Nessus Network Monitor CVE-2023-5622

In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Rated cri

NNM failed to properly set ACLs on its installation directory, which could allow a low privileged user to run arbitrary

A vulnerability in Nessus Network Monitor versions 5.11.0, 5.11.1, and 5.12.0 for Windows could allow an authenticated l

Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases

The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain.

Under certain conditions, Nessus Network Monitor was found to not properly enforce input validation. Rated high severity

The X.509 GeneralName type is a generic type for representing different types of names. Rated medium severity (CVSS 5.9)

An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. Rated med

The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer

A stored cross site scripting vulnerability exists in Nessus Network Monitor where an authenticated, privileged local at

In Tenable Network Monitor versions prior to 6.5.1 on a Windows host, it was found that a non-administrative user could

When installing Tenable Network Monitor to a non-default location on a Windows host, Tenable Network Monitor versions pr