CVE-2020-17494

Untangle Firewall NG before 16.0 uses MD5 for passwords...

CVE-2020-17494

Untangle Firewall NG before 16.0 uses MD5 for passwords...

Design/Logic Flaw

Untangle Firewall NG before 16.0 uses MD5 for passwords...

CVE-2020-17494

Affected product: Untangle Firewall NG. Vulnerability: use of MD5 for passwords in versions before 16.0 (root cause: weak password hashing). Impact: knowledge of weak password storage; explicit exploitation details are not provided in the sources. Remediation: upgrade to version 16.0 or later (pe...

CVE-2020-17494

Untangle Firewall NG before 16.0 uses MD5 for passwords...

CVE-2019-18646

The Untangle NG firewall 14.2.0 is vulnerable to authenticated inline-query SQL injection within the timeDataDynamicColumn parameter when logged in as an admin user...

CVE-2019-18648

When logged in as an admin user, the Untangle NG firewall 14.2.0 is vulnerable to reflected XSS at multiple places and specific user input fields...

CVE-2019-18649

When logged in as an admin user, the Title input field under Reports within Untangle NG firewall 14.2.0 is vulnerable to stored XSS...

CVE-2019-18649

When logged in as an admin user, the Title input field under Reports within Untangle NG firewall 14.2.0 is vulnerable to stored XSS...

CVE-2019-18647

The Untangle NG firewall 14.2.0 is vulnerable to an authenticated command injection when logged in as an admin user...

CVE-2019-18646

The Untangle NG firewall 14.2.0 is vulnerable to authenticated inline-query SQL injection within the timeDataDynamicColumn parameter when logged in as an admin user...

CVE-2019-18647

The Untangle NG firewall 14.2.0 is vulnerable to an authenticated command injection when logged in as an admin user...

CVE-2019-18648

When logged in as an admin user, the Untangle NG firewall 14.2.0 is vulnerable to reflected XSS at multiple places and specific user input fields...

Sql injection

The Untangle NG firewall 14.2.0 is vulnerable to authenticated inline-query SQL injection within the timeDataDynamicColumn parameter when logged in as an admin user...

Command injection

The Untangle NG firewall 14.2.0 is vulnerable to an authenticated command injection when logged in as an admin user...

Cross site scripting

When logged in as an admin user, the Title input field under Reports within Untangle NG firewall 14.2.0 is vulnerable to stored XSS...

Cross site scripting

When logged in as an admin user, the Untangle NG firewall 14.2.0 is vulnerable to reflected XSS at multiple places and specific user input fields...

CVE-2019-18646

Affected product/versions: Untangle NG firewall 14.2.0. Vulnerability: authenticated inline-query SQL injection in the timeDataDynamicColumn parameter when logged in as an admin user. Root cause: improper handling of inline SQL in the affected parameter. Impact: not explicitly quantified beyond t...

CVE-2019-18646

The Untangle NG firewall 14.2.0 is vulnerable to authenticated inline-query SQL injection within the timeDataDynamicColumn parameter when logged in as an admin user...

CVE-2019-18647

CVE-2019-18647 concerns Untangle NG firewall 14.2.0, with an authenticated command injection when logged in as an admin user. The vulnerability is described across multiple sources (NVD, Red Hat advisory, CVE lists) and is classified with high impact (C/H/I/A) and a high base score (CVSS v3.1: 7....