. An authenticated administrator could modify application configuration values to achieve arbitrary command execution on the underlying operating system when specific backend operations are tri
- 9.9 Critical severity
Security Center: Improper Neutralization of Directives in Dynamically Evaluated Code
A remote code execution vulnerability exists in Tenable Security Center's report generation functionality. An authenticated, non-administrative user could exploit this issue by supplying specially crafted input that is later processed unsafely during server-si
- 8.8 High severity
Security Center: Improper Neutralization of Special Elements used in an OS Command
The audit file upload handler does not sanitize filenames, allowing shell metacharacters to flow into system command execution. This input validation failure enables command injection when chained with a related vulnerability.
- 7.1 High severity
Security Center: Improper Neutralization of Special Elements used in an SQL Command
Unsanitized user-supplied input in report filtering parameters is concatenated directly into SQL queries without proper escaping or parameterized queries, enabling blind SQL injection and unauthorized database read access.
- 9.9 Critical severity
Security Center: Improper Neutralization of Special Elements used in an OS Command
A filename supplied during file upload is not properly sanitized before being used in system command execution, allowing an attacker to inject shell metacharacters and achieve command injection via the audit file upload functionality.
- 9.9 Critical severity
Security Center: Improper Neutralization of Special Elements used in an OS Command
Unvalidated input in asset filter parameters allows shell metacharacters to escape command argument handling, resulting in remote code execution as a low-privileged OS user via the Analysis REST endpoint.
- 8.8 High severity
Security Center: Improper Neutralization of Special Elements used in an OS Command
A Command Injection vulnerability exists where an authenticated, remote attacker could execute arbitrary code on the underlying server where Tenable Security Center is hosted.
- 7.2 High severity
Security Center: Improper Neutralization of Special Elements used in an OS Command
A command injection vulnerability exists where an authenticated, remote attacker with administrator privileges on the Security Center application could modify Logging parameters, which could lead to the execution of arbitrary code on the Security Center host.
- 8.8 High severity
Tenable.io: Uncontrolled Search Path Element
Vulnerability in Tenable Tenable.Io, Tenable Nessus, Tenable Security Center.This issue affects Tenable.Io: before Plugin Feed ID #202306261202 ; Nessus: before Plugin Feed ID #202306261202 ; Security Center: before Plugin Feed ID #202306261202 . This vulnerab