Vulnerabilidades do Tenable Security Center
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Tenable Security Center: 9 registro(s), com versões afetadas e correções.cpe:2.3:a:tenable:security_center
CVE-2026-64881
Alta · 8.8
CWE-78 21/07/2026
OS Command Injection em Tenable Security Center
The audit file upload handler does not sanitize filenames, allowing shell metacharacters to flow into system command execution. This input validation failure enables command injection when chained with a related vulnerability.
CVE-2026-64880
Alta · 7.1
CWE-89 21/07/2026
SQL Injection em Tenable Security Center
Unsanitized user-supplied input in report filtering parameters is concatenated directly into SQL queries without proper escaping or parameterized queries, enabling blind SQL injection and unauthorized database read access.
CVE-2026-64879
Crítica · 9.9
CWE-78 21/07/2026
OS Command Injection em Tenable Security Center
A filename supplied during file upload is not properly sanitized before being used in system command execution, allowing an attacker to inject shell metacharacters and achieve command injection via the audit file upload functionality.
CVE-2026-64878
Crítica · 9.9
CWE-78 21/07/2026
OS Command Injection em Tenable Security Center
Unvalidated input in asset filter parameters allows shell metacharacters to escape command argument handling, resulting in remote code execution as a low-privileged OS user via the Analysis REST endpoint.
CVE-2026-64877
Alta · 8.4
CWE-20 21/07/2026
Improper Input Validation em Tenable Security Center
An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API to access sensitive data stored in the appliance database.
CVE-2026-2698
Média · 6.5
CWE-639 23/02/2026
Improper Access Control
An improper access control vulnerability exists where an authenticated user could access areas outside of their authorized scope.
CVE-2026-2697
Alta · 8.8
CWE-639 23/02/2026
Indirect Object Reference (IDOR) in Security Center
An Indirect Object Reference (IDOR) in Security Center allows an authenticated remote attacker to escalate privileges via the 'owner' parameter.
CVE-2026-2630
Alta · 8.8
CWE-78 17/02/2026
[R1] Stand-alone Security Patches Available for Tenable Security Center versions 6.5.1, 6.6.0 and 6.7.2: SC-202602.1 + SC-202602.2
A Command Injection vulnerability exists where an authenticated, remote attacker could execute arbitrary code on the underlying server where Tenable Security Center is hosted.
CVE-2025-36636
Média · 4.3
CWE-284 08/10/2025
Improper Access Control
In Tenable Security Center versions prior to 6.7.0, an improper access control vulnerability exists where an authenticated user could access areas outside of their authorized scope.