CVE-2016-9260

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Cross-site scripting (XSS) vulnerability in Tenable Nessus before 6.9 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to handling of .nessus files.

Metrics

CVSS 3.0 5.4/10CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://jvn.jp/en/jp/JVN12796388/index.htmlThird Party Advisory, VDB Entry
http://jvndb.jvn.jp/en/contents/2017/JVNDB-2017-000013.htmlThird Party Advisory, VDB Entry
http://www.securityfocus.com/bid/95772Third Party Advisory, VDB Entry
https://www.tenable.com/security/tns-2016-16Vendor Advisory
http://jvn.jp/en/jp/JVN12796388/index.htmlThird Party Advisory, VDB Entry
http://jvndb.jvn.jp/en/contents/2017/JVNDB-2017-000013.htmlThird Party Advisory, VDB Entry
http://www.securityfocus.com/bid/95772Third Party Advisory, VDB Entry
https://www.tenable.com/security/tns-2016-16Vendor Advisory

Timeline

Published: Jan 31, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-92615.4Cross-site scripting (XSS) vulnerability in Tenable Log Correlation Engine (aka LCE) before 4.8.1 allows remote authenticated users to injec CVE-2016-92625.5Multiple integer overflows in the (1) jas_realloc function in base/jas_malloc.c and (2) mem_resize function in base/jas_stream.c in JasPer b CVE-2016-92634.7WordPress through 4.8.2, when domain-based flashmediaelement.swf sandboxing is not used, allows remote attackers to conduct cross-domain Fla CVE-2016-92645.5Buffer overflow in the printMP3Headers function in listmp3.c in Libming 0.4.7 allows remote attackers to cause a denial of service (out-of-b CVE-2016-92655.5The printMP3Headers function in listmp3.c in Libming 0.4.7 allows remote attackers to cause a denial of service (divide-by-zero error and ap CVE-2016-92666.5listmp3.c in libming 0.4.7 allows remote attackers to unspecified impact via a crafted mp3 file, which triggers an invalid left shift.CVE-2016-92687.2Unrestricted file upload vulnerability in the Blog appearance in the "Install or upgrade manually" module in Dotclear through 2.10.4 allows CVE-2016-92699.9Remote Command Execution in com.trend.iwss.gui.servlet.ManagePatches in Trend Micro Interscan Web Security Virtual Appliance (IWSVA) version CVE-2016-92715.4Cloudera Manager 5.7.x before 5.7.6, 5.8.x before 5.8.4, and 5.9.x before 5.9.1 allows XSS in the help search feature.CVE-2016-92729.1A Blind SQL Injection Vulnerability in Exponent CMS through 2.4.0, with the rerank array parameter, can lead to site database information di CVE-2016-92735.5tiffsplit in libtiff 4.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file, related to changing CVE-2016-92747.8Untrusted search path vulnerability in Git 1.x for Windows allows local users to gain privileges via a Trojan horse git.exe file in the curr