Vulnerability Reporting Guidelines

Thank you for working with Tenable to help ensure we can provide a timely response to security issues with our products. Tenable supports responsible disclosure of security vulnerabilities, and we are committed to working with researchers to fully understand and resolve them.

To help ensure that we have enough information to properly evaluate a potential issue, Tenable asks that you include the following information in your report:

• A description of the issue explaining the vulnerability, including the impact to the user(s) or system. This should clearly describe how the issue crosses privilege boundaries.
• The affected product or resource (e.g., Tenable Vulnerability Management, Tenable Nessus, Tenable Security Center, Tenable Log Correlation Engine, Tenable Nessus Network Monitor, Tenable web site), the software version, and the platform you are using (e.g., Windows 10, Debian Linux).
• A proof-of-concept or functional exploit that demonstrates the issue. If a proof-of-concept is not available, please include any relevant logs generated from your testing.
• Any caveats or conditions required to exploit the issue. Indicate if there are any non-default system settings, custom configurations, required user interaction, or anything else that would limit the attack.
• Any vulnerability database identifier you have requested. If you have not requested a CVE identifier, indicate if you would like us to request one.

Please note, potential vulnerabilities that do not by themselves expose a service or application to attack, are not considered valid issues. For example, injecting or the lack of an HTML tag does not necessarily mean an application is vulnerable to cross-site scripting, and injecting a single backtick (`) does not necessarily mean it is vulnerable to SQL injection.

Once we receive your report, Tenable will stay in touch with you to provide updates on our investigation and status of a fix for verified issues. During this time we might also request additional information. If the issue you reported is determined to be valid and affects one of our products, an advisory will be published when a solution is available for our customers.

Please indicate if and how you would like to be credited in the advisory (name, company or affiliation, etc). Tenable does not participate in a public bug bounty program or provide financial awards for finding issues.

<p>Tenable encourages the use of encrypted mail. Our PGP public key can be found below:</p> <div class="multi-accordion accordion"> <h3><a href="#">PGP Public Key</a></h3> <div id="pgp-key" class="hidden"> <div> <pre><code> -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFlnznIBEAC/ap8qpib9Hmm8K2WSKlDTdF3AMtMwrWT+I55VW/Cpikmyv/fr xhSzKVMcw+mfplz+Dk9Sco4SDpj79qNO4UuV6u3aA5WC78aiep5gg8AhVYPfH0Fk FOP19ds4ti3jaATtacgq4quZmakKBGdm0Kzgtri67If40UsF0hN/euUTt3khjO/n RdzcAL4bJynsP3SyHaddTRQfdH4pO86sqXNx6xXBlDGFUD1RNDy9VTdgkal3SU/3 sJN/5vHcpc3Kk5WEUoCwlyb4CAl/D3qOU9FjkkZTKVZxuUHizO2AXlKi05AMvv21 /4tVGxh4WecoA89lke/s8r0GMDrm4DMLusdueBIW9Csl9eZXLEuxZRT3HSErKMQ7 cpQan9srvF/JgCCBfZ0UbP++MQZwqcs5p0oL9Mv72Lf4zmuSzy4i63l87bbZGyBX Pd3Sfzn/cJTLPrlAf7jGUo8FZHOzz5AMlc+Yuwlm28X+/tDjQMwMtsaviAi92D0z nUDYHKyOl5lgWWavTUBpxxYoJxRWn1HnSManocbOEdBjz0cnt7hvPPpx3O0tSAde p8QogSJO14K36nCIJb/TjNQ/e/L0JQwd17XRKbmMs0wZ5tEG1XelI4wJ2+fWqF1B huRwwgDVbKah9AH+OMxJwgXwqh96e3ftOnEvpl5hEdiyF6nUam51IXVpbwARAQAB tDBUZW5hYmxlIE5ldHdvcmsgU2VjdXJ0eSA8dnVsbnJlcG9ydEB0ZW5hYmxlLmNv bT6JAj8EEwEIACkFAllnznICGwMFCQeGH4AHCwkIBwMCAQYVCAIJCgsEFgIDAQIe AQIXgAAKCRBQiymuY76m5eqcD/9aJJKu7bbV432XzZQm47RvaMTV2bhpLi/lttH7 85+KirQAW6vGkP0SzFbEaYaiaaW64XtJOHW7ZZjxwkZ+hr6ZK6/5PkCZTrFyEM00 Nz+euqnhM9xNQG+tF02CuCW/8liFxBVKXm/TkFtvno6zdRq+ybeDo/ooUY7SrYjG /okzt12/iZdsqASTPkn8xlsZRCFVt+W7oxOvber7oiXZAmDRU6Pzywk6r8TS8Dse Y92M9f2kdtD5kBTq5rc5Y6O+LvYHcfmyoM3BfHngXQVq7KOw7yCN9eHFEAguxyG6 ox+G3N+UdGmHVgHsa8+wC9XCxtMUm+qNitmtrlCrN+to9qXE29Zp0YUlGZRrogzx UnLCFUNMOJiCc5MstA8H2qR/xa4F1Wqe5JQmHMi0oD9vzjnn2uJoMY4tpV77UA5y YDMp6KeByiX1U4pDJaZs5AfcFIAA6Rl6siRYeTWoTwbtouFmxtAmDNEpfO/OZ68B whgKgsmgZtm36YMO9Vay2MsrEC8BK2clJGx8R8NCjZD1tHuypDwyGIGI5/owPQ3E o63wy1QawOR1yJQz3cTkBYNmO3jzzg0F1afcgqbUscjckCLxpSLjfH4ApPO4IoHc B099Ne2nyz/YmF0uXC0ePXtQ6u7TX+UQwfi/9t6aGHulA/XS7cIJhLZwJFIugcbP 2qZI6LQxVGVuYWJsZSBOZXR3b3JrIFNlY3VyaXR5IDx2dWxucmVwb3J0QHRlbmFi bGUuY29tPokCPwQTAQgAKQUCWWfSaAIbAwUJB4YfgAcLCQgHAwIBBhUIAgkKCwQW AgMBAh4BAheAAAoJEFCLKa5jvqblF88QAJK0GYrQnVdPYfb/szV/NootxD5YCwL0 FOOX2ga52RkxChMRfo3FkcaAWTpsU//Ug+RRwX/ZfOFqURdr0hMwr5985BSzCT5X 8d9iHMnJARQFCSJ7jHZfBcLn8Fmtej/Xw2+Q+0s+QFKjq0WsGia2TCFmNSsDjosG xXaCP6rLVHt68pGfsRStgBAlT1t1jJkO9rzMLk+q3b4TeeRurmYLwmVRAn5Mh1Mh tQoay3OBrMyat4PKV7D+G/7WonLS+9ItAYp0WTqcPCEImf43tfIUv7/LAdIcpAjs g7LkaweLk0DC8oxsGoF7FyfE9TE14mjk3onIcR0YRhpDHlL9PWWG/2LEvaYgZ7Xe /GdI8irE2tF2j4Ff+eWX1w/2Q55RVUGC/gej56KmaFKMjVsb0wZUNfYETtgYuuhA p4UaoOeqhB26rmB5TeGwuJXMz2PBMiThV161DPp/FuhVV3vCY5k3pxMrlrTGjBbT lL9h0JUzlyflyZEkxb63BnNlHaDXYn+4ExS27wKYvA9umnnLqtlqPw0Uie2NM0f4 iaTCIDRTyurvGVjrWGFPdBxIrznUICOZxMatjYaRCx15XoF1bmjDvursLl7lTUl3 46deB+64j+M1ILDcZEXUgLbTf1veOBgCJYFLTuKXj7KpJ2vwgVhAvS/KBJKK9W6l azqoOGkZKzo1uQINBFlnznIBEADbq6EHwPa8aUgrl+zCUANmjwDXj9emdtB9AG3g bDgR0hNSTkjBNs8liuooxeMZQcKFfsfX7nSYrGTuYKm28zI2MnEb0Q7v9wyYxpo/ nVSgaakdj3kpjEpVDePNF9y5v6BQ3E/J5Wdor/PJy0fPARzea2T+RDSnrHpKWgjB 8Q7SWAVroLMNhcOGbRbwTc87+fyLDYtpWngF+/hgTGFU4p1499w7d7CQYQqvKdPx MMeDSR9mWtmFg1y2HVSVD7RGRbqBRHBASkf5lMgvCjwG+vc58R7cv4Ipf3LfogVb 4YxEeklBEF/d9Qq5U0yN/NoE4Vu7l3ZeZYvL5+4isxOTmtyTuYiK74ShJczo8HvJ 7jDJPAdBdVwqhNb0HwQWxTsVVPsXs97By6DKuI1znpzFviDm3+UdltmravY8meHB yQtVgY8iXH5o5YDBgOQwHdUn2FURBapnMnAzpA8YkdqOh71uWYuTAFYVvyc2sjFC CmDgnWPiUauMogRxLf4HwknlKhN+JLQtjB27LstosYEOdUtbJps+zgIUbHePlg+p +1mZYqsiyfOXZQvINC5rMFHt53Yd391NNEBF8nVNLyVYRtZIZHs8M9B1cC20hIzu 6rJruhvmOQKVrLDb0H/jRCqCjGcL2kBXpRwXVpss3xhNituvGXALlVsxr73070XQ w2dJxQARAQABiQIlBBgBCAAPBQJZZ85yAhsMBQkHhh+AAAoJEFCLKa5jvqblr8sP +wWAHzBwCVKSRPi08i18nHFT5ywCuA5VBPJlRk+sOV3ZjMg1E1TQYoLOQYU02pae K+7jW07uccd6K5hjV0ZQebCZa4suMtvI+XP6FQtELFfwh90zrpurdlC6o8s9km80 RZrz1NJnLSn0W0Uwm+nj6LhWKvs8icAeAtb/4BS/Pc+CdxyGPuyqF3YekS4h2TQC OdXyce7Do4KZS5OorufeJ6U1NlvEGiZrsXUvB9abYCn00enkopKOdVXfR0TW9R3t 5OE8IAXcONUOAYFYcv8cDCk7Q0BA+/E0ru64Z33rl3rSmrJ6j3r63kD0YnT2nhQB X9x6Bx1A4frEoVoi7YGh1OzQUaYNUJn1mNpqn8XnuPqgZkc9FpMwFTI22RtB/tPy mDwRaT/kJV88lAsxqlqg4R8KeNvwWnk5qf3ch9PofLXij1AAyRzI1pc5H6SSDccF 0jykjBA5EIfDnpACytH11RDS8zTmVVZVN5diC9lQ+AWVK2+wt2H9Snhlxnr7+yJI ObPyMWsuiypehWWjk7fyZWXpCGUnAre9eXWHJzqmueLYhRnJDvlqAjXUePZY9Cmj xhGnDebpUWBnItcLQ2vejokoZiJNkLlcg6dtZ5QcPnmAZBRPfFAYF/OjTOcxvso3 F25h6fDip6iBvUcrp6tj/99biPNsBCbkNQgNN72OXLry =GwC5 -----END PGP PUBLIC KEY BLOCK----- </pre></code> </div> </div> <p class="mt2"><strong>Contact us:</strong> Email <a href="mailto:vulnreport@tenable.com">vulnreport@tenable.com</a>.</p> </div> ## Have a Vulnerability to Report?

Please read the vulnerability reporting guidelines before submission. Email [email protected].

Contact Us #### Tenable Hall of Fame

View Now