Unisys

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2026-39907 1Unisys 1Webperfect Image Suite Jul 24, 2026 Apr 14, 2026 7.0 HIGH· v4 10.0 CRITICAL· v3 N/A· v2 Unisys WebPerfect Image Suite versions 3.0.3960.22810 and 3.0.3960.22604 expose an unauthenticated WCF SOAP endpoint on TCP port 1208 that accepts unsanitized file paths in the ReadLicense action's LFName parameter, allo...Show more Unisys WebPerfect Image Suite versions 3.0.3960.22810 and 3.0.3960.22604 expose an unauthenticated WCF SOAP endpoint on TCP port 1208 that accepts unsanitized file paths in the ReadLicense action's LFName parameter, allowing remote attackers to trigger SMB connections and leak NTLMv2 machine-account hashes. Attackers can submit crafted SOAP requests with UNC paths to force the server to initiate outbound SMB connections, exposing authentication credentials that may be relayed for privilege escalation or lateral movement within the network.Show less
CVE-2026-39906 1Unisys 1Webperfect Image Suite Jul 24, 2026 Apr 14, 2026 7.0 HIGH· v4 10.0 CRITICAL· v3 N/A· v2 Unisys WebPerfect Image Suite versions 3.0.3960.22810 and 3.0.3960.22604 expose a deprecated .NET Remoting TCP channel that allows remote unauthenticated attackers to leak NTLMv2 machine-account hashes by supplying a Win...Show more Unisys WebPerfect Image Suite versions 3.0.3960.22810 and 3.0.3960.22604 expose a deprecated .NET Remoting TCP channel that allows remote unauthenticated attackers to leak NTLMv2 machine-account hashes by supplying a Windows UNC path as a target file argument through object-unmarshalling techniques. Attackers can capture the leaked NTLMv2 hash and relay it to other hosts to achieve privilege escalation or lateral movement depending on network configuration and patch level.Show less
CVE-2024-23758 1Unisys 1Stealth Jun 17, 2026 Feb 20, 2024 N/A· v4 7.5 HIGH· v3 N/A· v2 An issue discovered in Unisys Stealth 5.3.062.0 allows attackers to view sensitive information via the Enterprise ManagementInstaller_msi.log file.
CVE-2022-32555 1Unisys 1Data Exchange Management Studio Jun 17, 2026 Sep 13, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 Unisys Data Exchange Management Studio before 6.0.IC2 and 7.x before 7.0.IC1 doesn't have an Anti-CSRF token to authenticate the POST request. Thus, a cross-site request forgery attack could occur.
CVE-2021-43394 1Unisys 1Messaging Integration Services Jun 17, 2026 Jan 24, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Unisys OS 2200 Messaging Integration Services (NTSI) 7R3B IC3 and IC4, 7R3C, and 7R3D has an Incorrect Implementation of an Authentication Algorithm. An LDAP password is not properly validated.
CVE-2021-45445 1Unisys 1Clearpath Mcp Tcp/ip Networking Services Jun 17, 2026 Jan 12, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Unisys ClearPath MCP TCP/IP Networking Services 59.1, 60.0, and 62.0 has an Infinite Loop.
CVE-2021-43388 1Unisys 1Cargo Mobile Jun 17, 2026 Dec 14, 2021 N/A· v4 7.5 HIGH· v3 4.3 MEDIUM· v2 Unisys Cargo Mobile Application before 1.2.29 uses cleartext to store sensitive information, which might be revealed in a backup. The issue is addressed by ensuring that the allowBackup flag (in the manifest) is False.
CVE-2021-35056 1Unisys 1Stealth Jun 17, 2026 Jul 15, 2021 N/A· v4 6.7 MEDIUM· v3 4.6 MEDIUM· v2 Unisys Stealth 5.1 before 5.1.025.0 and 6.0 before 6.0.055.0 has an unquoted Windows search path for a scheduled task. An unintended executable might run.
CVE-2020-35542 1Unisys 1Data Exchange Management Studio Jun 17, 2026 Apr 27, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 Unisys Data Exchange Management Studio through 5.0.34 doesn't sanitize the input to a HTML document field. This could be used for an XSS attack.
CVE-2021-28492 1Unisys 1Stealth Jun 17, 2026 Apr 20, 2021 N/A· v4 4.9 MEDIUM· v3 4.0 MEDIUM· v2 Unisys Stealth (core) 5.x before 5.0.048.0, 5.1.x before 5.1.017.0, and 6.x before 6.0.037.0 stores passwords in a recoverable format.
