Tenable Nessus vulnerabilities

CVE-2014-4980 [MEDIUM] CWE-200 CVE-2014-4980: The /server/properties resource in Tenable Web UI before 2.3.5 for Nessus 5.2.3 through 5.2.7 allows The /server/properties resource in Tenable Web UI before 2.3.5 for Nessus 5.2.3 through 5.2.7 allows remote attackers to obtain sensitive information via the token parameter.

CVE-2014-2848 [MEDIUM] CWE-362 CVE-2014-2848: A race condition in the wmi_malware_scan.nbin plugin before 201402262215 for Nessus 5.2.1 allows loc A race condition in the wmi_malware_scan.nbin plugin before 201402262215 for Nessus 5.2.1 allows local users to gain privileges by replacing the dissolvable agent executable in the Windows temp directory with a Trojan horse program.

CVE-2023-3253 [MEDIUM] CWE-863 CVE-2023-3253: An improper authorization vulnerability exists where an authenticated, low privileged remote attack An improper authorization vulnerability exists where an authenticated, low privileged remote attacker could view a list of all the users available in the application.

CVE-2024-0955 [MEDIUM] CWE-20 CVE-2024-0955: A stored XSS vulnerability exists where an authenticated, remote attacker with administrator privil A stored XSS vulnerability exists where an authenticated, remote attacker with administrator privileges on the Nessus application could alter Nessus proxy settings, which could lead to the execution of remote arbitrary scripts.

CVE-2026-57588 [LOW] CWE-89 CVE-2026-57588: A SQL injection vulnerability in Nessus allows an attacker to craft a malicious scan result file tha A SQL injection vulnerability in Nessus allows an attacker to craft a malicious scan result file that, when imported by a privileged user, injects malicious SQL into the scan results database, potentially enabling exfiltration of scan-result data.

CVE-2016-1000029 [MEDIUM] CWE-79 CVE-2016-1000029: Tenable Nessus before 6.8 has a stored XSS issue that requires admin-level authentication to the Nes Tenable Nessus before 6.8 has a stored XSS issue that requires admin-level authentication to the Nessus UI, and would potentially impact other admins (Tenable IDs 5218 and 5269).

CVE-2025-36625 [MEDIUM] CWE-117 CVE-2025-36625: In Nessus versions prior to 10.8.4, a non-authenticated attacker could alter Nessus logging entries In Nessus versions prior to 10.8.4, a non-authenticated attacker could alter Nessus logging entries by manipulating http requests to the application.

CVE-2016-1000028 [MEDIUM] CWE-79 CVE-2016-1000028: Tenable Nessus before 6.8 has a stored XSS issue that requires admin-level authentication to the Nes Tenable Nessus before 6.8 has a stored XSS issue that requires admin-level authentication to the Nessus UI, and would only potentially impact other admins. (Tenable ID 5198).

CVE-2017-7849 [MEDIUM] CWE-732 CVE-2017-7849: Nessus 6.10.x before 6.10.5 was found to be vulnerable to a local denial of service condition due to Nessus 6.10.x before 6.10.5 was found to be vulnerable to a local denial of service condition due to insecure permissions when running in Agent Mode.

CVE-2019-3962 [LOW] CWE-79 CVE-2019-3962: Content Injection vulnerability in Tenable Nessus prior to 8.5.0 may allow an authenticated, local a Content Injection vulnerability in Tenable Nessus prior to 8.5.0 may allow an authenticated, local attacker to exploit this vulnerability by convincing another targeted Nessus user to view a malicious URL and use Nessus to send fraudulent messages. Successful exploitation could allow the authenticated adversary to inject arbitrary text into the feed statu