CVE-2020-3936

UltraLog Express device management interface does not properly filter user inputted string in some specific parameters, attackers can inject arbitrary SQL command...

Information disclosure

UltraLog Express device management software stores user’s information in cleartext. Any user can obtain accounts information through a specific page...

Directory traversal

UltraLog Express device management interface does not properly perform access authentication in some specific pages/functions. Any user can access the privileged page to manage accounts through specific system directory...

CVE-2020-3936 Unisoon UltraLog Express - SQL Injection

UltraLog Express device management interface does not properly filter user inputted string in some specific parameters, attackers can inject arbitrary SQL command...

CVE-2020-3921 Unisoon UltraLog Express - Sensitive Data Exposure

UltraLog Express device management software stores user’s information in cleartext. Any user can obtain accounts information through a specific page...

CVE-2020-3921 Unisoon UltraLog Express - Sensitive Data Exposure

UltraLog Express device management software stores user’s information in cleartext. Any user can obtain accounts information through a specific page...

CVE-2020-3936

The CVE-2020-3936 issue concerns the UltraLog Express device management interface from Unisoon. Affected component: the device management interface that fails to properly filter user-inputted strings in specific parameters, enabling SQL injection. Root cause: lack of input validation/filtering le...

CVE-2020-3921

The CVE-2020-3921 entry concerns Unisoon UltraLog Express device management software that stores user information in cleartext, enabling access to account data via a specific page. Multiple connected sources corroborate: the vulnerability is a data disclosure due to plaintext storage in the Ultra...

CVE-2020-3936 Unisoon UltraLog Express - SQL Injection

UltraLog Express device management interface does not properly filter user inputted string in some specific parameters, attackers can inject arbitrary SQL command...

CVE-2020-3920

CVE-2020-3920 affects the UltraLog Express device management interface (Unisoon) where access authentication is not properly enforced on certain pages/functions, enabling any user to reach a privileged page for managing accounts via a system directory. Multiple sources (NVD, CNVD, CVE records, an...

CVE-2020-3920 Unisoon UltraLog Express - Broken Authentication

UltraLog Express device management interface does not properly perform access authentication in some specific pages/functions. Any user can access the privileged page to manage accounts through specific system directory...

PT-2020-17796 · Ultralog · Ultralog Express

Name of the Vulnerable Software and Affected Versions: UltraLog Express affected versions not specified Description: The UltraLog Express device management interface has an issue with access authentication on certain pages or functions. This allows any user to access a privileged page for managin...

PT-2020-17812 · Unknown · Ultralog Express

Name of the Vulnerable Software and Affected Versions: UltraLog Express affected versions not specified Description: The issue concerns the UltraLog Express device management interface, which fails to properly filter user-inputted strings in specific parameters. This allows attackers to inject...

PT-2020-17797 · Ultralog · Ultralog Express

Name of the Vulnerable Software and Affected Versions: UltraLog Express device management software affected versions not specified Description: The issue concerns the storage of user information in cleartext by the UltraLog Express device management software. This allows any user to obtain accoun...

The vulnerability in the web interface of the Cisco Unified Contact Center Express software allows a malicious individual to elevate their privileges to the root level.

The vulnerability of the Cisco Unified Contact Center Express automation software lies in the insufficient restrictions on the content uploaded to the vulnerable system. Exploiting this vulnerability can allow a malicious actor to elevate their privileges to the root level...

DEBIAN-CVE-2019-15034

hw/display/bochs-display.c in QEMU 4.0.0 does not ensure a sufficient PCI config space allocation, leading to a buffer overflow involving the PCIe extended config space...

UBUNTU-CVE-2019-15034

hw/display/bochs-display.c in QEMU 4.0.0 does not ensure a sufficient PCI config space allocation, leading to a buffer overflow involving the PCIe extended config space...

Cross-site Scripting (XSS)

express-sanitize-escape is vulnerable to cross-site scripting XSS. The vulnerability exists as it doesn't sanitize the 'req.query' and 'req.body' since the 'req.param' has not been populated at the time that middleware is called allowing an attacker to inject arbitrary Javascript to cause a...

Security Bulletin: IBM Security SiteProtector System is affected by Apache HTTP Server vulnerabilities

Summary IBM Security SiteProtector System has addressed the following vulnerabilities in Apache HTTP Server. Vulnerability Details CVEID: CVE-2019-10092 DESCRIPTION: In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the modproxy error page. An attacke...

Security Bulletin: IBM Security SiteProtector System is affected by Apache HTTP Server vulnerabilities

Summary IBM Security SiteProtector System has addressed the following vulnerabilities in Apache HTTP Server. Vulnerability Details CVEID: CVE-2018-20843 DESCRIPTION: libexpat is vulnerable to a denial of service, caused by an error in the XML parser. By persuading a victim to open a...