CVE-2021-20106

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Nessus Agent versions 8.2.5 and earlier were found to contain a privilege escalation vulnerability which could allow a Nessus administrator user to upload a specially crafted file that could lead to gaining administrator privileges on the Nessus host.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	Nessus Agent	Nessus Agent 8.2.5 and earlier

References

https://www.tenable.com/security/tns-2021-13Vendor Advisory
https://www.tenable.com/security/tns-2021-13Vendor Advisory

Timeline

Published: Jul 21, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-201075.4There exists an unauthenticated BLE Interface in Sloan SmartFaucets including Optima EAF, Optima ETF/EBF, BASYS EFX, and Flushometers includ CVE-2021-201087.5Manage Engine Asset Explorer Agent 1.0.34 listens on port 9000 for incoming commands over HTTPS from Manage Engine Server. The HTTPS certifi CVE-2021-201097.5Due to the Asset Explorer agent not validating HTTPS certificates, an attacker on the network can statically configure their IP address to m CVE-2021-20115.9Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.7.32 and prior and CVE-2021-201109.8Due to Manage Engine Asset Explorer Agent 1.0.34 not validating HTTPS certificates, an attacker on the network can statically configure thei CVE-2021-201115.4A stored cross-site scripting vulnerability exists in TCExam <= 14.8.1. Valid files uploaded via tce_filemanager.php with a filename beggini CVE-2021-201125.4A stored cross-site scripting vulnerability exists in TCExam <= 14.8.1. Valid files uploaded via tce_select_mediafile.php with a filename be CVE-2021-201135.3An exposure of sensitive information vulnerability exists in TCExam <= 14.8.1. If a password reset request was made for an email address tha CVE-2021-201147.5When installed following the default/recommended settings, TCExam <= 14.8.1 allowed unauthenticated users to access the /cache/backup/ direc CVE-2021-201156.1A reflected cross-site scripting vulnerability exists in TCExam <= 14.8.3. The paths provided in the f, d, and dir parameters in tce_fileman CVE-2021-201166.1A reflected cross-site scripting vulnerability exists in TCExam <= 14.8.4. The paths provided in the f, d, and dir parameters in tce_select_CVE-2021-201176.7Nessus Agent 8.3.0 and earlier was found to contain a local privilege escalation vulnerability which could allow an authenticated, local adm