Vulnerabilidades de Tenable
CVEs publicadas que afetam produtos de Tenable: 60 registro(s), com severidade, exploração e correções.
Security Center 20Nessus 19Tenable.sc 8Nessus Agent 6Log Correlation Engine 4Nessus Network Monitor 3Terrascan 3Agent 2Operational Technology Exposure 1Identity Exposure 1Tenable Nessus, Tenable Nessus Agent 1Tenable Identity Exposure (SaaS) 1Tenable Operation Technology 1Sensor Proxy 1
CVE-2020-1967
Alta · 7.5
CWE-476 21/04/2020
Segmentation fault in SSL_check_chain
Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f).
CVE-2020-11656
Crítica · 9.8
CWE-416 09/04/2020
In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by...
In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement.
CVE-2020-11655
Alta · 7.5
CWE-665 09/04/2020
SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a...
SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's initialization is mishandled.
CVE-2019-19646
Crítica · 9.8
CWE-754 09/12/2019
pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in...
pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns.
CVE-2019-19645
Média · 5.5
CWE-674 09/12/2019
alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types...
alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements.
CVE-2019-1551
Média · 5.3
CWE-190 06/12/2019
rsaz_512_sqr overflow bug on x86_64
There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. Also applications directly using the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME. Fixed in OpenSSL 1.1.1e (Affected 1.1.1-1.1.1d). Fixed in OpenSSL 1.0.2u (Affected 1.0.2-1.0.2t).
CVE-2019-11043
Crítica · 9.8
KEV Urgente · 90 Exploit público Ransomware CWE-787 28/10/2019
PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.
CVE-2019-16168
Média · 6.5
CWE-369 09/09/2019
In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other...
In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a "severe division by zero in the query planner."
CVE-2018-20843
Alta · 7.5
CWE-611 24/06/2019
In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of...
In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and CPU resources while processing (enough to be usable for denial-of-service attacks).
CVE-2018-5407
Média · 4.7
Exploit público CWE-203 15/11/2018
Observable Discrepancy em Canonical Ubuntu Linux
Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.