CVE-2018-1155: In SecurityCenter versions prior to 5.7.0, a cross-site scripting (XSS) issue could allow an authenticated...

Security readout for executives and security teams

CVE-2018-1155 is an authenticated cross-site scripting flaw in Tenable SecurityCenter before 5.7.0. A logged-in attacker could place JavaScript in an image filename used by Reports. The cited fix is updated input validation in SecurityCenter 5.7.0. No source in the bundle reports active exploitation. Exposure is limited to organizations running Tenable SecurityCenter earlier than 5.7.0, especially where many users can access report functionality. Internet exposure is not established by the sources; this is primarily an authenticated application risk. Treat this as a normal-priority remediation for affected SecurityCenter deployments. It is not supported as actively exploited, but it affects a security management platform and can enable script execution in authenticated user sessions. Mitigation focus: Upgrade Tenable SecurityCenter to version 5.7.0 or later.; Review Tenable advisory TNS-2018-11 for vendor-specific upgrade guidance.; Limit Reports feature access to trusted users until upgraded..

Prepared

Jun 7, 2026, 05:54 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.