CVE Feed

    Dashboard / CVE / CVE-2017-11506

    CVE-2017-11506

    When linking a Nessus scanner or agent to Tenable.io or other manager, Nessus 6.x before 6.11 does not verify the manager's TLS certificate when making the initial outgoing connection. This could allow man-in-the-middle attacks.

    Published:Aug 9, 2017
    Last Modified:Apr 20, 2025
    EPS:Aug 9, 2017
    EPSS Score:0.00104
    CVSS Score:7.4

    Affected Products

    Vendor
    Tenable
    Product
    Nessus

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-295 Improper Certificate Validation

    Related CVEs

    CVE-2026-57588 (CVSS 1.8) — A SQL injection vulnerability in Nessus allows an attacker to craft a malicious scan result file that, when im…
    CVE-2026-57587 (CVSS 2.9) — A SQL injection vulnerability in Nessus allows a remote, unauthenticated attacker who controls reverse DNS rec…
    CVE-2026-33694 (CVSS 7.4) — This vulnerability allows an attacker to create a junction, enabling the deletion of arbitrary files with SYST…
    CVE-2025-36630 (CVSS 8.4) — In Tenable Nessus versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user coul…
    CVE-2025-36625 (CVSS 4.3) — In Nessus versions prior to 10.8.4, a non-authenticated attacker could alter Nessus logging entries by manipul…
    CVE-2025-24914 (CVSS 7.8) — When installing Nessus to a non-default location on a Windows host, Nessus versions prior to 10.8.4 did not en…
    CVE-2024-3290 (CVSS 8.2) — A race condition vulnerability exists where an authenticated, local attacker on a Windows Nessus host could mo…
    CVE-2024-3289 (CVSS 7.8) — When installing Nessus to a directory outside of the default location on a Windows host, Nessus versions prior…
    CVE-2024-2390 (CVSS 7.8) — As a part of Tenable’s vulnerability disclosure program, a vulnerability in a Nessus plugin was identified an…
    CVE-2024-0971 (CVSS 6.5) — A SQL injection vulnerability exists where an authenticated, low-privileged remote attacker could potentially…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High