Tenable SecurityCenter vulnerabilities

In SecurityCenter versions prior to 5.7.0, a cross-site scripting (XSS) issue allows an authenticated attacker to inject JavaScript code into an image filename parameter within the Reports feature area.

In SecurityCenter versions prior to 5.7.0, a username enumeration issue allows an unauthenticated attacker to automate discovery of username aliases via brute force, potentially facilitating unauthorized access.

A cross-site scripting (XSS) vulnerability in devform.php in Tenable SecurityCenter 4.6 through 4.7 allows remote attackers to inject arbitrary web script or HTML via the message parameter.