Vulnerabilities > Tenable > Nessus Network Monitor > 5.4.1
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2024-09-30 | CVE-2024-9158 | Cross-site Scripting vulnerability in Tenable Nessus Network Monitor A stored cross site scripting vulnerability exists in Nessus Network Monitor where an authenticated, privileged local attacker could inject arbitrary code into the NNM UI via the local CLI. | 4.6 |
| 2023-10-26 | CVE-2023-5623 | Code Injection vulnerability in Tenable Nessus Network Monitor NNM failed to properly set ACLs on its installation directory, which could allow a low privileged user to run arbitrary code with SYSTEM privileges where NNM is installed to a non-standard location | 7.8 |
| 2023-10-26 | CVE-2023-5624 | Improper Input Validation vulnerability in Tenable Nessus Network Monitor Under certain conditions, Nessus Network Monitor was found to not properly enforce input validation. | 7.2 |
| 2021-08-24 | CVE-2021-3711 | Classic Buffer Overflow vulnerability in multiple products In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). | 9.8 |
| 2021-08-24 | CVE-2021-3712 | Out-of-bounds Read vulnerability in multiple products ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. | 7.4 |
| 2020-12-08 | CVE-2020-1971 | NULL Pointer Dereference vulnerability in multiple products The X.509 GeneralName type is a generic type for representing different types of names. | 5.9 |