Vulnerabilidades em Tenable

81 resultados
Análise Vexday

Com 73 CVEs catalogadas e nenhuma confirmada em exploração ativa pelo CISA KEV, o perfil de risco da Tenable situa-se abaixo da média geral do catálogo, que registra 0,45% de taxa de exploração. A ausência de vulnerabilidades críticas e de novas ocorrências nos últimos 90 dias reforça um cenário de baixa pressão imediata, embora duas CVEs com prova de conceito pública mereçam atenção contínua por reduzirem a barreira técnica para tentativas de exploração. O tipo de falha mais recorrente é CWE-269 (gerenciamento impróprio de privilégios), um padrão que frequentemente serve de vetor para escalonamento de acesso em ambientes corporativos. A CVE mais relevante no momento, CVE-2019-3921, apresenta EPSS de 0,1789, indicando probabilidade não desprezível de exploração e justificando priorização nas rotinas de patching, especialmente em instalações que ainda não aplicaram as correções disponíveis.

CVE-2019-3921—The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 is vulnerable to a stack buffer overflow via crafted HTTP POST reEPSS 17.9%CVE-2019-3924—MikroTik RouterOS before 6.43.12 (stable) and 6.42.12 (long-term) is vulnerable to an intermediary vulnerability. The software will execute EPSS 15.7%CVE-2019-3922—The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 is vulnerable to a stack buffer overflow via crafted HTTP POST reEPSS 5.2%CVE-2019-3912—An open redirect vulnerability in LabKey Server Community Edition before 18.3.0-61806.763 via the /__r1/ returnURL parameter allows an unautEPSS 4.8%CVE-2019-3920—The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 is vulnerable to authenticated command injection via crafted HTTPEPSS 3.9%CVE-2019-3919—The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 is vulnerable to command injection via crafted HTTP request sent EPSS 3.9%CVE-2019-3911—Reflected cross-site scripting (XSS) vulnerability in LabKey Server Community Edition before 18.3.0-61806.763 allows an unauthenticated remoEPSS 3.8%CVE-2018-1152—libjpeg-turbo 1.5.90 is vulnerable to a denial of service vulnerability caused by a divide by zero when processing a crafted BMP image.EPSS 3.4%CVE-2020-5756—Grandstream GWN7000 firmware version 1.0.9.4 and below allows authenticated remote users to modify the system's crontab via undocumented APIEPSS 2.5%CVE-2019-3917—The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 allows a remote, unauthenticated attacker to enable telnetd on thEPSS 2.4%CVE-2019-3918—The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 contains multiple hard coded credentials for the Telnet and SSH iEPSS 2.0%CVE-2019-3913—Command manipulation in LabKey Server Community Edition before 18.3.0-61806.763 allows an authenticated remote attacker to unmount any driveEPSS 1.7%CVE-2024-1367HIGHCommand Injection Vulnerability in Tenable Security CenterEPSS 1.6%CVE-2018-15694—ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to upload files to arbitrary locations due to a patEPSS 1.5%CVE-2019-3961—Nessus versions 8.4.0 and earlier were found to contain a reflected XSS vulnerability due to improper validation of user-supplied input. An EPSS 1.5%CVE-2017-11508—SecurityCenter versions 5.5.0, 5.5.1 and 5.5.2 contain a SQL Injection vulnerability that could be exploited by an authenticated user with sEPSS 1.2%CVE-2026-2630HIGH[R1] Stand-alone Security Patches Available for Tenable Security Center versions 6.5.1, 6.6.0 and 6.7.2: SC-202602.1 + SC-202602.2EPSS 1.2%CVE-2018-1147—In Nessus before 7.1.0, a XSS vulnerability exists due to improper input validation. A remote authenticated attacker could create and uploadEPSS 1.1%CVE-2018-15698—ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to read any file on the file system when providing EPSS 1.1%CVE-2023-6062MEDIUMArbitrary File WriteEPSS 1.0%