According to its self-reported version, the Tenable Security Center running on the remote host is prior to 6.6.0 and missing relevant patches. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2025-09 advisory.

  - In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can cause memory to be written     beyond the end of a malloc-allocated buffer. If the separator argument is attacker-controlled and has a     large string (e.g., 2MB or more), an integer overflow occurs in calculating the size of the result buffer,     and thus malloc may not allocate enough memory. (CVE-2025-29087)

  - Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are     vulnerable to Regular Expression Denial of Service (ReDoS) via the trim() function. (CVE-2022-25927)

  - An integer overflow can be triggered in SQLite's `concat_ws()` function. The resulting, truncated integer     is then used to allocate a buffer. When SQLite then writes the resulting string to the buffer, it uses the     original, untruncated size and thus a wild Heap Buffer overflow of size ~4GB can be triggered. This can     result in arbitrary code execution. (CVE-2025-3277)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Tenable Security Center Multiple Vulnerabilities (TNS-2025-09)

medium Nessus Plugin ID 237580

Version 1.2

Version 1.1

Version 1.2 Jul 15, 2025, 2:39 AM Detection (Add check for patches. Flag 6.5.0 as vulnerable) Plugin Feed: 202507150239
Version 1.1 May 30, 2025, 3:10 PM New Plugin Feed: 202505301510