← Back

Untangle

untangle

5 CVEs • 2 products

Products (2)

Click to collapse
Toggle
Ng Firewall
ng_firewall
4 CVEs
Untangle Firewall Ng
untangle_firewall_ng
1 CVE

CVEs (5)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2020-17494
1Untangle
1Untangle Firewall Ng
Jun 17, 2026
Nov 12, 2020
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
Untangle Firewall NG before 16.0 uses MD5 for passwords.
CVE-2019-18649
1Untangle
1Ng Firewall
Jun 17, 2026
Nov 14, 2019
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
When logged in as an admin user, the Title input field (under Reports) within Untangle NG firewall 14.2.0 is vulnerable to stored XSS.
CVE-2019-18648
1Untangle
1Ng Firewall
Jun 17, 2026
Nov 14, 2019
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
When logged in as an admin user, the Untangle NG firewall 14.2.0 is vulnerable to reflected XSS at multiple places and specific user input fields.
CVE-2019-18647
1Untangle
1Ng Firewall
Jun 17, 2026
Nov 14, 2019
N/A· v4
7.2 HIGH· v3
9.0 HIGH· v2
The Untangle NG firewall 14.2.0 is vulnerable to an authenticated command injection when logged in as an admin user.
CVE-2019-18646
1Untangle
1Ng Firewall
Jun 17, 2026
Nov 14, 2019
N/A· v4
7.2 HIGH· v3
6.5 MEDIUM· v2
The Untangle NG firewall 14.2.0 is vulnerable to authenticated inline-query SQL injection within the timeDataDynamicColumn parameter when logged in as an admin user.