Vulnerabilities

As part of our Security Development Lifecycle, a potential privilege escalation issue was identified internally.

A Server Side Request Forgery (SSRF) vulnerability exists in Tenable.sc due to improper validation of session & user-accessible input data.

A stored cross-site scripting (XSS) vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users.

A formula injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users.

A LDAP injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users.

Composer is a dependency manager for the PHP programming language.

Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates.

Tenable.sc versions 5.14.0 through 5.19.1 were found to contain a remote code execution vulnerability which could allow a remote, unauthenticated attacker to execute code under special circumstances.

A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be…

A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts).

In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode the filename passed to them.

jQuery-UI is the official jQuery user interface library.

jQuery-UI is the official jQuery user interface library.

jQuery-UI is the official jQuery user interface library.

Composer is an open source dependency manager for the PHP language.

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.

Malformed requests may cause the server to dereference a NULL pointer.

ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length.

In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt().

A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning.

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument…

An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client.

Tenable.sc and Tenable.sc Core versions 5.13.0 through 5.17.0 were found to contain a vulnerability that could allow an authenticated, unprivileged user to perform Remote Code Execution (RCE) on the Tenable.sc server via…

The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate.

In certain scenarios in Tenable.sc prior to 5.17.0, a scanner could potentially be used outside the user's defined scan zone without a particular zone being specified within the Automatic Distribution configuration.