CVE Feed

    Dashboard / CVE / CVE-2018-1147

    CVE-2018-1147

    In Nessus before 7.1.0, a XSS vulnerability exists due to improper input validation. A remote authenticated attacker could create and upload a .nessus file, which may be viewed by an administrator allowing for the execution of arbitrary script code in a user's browser session. In other scenarios, XSS could also occur by altering variables from the Advanced Settings.

    Published:May 18, 2018
    Last Modified:Nov 21, 2024
    EPS:May 18, 2018
    EPSS Score:0.00363
    CVSS Score:5.4

    Affected Products

    Vendor
    Tenable
    Product
    Nessus

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-57588 (CVSS 1.8) — A SQL injection vulnerability in Nessus allows an attacker to craft a malicious scan result file that, when im…
    CVE-2026-57587 (CVSS 2.9) — A SQL injection vulnerability in Nessus allows a remote, unauthenticated attacker who controls reverse DNS rec…
    CVE-2026-33694 (CVSS 7.4) — This vulnerability allows an attacker to create a junction, enabling the deletion of arbitrary files with SYST…
    CVE-2025-36630 (CVSS 8.4) — In Tenable Nessus versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user coul…
    CVE-2025-36625 (CVSS 4.3) — In Nessus versions prior to 10.8.4, a non-authenticated attacker could alter Nessus logging entries by manipul…
    CVE-2025-24914 (CVSS 7.8) — When installing Nessus to a non-default location on a Windows host, Nessus versions prior to 10.8.4 did not en…
    CVE-2024-3290 (CVSS 8.2) — A race condition vulnerability exists where an authenticated, local attacker on a Windows Nessus host could mo…
    CVE-2024-3289 (CVSS 7.8) — When installing Nessus to a directory outside of the default location on a Windows host, Nessus versions prior…
    CVE-2024-2390 (CVSS 7.8) — As a part of Tenable’s vulnerability disclosure program, a vulnerability in a Nessus plugin was identified an…
    CVE-2024-0971 (CVSS 6.5) — A SQL injection vulnerability exists where an authenticated, low-privileged remote attacker could potentially…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High