CVE-2019-18647

The Untangle NG firewall 14.2.0 is vulnerable to an authenticated command injection when logged in as an admin user...

CVE-2019-18648

When logged in as an admin user, the Untangle NG firewall 14.2.0 is vulnerable to reflected XSS at multiple places and specific user input fields...

Sql injection

The Untangle NG firewall 14.2.0 is vulnerable to authenticated inline-query SQL injection within the timeDataDynamicColumn parameter when logged in as an admin user...

Cross site scripting

When logged in as an admin user, the Title input field under Reports within Untangle NG firewall 14.2.0 is vulnerable to stored XSS...

Cross site scripting

When logged in as an admin user, the Untangle NG firewall 14.2.0 is vulnerable to reflected XSS at multiple places and specific user input fields...

CVE-2019-18646

Affected product/versions: Untangle NG firewall 14.2.0. Vulnerability: authenticated inline-query SQL injection in the timeDataDynamicColumn parameter when logged in as an admin user. Root cause: improper handling of inline SQL in the affected parameter. Impact: not explicitly quantified beyond t...

CVE-2019-18646

The Untangle NG firewall 14.2.0 is vulnerable to authenticated inline-query SQL injection within the timeDataDynamicColumn parameter when logged in as an admin user...

CVE-2019-18647

CVE-2019-18647 concerns Untangle NG firewall 14.2.0, with an authenticated command injection when logged in as an admin user. The vulnerability is described across multiple sources (NVD, Red Hat advisory, CVE lists) and is classified with high impact (C/H/I/A) and a high base score (CVSS v3.1: 7....

CVE-2019-18647

The Untangle NG firewall 14.2.0 is vulnerable to an authenticated command injection when logged in as an admin user...

CVE-2019-18648

CVE-2019-18648 affects Untangle NG firewall 14.2.0 with a reflected XSS vulnerability exploitable when an administrator is logged in. The weakness is reported at multiple input fields and other input points, enabling injection of malicious scripts via user-supplied data. The provided documents in...

CVE-2019-18648

When logged in as an admin user, the Untangle NG firewall 14.2.0 is vulnerable to reflected XSS at multiple places and specific user input fields...

CVE-2019-18649

The CVE-2019-18649 entry concerns Untangle NG firewall 14.2.0 where an admin-authenticated user can trigger a stored XSS in the Title input under Reports. Documented impact metrics include CVSS v2 base score 3.5 (LOW) and CVSS v3.1 base score 4.8 (MEDIUM); both indicate potential confidentiality/...

CVE-2019-18649

When logged in as an admin user, the Title input field under Reports within Untangle NG firewall 14.2.0 is vulnerable to stored XSS...

Junos OS: NG-mVPN rpd DoS (JSA10965)

According to its self-reported version number, the remote Juniper Junos device is affected by an unexpected status return value weakness in the Next-Generation Multicast VPN NG-mVPN which can result in a denial of service DoS condition. An unauthenticated, remote attacker can exploit this issue, ...

Amazon Linux 2 : procps-ng (ALAS-2019-1333)

If the HOME environment variable is unset or empty, top will read its configuration file from the current working directory without any security check. If a user runs top with HOME unset in an attacker-controlled directory, the attacker could achieve privilege escalation by exploiting one of...

nipper-ng buffer overflow vulnerability

nipper-ng is an open source penetration testing tool. A buffer overflow vulnerability exists in the 'processPrivilage' function of the IOS/process-general.c file in version 0.11.10 of nipper-ng. The vulnerability stems from a networked system or product that does not correctly validate data...

CVE-2019-17424

A stack-based buffer overflow in the processPrivilage function in IOS/process-general.c in nipper-ng 0.11.10 allows remote attackers serving firewall configuration files to achieve Remote Code Execution or Denial Of Service via a crafted file...

CVE-2019-17424

A stack-based buffer overflow in the processPrivilage function in IOS/process-general.c in nipper-ng 0.11.10 allows remote attackers serving firewall configuration files to achieve Remote Code Execution or Denial Of Service via a crafted file...

CVE-2019-17424

CVE-2019-17424 affects nipper-ng 0.11.10. A stack-based buffer overflow in the function processPrivilage() (IOS/process-general.c) may be triggered by processing a crafted firewall configuration file, enabling remote attackers to achieve Remote Code Execution or Denial of Service. Public details ...

CVE-2019-17424

A stack-based buffer overflow in the processPrivilage function in IOS/process-general.c in nipper-ng 0.11.10 allows remote attackers serving firewall configuration files to achieve Remote Code Execution or Denial Of Service via a crafted file...