CVE-2020-3936

The CVE-2020-3936 issue concerns the UltraLog Express device management interface from Unisoon. Affected component: the device management interface that fails to properly filter user-inputted strings in specific parameters, enabling SQL injection. Root cause: lack of input validation/filtering le...

CVE-2020-3921 Unisoon UltraLog Express - Sensitive Data Exposure

UltraLog Express device management software stores user’s information in cleartext. Any user can obtain accounts information through a specific page...

CVE-2020-3920

CVE-2020-3920 affects the UltraLog Express device management interface (Unisoon) where access authentication is not properly enforced on certain pages/functions, enabling any user to reach a privileged page for managing accounts via a system directory. Multiple sources (NVD, CNVD, CVE records, an...

CVE-2020-3920 Unisoon UltraLog Express - Broken Authentication

UltraLog Express device management interface does not properly perform access authentication in some specific pages/functions. Any user can access the privileged page to manage accounts through specific system directory...

PT-2020-17796 · Ultralog · Ultralog Express

Name of the Vulnerable Software and Affected Versions: UltraLog Express affected versions not specified Description: The UltraLog Express device management interface has an issue with access authentication on certain pages or functions. This allows any user to access a privileged page for managin...

PT-2020-17797 · Ultralog · Ultralog Express

Name of the Vulnerable Software and Affected Versions: UltraLog Express device management software affected versions not specified Description: The issue concerns the storage of user information in cleartext by the UltraLog Express device management software. This allows any user to obtain accoun...

CVE-2020-3921: Cleartext Storage of Sensitive Information

UltraLog Express device management software stores user’s information in cleartext. Any user can obtain accounts information through a specific page...

CVE-2020-3920: Missing Authentication for Critical Function

UltraLog Express device management interface does not properly perform access authentication in some specific pages/functions. Any user can access the privileged page to manage accounts through specific system directory...

PT-2020-17812 · Unknown · Ultralog Express

Name of the Vulnerable Software and Affected Versions: UltraLog Express affected versions not specified Description: The issue concerns the UltraLog Express device management interface, which fails to properly filter user-inputted strings in specific parameters. This allows attackers to inject...

CVE-2020-3936: Improper Neutralization of Special Elements used in an SQL Command

UltraLog Express device management interface does not properly filter user inputted string in some specific parameters, attackers can inject arbitrary SQL command...

The vulnerability in the web interface of the Cisco Unified Contact Center Express software allows a malicious individual to elevate their privileges to the root level.

The vulnerability of the Cisco Unified Contact Center Express automation software lies in the insufficient restrictions on the content uploaded to the vulnerable system. Exploiting this vulnerability can allow a malicious actor to elevate their privileges to the root level...

DEBIAN-CVE-2019-15034

hw/display/bochs-display.c in QEMU 4.0.0 does not ensure a sufficient PCI config space allocation, leading to a buffer overflow involving the PCIe extended config space...

UBUNTU-CVE-2019-15034

hw/display/bochs-display.c in QEMU 4.0.0 does not ensure a sufficient PCI config space allocation, leading to a buffer overflow involving the PCIe extended config space...

Cross-site Scripting (XSS)

express-sanitize-escape is vulnerable to cross-site scripting XSS. The vulnerability exists as it doesn't sanitize the 'req.query' and 'req.body' since the 'req.param' has not been populated at the time that middleware is called allowing an attacker to inject arbitrary Javascript to cause a...

Security Bulletin: IBM Security SiteProtector System is affected by Apache HTTP Server vulnerabilities

Summary IBM Security SiteProtector System has addressed the following vulnerabilities in Apache HTTP Server. Vulnerability Details CVEID: CVE-2019-10092 DESCRIPTION: In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the modproxy error page. An attacke...

Security Bulletin: IBM Security SiteProtector System is affected by Apache HTTP Server vulnerabilities

Summary IBM Security SiteProtector System has addressed the following vulnerabilities in Apache HTTP Server. Vulnerability Details CVEID: CVE-2018-20843 DESCRIPTION: libexpat is vulnerable to a denial of service, caused by an error in the XML parser. By persuading a victim to open a...

Stored Cross-Site Scripting Vulnerability in Ant Express Display-based System

Ant Express Station is the sincere work of MaiMaiRui Network Technology Co., Ltd. based on the latest international SaaS Software as a Service model, the company's products are based on the concept of professional Saas services, is committed to providing customers with a professional one-stop...

Node.js third-party modules: [express-cart] Wide CSRF in application

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! I would like to report CSRF in...

Cisco Unified Contact Center Express Command Execution Vulnerability

Cisco Unified Contact Center Express Unified CCX is a customer relationship management component of a unified communications solution from Cisco. The component supports features such as self-service voice, call distribution, and customer access control. A code issue vulnerability exists in Cisco...

Cisco Releases Security Updates

Cisco has released security updates to address vulnerabilities affecting multiple products. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. For updates addressing lower severity vulnerabilities, see the Cisco Security Advisories page. The...