CVE-2016-1000028

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

Tenable Nessus before 6.8 has a stored XSS issue that requires admin-level authentication to the Nessus UI, and would only potentially impact other admins. (Tenable ID 5198).

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/92134Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1036414Third Party Advisory, VDB Entry
https://www.tenable.com/security/tns-2016-11Vendor Advisory
http://www.securityfocus.com/bid/92134Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1036414Third Party Advisory, VDB Entry
https://www.tenable.com/security/tns-2016-11Vendor Advisory

Timeline

Published: Dec 27, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-10000294.8Tenable Nessus before 6.8 has a stored XSS issue that requires admin-level authentication to the Nessus UI, and would potentially impact oth CVE-2016-10000309.8Pidgin version <2.11.0 contains a vulnerability in X.509 Certificates imports specifically due to improper check of return values from gnutl CVE-2016-10000319.8Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution CVE-2016-10000327.5TGCaptcha2 version 0.3.0 is vulnerable to a replay attack due to a missing nonce allowing attackers to use a single solved CAPTCHA multiple CVE-2016-10000333.7Shotwell version 0.22.0 (and possibly other versions) is vulnerable to a TLS/SSL certification validation flaw resulting in a potential for CVE-2016-10000376.1Pagure: XSS possible in file attachment endpoint CVE-2016-10001048.8A security Bypass vulnerability exists in the FcgidPassHeader Proxy in mod_fcgid through 2016-07-07.CVE-2016-10001076.1inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of u CVE-2016-10001086.1yaws before 2.0.4 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications fr CVE-2016-10001095.3HHVM does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presen CVE-2016-10001106.1The CGIHandler class in Python before 2.7.12 does not protect against the HTTP_PROXY variable name clash in a CGI script, which could allow CVE-2016-10001115.3Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI application