CVE-2024-1891

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A stored cross site scripting vulnerability exists in Tenable Security Center where an authenticated, remote attacker could inject HTML code into a web application scan result page.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Tenable	Security Center	< 6.4.0
tenable	security_center	< 6.4.0

References

https://www.tenable.com/security/tns-2024-10Vendor Advisory
https://www.tenable.com/security/tns-2024-10Vendor Advisory

Timeline

Published: Jun 12, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-18926.5A Regular Expression Denial of Service (ReDoS) vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in CVE-2024-18938.8The Easy Property Listings plugin for WordPress is vulnerable to time-based SQL Injection via the ‘property_status’ shortcode attribute in a CVE-2024-18945.4The Burst Statistics – Privacy-Friendly Analytics for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'b CVE-2024-18957.5The Event Monster – Event Management, Tickets Booking, Upcoming Event plugin for WordPress is vulnerable to PHP Object Injection in all vers CVE-2024-18967.5The Photo Gallery – Responsive Photo Gallery, Image Gallery, Portfolio Gallery, Logo Gallery And Team Gallery plugin for WordPress is vulner CVE-2024-18977.5The Grid Gallery – Photo Image Grid Gallery plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including,CVE-2024-18984.3Improper access control in the notification feature in Devolutions Server 2023.3.14.0 and earlier allows a low privileged user to change not CVE-2024-18995.3An issue in the anchors subparser of Showdownjs versions <= 2.1.0 could allow a remote attacker to cause denial of service conditions.CVE-2024-19005.5Improper session management in the identity provider authentication flow in Devolutions Server 2023.3.14.0 and earlier allows an authenticat CVE-2024-19014.3Denial of service in PAM password rotation during the check-in process in Devolutions Server 2023.3.14.0 allows an authenticated user with s CVE-2024-19027.5lunary-ai/lunary is vulnerable to a session reuse attack, allowing a removed user to change the organization name without proper authorizati CVE-2024-19044.3The MasterStudy LMS plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the search_posts