PT-2020-13561

Name of the Vulnerable Software and Affected Versions NCH Express Accounts versions 8.24 and earlier Description The issue allows an authenticated low-privilege user to access higher-privileged functionalities, such as Add/Edit users, by entering a crafted URL. Recommendations For versions 8.24 a...

NCH Express Accounts Security Vulnerability

NCH Express Accounts Accounting is a business accounting software. The software includes features such as financial income and expense management, financial analysis and reporting. A security vulnerability exists in NCH Express Accounts version 8.24 and prior versions that allows local users to...

PT-2020-13563

Name of the Vulnerable Software and Affected Versions NCH Express Invoice versions 8.06 through 8.24 Description The issue concerns a Reflected XSS vulnerability in the Quotes List module. Recommendations For versions 8.06 through 8.24, update to a version that fixes the Reflected XSS issue in th...

NCH Express Accounts Security Vulnerability

NCH Express Accounts Accounting is a business accounting software. The software includes features such as financial income and expense management, financial analysis and reporting. A security vulnerability exists in NCH Express Accounts version 8.24, which originates when an authenticated,...

NCH Express Invoice 跨站脚本漏洞

NCH Express Invoice is invoice software that allows you to create print-ready invoices that can be emailed or faxed to your customers for faster payment. A reflected cross-site scripting vulnerability exists in the Quotes List module in NCH Express Invoice 8.06-8.24. No detailed vulnerability...

CVE-2020-13476: Improper Neutralization of Input During Web Page Generation

NCH Express Invoice 8.06 to 8.24 is vulnerable to Reflected XSS in the Quotes List module...

CVE-2020-13474: Direct Request

In NCH Express Accounts 8.24 and earlier, an authenticated low-privilege user can enter a crafted URL to access higher-privileged functionalities such as Add/Edit users...

PT-2020-13560

Name of the Vulnerable Software and Affected Versions NCH Express Accounts versions 8.24 and earlier Description The issue allows local users to discover the cleartext password by reading the configuration file. Recommendations For versions 8.24 and earlier, consider restricting access to the...

CVE-2020-13473: Cleartext Storage of Sensitive Information

NCH Express Accounts 8.24 and earlier allows local users to discover the cleartext password by reading the configuration file...

CVE-2020-5684: Improper Certificate Validation

iSM client versions from V5.1 prior to V12.1 running on NEC Storage Manager or NEC Storage Manager Express does not verify a server certificate properly, which allows a man-in-the-middle attacker to eavesdrop on an encrypted communication or alter the communication via a crafted certificate...

JVN#10100024: Management software for NEC Storage disk array system vulnerable to improper server certificate verification

Management software for NEC Storage disk array system provided by NEC Corporation is vulnerable to improper server certificate verification CWE-295. Impact A man-in-the-middle attack may allow an attacker to eavesdrop on an encrypted communication or alter the communication. Solution Update the...

CVE-2020-29579

The official Express Gateway Docker images before 1.14.0 contain a blank password for a root user. Systems using the Express Gateway Docker container deployed by affected versions of the Docker image may allow an remote attacker to achieve root access...

CVE-2020-29579

The official Express Gateway Docker images before 1.14.0 contain a blank password for a root user. Systems using the Express Gateway Docker container deployed by affected versions of the Docker image may allow an remote attacker to achieve root access...

Default credentials

The official Express Gateway Docker images before 1.14.0 contain a blank password for a root user. Systems using the Express Gateway Docker container deployed by affected versions of the Docker image may allow an remote attacker to achieve root access...

CVE-2020-29579

The CVE-2020-29579 entry concerns the Express Gateway Docker images. Affected software: Express Gateway Docker images prior to version 1.14.0. Root cause/impact: a blank password for the root user in these images may allow a remote attacker to obtain root access. Exploit details are not provided ...

CVE-2020-29579

The official Express Gateway Docker images before 1.14.0 contain a blank password for a root user. Systems using the Express Gateway Docker container deployed by affected versions of the Docker image may allow an remote attacker to achieve root access...

CVE-2020-29579: Undefined Security Weakness

The official Express Gateway Docker images before 1.14.0 contain a blank password for a root user. Systems using the Express Gateway Docker container deployed by affected versions of the Docker image may allow an remote attacker to achieve root access...

Docker Images Express Gateway Security Vulnerability

Docker is an open source application container engine from the American company Docker. The product supports creating a container lightweight virtual machine and deploying and running applications on Linux systems, as well as automating the installation, deployment, and upgrading of applications...

PT-2020-17202

Name of the Vulnerable Software and Affected Versions Express Gateway versions prior to 1.14.0 Description The official Express Gateway Docker images contain a blank password for a root user, which may allow a remote attacker to achieve root access. This issue affects systems using the Express...

DEBIAN-CVE-2020-28361

Kamailio before 5.4.0, as used in Sip Express Router SER in Sippy Softswitch 4.5 through 5.2 and other products, allows a bypass of a header-removal protection mechanism via whitespace characters. This occurs in the removehf function in the Kamailio textops module. Particular use of removehf in...