Vulnerabilities

A command injection vulnerability exists in Security Center where a remote, unauthenticated attacker could exploit this issue to execute arbitrary commands on the underlying operating system with the privileges of the se…

An authenticated command injection vulnerability exists in Security Center related to file upload processing.

A SQL injection vulnerability exists in Security Center that could allow an attacker to access unauthorized data from the application's database.

An input validation vulnerability exists in Security Center's file upload handling, where insufficient sanitization of uploaded filenames could contribute to a downstream command injection issue.

An improper access control vulnerability exists where an authenticated non-administrative application user could potentially view settings outside of their assigned scope.

An issue was identified in which CSRF tokens were generated using a predictable method, potentially reducing their effectiveness as a security control.

A local privilege escalation vulnerability exists in Security Center.

A SQL injection vulnerability exists in Security Center that could allow an authenticated administrator to execute arbitrary SQL queries, potentially resulting in unauthorized access to sensitive data, including credenti…

A privilege escalation vulnerability exists in Tenable Security Center that allows a user with "Security Manager" role and "manage user" permission on a single group to modify users belonging to other groups.

A command injection vulnerability exists in Tenable Security Center.

A remote code execution vulnerability exists in Tenable Security Center's report generation functionality.