CVE-2021-3141 1Unisys 1Stealth Jun 17, 2026 Mar 18, 2021 N/A· v4 7.8 HIGH· v3 2.1 LOW· v2 In Unisys Stealth (core) before 6.0.025.0, the Keycloak password is stored in a recoverable format that might be accessible by a local attacker, who could gain access to the Management Server and change the Stealth confi...Show more In Unisys Stealth (core) before 6.0.025.0, the Keycloak password is stored in a recoverable format that might be accessible by a local attacker, who could gain access to the Management Server and change the Stealth configuration.Show less
CVE-2020-24620 1Unisys 1Stealth Jun 17, 2026 Oct 1, 2020 N/A· v4 7.8 HIGH· v3 2.1 LOW· v2 Unisys Stealth(core) before 4.0.134 stores passwords in a recoverable format. Therefore, a search of Enterprise Manager can potentially reveal credentials.
CVE-2020-12053 1Unisys 1Stealth Jun 17, 2026 Jun 22, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 In Unisys Stealth 3.4.x, 4.x and 5.x before 5.0.026, if certificate-based authorization is used without HTTPS, an endpoint could be authorized without a private key.
CVE-2020-12647 1Unisys 1Algol Compiler Jun 17, 2026 May 21, 2020 N/A· v4 8.8 HIGH· v3 7.2 HIGH· v2 Unisys ALGOL Compiler 58.1 before 58.1a.15, 59.1 before 59.1a.9, and 60.0 before 60.0a.5 can emit invalid code sequences under rare circumstances related to syntax. The resulting code could, for example, trigger a system...Show more Unisys ALGOL Compiler 58.1 before 58.1a.15, 59.1 before 59.1a.9, and 60.0 before 60.0a.5 can emit invalid code sequences under rare circumstances related to syntax. The resulting code could, for example, trigger a system fault or adversely affect confidentiality, integrity, and availability.Show less
CVE-2019-18193 1Unisys 1Stealth Jun 17, 2026 Feb 3, 2020 N/A· v4 7.5 HIGH· v3 6.9 MEDIUM· v2 In Unisys Stealth (core) 3.4.108.0, 3.4.209.x, 4.0.027.x and 4.0.114, key material inadvertently logged under certain conditions. Fixed included in 3.4.109, 4.0.027.13, 4.0.125 and 5.0.013.0.
CVE-2019-18386 1Unisys 1Mcp Firmware Jun 17, 2026 Jan 7, 2020 N/A· v4 8.7 HIGH· v3 5.8 MEDIUM· v2 Systems management on Unisys ClearPath Forward Libra and ClearPath MCP Software Series can fault and have other unspecified impact when receiving specifically crafted message payloads over a systems management communicat...Show more Systems management on Unisys ClearPath Forward Libra and ClearPath MCP Software Series can fault and have other unspecified impact when receiving specifically crafted message payloads over a systems management communication channelShow less
CVE-2018-7534 1Unisys 1Stealth Authorization Server Jun 17, 2026 May 30, 2018 N/A· v4 4.7 MEDIUM· v3 1.9 LOW· v2 In Stealth Authorization Server before 3.3.017.0 in Unisys Stealth Solution, an encryption key may be left in memory.
CVE-2018-8049 1Unisys 1Stealth Svg Jun 17, 2026 Apr 3, 2018 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 The Stealth endpoint in Unisys Stealth SVG 2.8.x, 3.0.x before 3.0.1999, 3.1.x, 3.2.x before 3.2.030, and 3.3.x before 3.3.016, when running on Linux and AIX, allows remote attackers to cause a denial of service (crash)...Show more The Stealth endpoint in Unisys Stealth SVG 2.8.x, 3.0.x before 3.0.1999, 3.1.x, 3.2.x before 3.2.030, and 3.3.x before 3.3.016, when running on Linux and AIX, allows remote attackers to cause a denial of service (crash) via crafted packets.Show less
CVE-2018-8802 1Unisys 2Clearpath Eportal Manager Eportal 2200 Jun 17, 2026 Mar 26, 2018 N/A· v4 8.1 HIGH· v3 6.5 MEDIUM· v2 SQL injection vulnerability in the management interface in ePortal Manager allows remote attackers to execute arbitrary SQL commands via unspecified parameters.
CVE-2018-5762 1Unisys 1Clearpath Mcp Jun 17, 2026 Feb 26, 2018 N/A· v4 5.9 MEDIUM· v3 4.3 MEDIUM· v2 The TLS implementation in the TCP/IP networking module in Unisys ClearPath MCP systems with TCP-IP-SW 58.1 before 58.160, 59.1 before 059.1a.17 (IC #17), and 60.0 before 60.044 might allow remote attackers to decrypt TLS...Show more The TLS implementation in the TCP/IP networking module in Unisys ClearPath MCP systems with TCP-IP-SW 58.1 before 58.160, 59.1 before 059.1a.17 (IC #17), and 60.0 before 60.044 might allow remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a ROBOT attack.Show less

12 Next