Command injection

The Untangle NG firewall 14.2.0 is vulnerable to an authenticated command injection when logged in as an admin user...

Cross site scripting

When logged in as an admin user, the Title input field under Reports within Untangle NG firewall 14.2.0 is vulnerable to stored XSS...

Sql injection

The Untangle NG firewall 14.2.0 is vulnerable to authenticated inline-query SQL injection within the timeDataDynamicColumn parameter when logged in as an admin user...

Cross site scripting

When logged in as an admin user, the Untangle NG firewall 14.2.0 is vulnerable to reflected XSS at multiple places and specific user input fields...

CVE-2019-18646

Affected product/versions: Untangle NG firewall 14.2.0. Vulnerability: authenticated inline-query SQL injection in the timeDataDynamicColumn parameter when logged in as an admin user. Root cause: improper handling of inline SQL in the affected parameter. Impact: not explicitly quantified beyond t...

CVE-2019-18646

The Untangle NG firewall 14.2.0 is vulnerable to authenticated inline-query SQL injection within the timeDataDynamicColumn parameter when logged in as an admin user...

CVE-2019-18647

CVE-2019-18647 concerns Untangle NG firewall 14.2.0, with an authenticated command injection when logged in as an admin user. The vulnerability is described across multiple sources (NVD, Red Hat advisory, CVE lists) and is classified with high impact (C/H/I/A) and a high base score (CVSS v3.1: 7....

CVE-2019-18647

The Untangle NG firewall 14.2.0 is vulnerable to an authenticated command injection when logged in as an admin user...

CVE-2019-18648

When logged in as an admin user, the Untangle NG firewall 14.2.0 is vulnerable to reflected XSS at multiple places and specific user input fields...

CVE-2019-18648

CVE-2019-18648 affects Untangle NG firewall 14.2.0 with a reflected XSS vulnerability exploitable when an administrator is logged in. The weakness is reported at multiple input fields and other input points, enabling injection of malicious scripts via user-supplied data. The provided documents in...

CVE-2019-18649

When logged in as an admin user, the Title input field under Reports within Untangle NG firewall 14.2.0 is vulnerable to stored XSS...

CVE-2019-18649

The CVE-2019-18649 entry concerns Untangle NG firewall 14.2.0 where an admin-authenticated user can trigger a stored XSS in the Title input under Reports. Documented impact metrics include CVSS v2 base score 3.5 (LOW) and CVSS v3.1 base score 4.8 (MEDIUM); both indicate potential confidentiality/...

PT-2019-15549

Name of the Vulnerable Software and Affected Versions Untangle NG firewall version 14.2.0 Description The issue concerns authenticated inline-query SQL injection. It occurs within the timeDataDynamicColumn parameter when a user is logged in as an admin. Recommendations For Untangle NG firewall...

PT-2019-15550

Name of the Vulnerable Software and Affected Versions Untangle NG firewall version 14.2.0 Description The issue allows for an authenticated command injection when an admin user is logged in. Recommendations For Untangle NG firewall version 14.2.0, at the moment, there is no information about a...

CVE-2019-18647: Improper Neutralization of Special Elements used in a Command

The Untangle NG firewall 14.2.0 is vulnerable to an authenticated command injection when logged in as an admin user...

CVE-2019-18649: Improper Neutralization of Input During Web Page Generation

When logged in as an admin user, the Title input field under Reports within Untangle NG firewall 14.2.0 is vulnerable to stored XSS...

CVE-2019-18648: Improper Neutralization of Input During Web Page Generation

When logged in as an admin user, the Untangle NG firewall 14.2.0 is vulnerable to reflected XSS at multiple places and specific user input fields...

CVE-2019-18646: Improper Neutralization of Special Elements used in an SQL Command

The Untangle NG firewall 14.2.0 is vulnerable to authenticated inline-query SQL injection within the timeDataDynamicColumn parameter when logged in as an admin user...

PT-2019-15551

Name of the Vulnerable Software and Affected Versions Untangle NG Firewall version 14.2.0 Description The issue allows for reflected XSS attacks when logged in as an admin user, affecting multiple places and specific user input fields. Recommendations For Untangle NG Firewall version 14.2.0,...

PT-2019-15552

Name of the Vulnerable Software and Affected Versions Untangle NG Firewall version 14.2.0 Description The issue concerns a stored XSS vulnerability in the Title input field under Reports when an admin user is logged in. Recommendations For Untangle NG Firewall version 14.2.0, update to a version...