PT-2020-19656 · Npm · Express-Mock-Middleware

Name of the Vulnerable Software and Affected Versions: express-mock-middleware versions 0.0.0 through 0.0.6 Description: The issue allows exported functions by the package to be tricked into adding or modifying properties of the Object.prototype, which can be exploited by creating a new directory...

CVE-2020-11560

CVE-2020-11560 affects NCH Express Invoice 7.25. Local users can read the application’s configuration file to obtain cleartext passwords, enabling potential account takeover. Root cause: credentials stored in plaintext in the configuration/files under the Express Invoice data path. Exploitation d...

PT-2020-12693 · Nch · Express Invoice

Name of the Vulnerable Software and Affected Versions: NCH Express Invoice version 7.25 Description: The issue allows local users to discover the cleartext password by reading the configuration file. Recommendations: For version 7.25, consider restricting access to the configuration file to...

CVE-2020-11560

NCH Express Invoice 7.25 allows local users to discover the cleartext password by reading the configuration file...

Prototype Pollution

Overview express-mock-middleware is an A simple mock middleware for express. Affected versions of this package are vulnerable to Prototype Pollution. Exported functions by the package can be tricked into adding or modifying properties of the Object.prototype. Exploitation of this vulnerability...

Unisoon UltraLog Express SQL Injection Vulnerability

Unisoon UltraLog Express is a telephone recording system from Unisoon, Taiwan, China. A SQL injection vulnerability exists in the administration interface in Unisoon UltraLog Express. The vulnerability stems from the lack of validation of externally entered SQL statements in database-based...

Unisoon UltraLog Express Authentication Vulnerability

Unisoon UltraLog Express is a telephone recording system from Unisoon, Taiwan, China. A security vulnerability exists in the administration interface of Unisoon UltraLog Express, which originates from the program not properly authenticating access to some pages/functions. An attacker could exploi...

Unisoon UltraLog Express Sensitive Data Disclosure Vulnerability

Unisoon UltraLog Express is a telephone recording system from Unisoon, Taiwan, China. A security vulnerability exists in Unisoon UltraLog Express, which is caused by the management software storing user information in plaintext. The vulnerability can be exploited by an attacker to gain access to...

CVE-2020-3920

UltraLog Express device management interface does not properly perform access authentication in some specific pages/functions. Any user can access the privileged page to manage accounts through specific system directory...

CVE-2020-3921

UltraLog Express device management software stores user’s information in cleartext. Any user can obtain accounts information through a specific page...

CVE-2020-3936

UltraLog Express device management interface does not properly filter user inputted string in some specific parameters, attackers can inject arbitrary SQL command...

CVE-2020-3921

UltraLog Express device management software stores user’s information in cleartext. Any user can obtain accounts information through a specific page...

CVE-2020-3936

UltraLog Express device management interface does not properly filter user inputted string in some specific parameters, attackers can inject arbitrary SQL command...

CVE-2020-3920

UltraLog Express device management interface does not properly perform access authentication in some specific pages/functions. Any user can access the privileged page to manage accounts through specific system directory...

Information disclosure

UltraLog Express device management software stores user’s information in cleartext. Any user can obtain accounts information through a specific page...

Directory traversal

UltraLog Express device management interface does not properly perform access authentication in some specific pages/functions. Any user can access the privileged page to manage accounts through specific system directory...

CVE-2020-3921 Unisoon UltraLog Express - Sensitive Data Exposure

UltraLog Express device management software stores user’s information in cleartext. Any user can obtain accounts information through a specific page...

CVE-2020-3936 Unisoon UltraLog Express - SQL Injection

UltraLog Express device management interface does not properly filter user inputted string in some specific parameters, attackers can inject arbitrary SQL command...

CVE-2020-3921

The CVE-2020-3921 entry concerns Unisoon UltraLog Express device management software that stores user information in cleartext, enabling access to account data via a specific page. Multiple connected sources corroborate: the vulnerability is a data disclosure due to plaintext storage in the Ultra...

CVE-2020-3936 Unisoon UltraLog Express - SQL Injection

UltraLog Express device management interface does not properly filter user inputted string in some specific parameters, attackers can inject arbitrary SQL command...