SecNews

TAG

#sqli

10月1日周四

  1. Tenable Security Advisories

    [R1] Nessus Version 10.12.5 Fixes Multiple Vulnerabilities

    CVE-2026-103946CVE-2026-103947CVE-2026-103948+1sqli

    [R1] Nessus Version 10.12.5 Fixes Multiple Vulnerabilities Arnie Cabral Thu, 10/01/2026 - 14:31 Several vulnerabilities have been identified, reported to Tenable and resolved. Please see the full list of resolved issues below.IssueCVE ID Severity CVSS v3 Base/TemporalCVSS v3 VectorAn SQL injection vulnerability could allow an authenticated user to read or modify data stored by Nessus.CVE-2026-103946High8.3 / 7.7CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L/E:F/RL:O/RC:CNessus did not sufficiently verify the integrity of certain downloaded content before using it, which could allow an authenticated, privileged attacker to compromise the system.CVE-2026-103947Critical9.1 / 8.4CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:F/RL:O/RC:CImproper handling of inconsistent length values could allow an authenticated, privileged attacker to compromise the confidentiality, integrity or availability of Nessus.CVE-2026-103948High7.2 / 6.7CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:CA type confusion vulnerability could allow an authenticated, privileged attacker to compromise the confidentiality, integrity or availability of Nessus.CVE-2026-103950High7.2 / 6.7CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:CAn out-of-bounds write vulnerability could allow an authenticated, privileged attacker to compromise the confidentiality, integrity or availability of Nessus.CVE-2026-103951High7.2 / 6.7CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:CAn out-of-bounds write

8月13日周四

  1. Tenable Security Advisories

    [R2] Security Center Version 6.9.0 Fixes Multiple Vulnerabilities

    CVE-2026-19639CVE-2026-19680CVE-2026-19681+1sqli

    [R2] Security Center Version 6.9.0 Fixes Multiple Vulnerabilities Arnie Cabral Thu, 08/13/2026 - 10:35 Security Center leverages third-party software to help provide underlying functionality. Several of the third-party components (curl, underscoreJS) were found to contain vulnerabilities, and updated versions have been made available by the providers. Out of caution and in line with best practice, Tenable has opted to upgrade these libraries to address the potential impact of the issues. Security Center 6.9.0 updates the following components:curl to version 8.20underscoreJS to version 1.13.8Additionally, several vulnerabilities were reported to Tenable and addressed within this update. Please see the full list of resolved issues below.ComponentCVE ID Severity CVSS v3 BaseCVSS v3 Temporal CVSS v3 VectorSecurity Center - Improper Access ControlCVE-2026-19639Medium4.33.9AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:CSecurity Center - OS Command InjectionCVE-2026-19682Critical9.09.0AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HSecurity Center - OS Command InjectionCVE-2026-19681Critical9.98.9AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:CSecurity Center - SQL InjectionCVE-2026-19680High7.16.4AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N/E:P/RL:O/RC:CSecurity Center - OS Command InjectionCVE-2026-19679High8.87.9AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:CSecurity Center - Brute Force EnumerationCVE-2026-19636Medium5.34.8AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N/E:P/RL:O/RC:CSecurity Center - Local

7月31日周五

  1. Tenable Security Advisories

    [R2] Stand-alone Security Patch Available for SC Versions 6.6.4, 6.7.5 and 6.8.0 on Tenable Enclave Security: SC202607.2

    CVE-2026-64877CVE-2026-64878CVE-2026-64879+1sqli

    [R2] Stand-alone Security Patch Available for SC Versions 6.6.4, 6.7.5 and 6.8.0 on Tenable Enclave Security: SC202607.2 Jason Schavel Fri, 07/31/2026 - 13:00 Security Center on Tenable Enclave Security leverages third-party software to help provide underlying functionality. Several of the third-party components (apache, OpenSSL, postgreSQL, PHP, redis) were found to contain vulnerabilities, and updated versions have been made available by the providers. Out of caution and in line with best practice, Tenable has opted to upgrade these libraries to address the potential impact of the issues. Security Center Patch SC202607.2 updates the following components:postgresql to version 16.14Apache to version 2.4.67OpenSSL to version 3.5.4PHP to version 8.2.31GO to version 1.26.5redis to version 8.2.6 (6.7.x and 6.8.0 only)Additionally, several vulnerabilities were reported to Tenable and addressed within this patch. Please see the full list of resolved issues below.ComponentCVE IDSeverityCVSS Base v3 CVSS v3 Temporal CVSS v3 VectorSecurity Center - SQL InjectionCVE-2026-64877 High8.47.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N/E:P/RL:U/RC:CSecurity Center - Command InjectionCVE-2026-64878 Critical9.98.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:CSecurity Center - Command InjectionCVE-2026-64879 Critical9.98.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:CSecurity Center - Blind SQL InjectionCVE-2026-64880 High7.17.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A