CVE-2019-18646

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

The Untangle NG firewall 14.2.0 is vulnerable to authenticated inline-query SQL injection within the timeDataDynamicColumn parameter when logged in as an admin user.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://gist.github.com/alm4ric/ada44ce7de9a30244c2269106c70a145Third Party Advisory
https://gist.github.com/alm4ric/ada44ce7de9a30244c2269106c70a145Third Party Advisory

Timeline

Published: Nov 14, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-186477.2The Untangle NG firewall 14.2.0 is vulnerable to an authenticated command injection when logged in as an admin user.CVE-2019-186484.8When logged in as an admin user, the Untangle NG firewall 14.2.0 is vulnerable to reflected XSS at multiple places and specific user input f CVE-2019-186494.8When logged in as an admin user, the Title input field (under Reports) within Untangle NG firewall 14.2.0 is vulnerable to stored XSS.CVE-2019-18658.8A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated,CVE-2019-186508.8An issue was discovered in Joomla! before 3.9.13. A missing token check in com_template causes a CSRF vulnerability.CVE-2019-186516.5A cross-site request forgery (CSRF) vulnerability in 3xLogic Infinias Access Control through 6.6.9586.0 allows remote attackers to execute m CVE-2019-186526.1A DOM based XSS vulnerability has been identified on the WatchGuard XMT515 through 12.1.3, allowing a remote attacker to execute JavaScript CVE-2019-186536.1A Cross Site Scripting (XSS) issue exists in Avast AntiVirus (Free, Internet Security, and Premiere Edition) 19.3.2369 build 19.3.4241.440 i CVE-2019-186546.1A Cross Site Scripting (XSS) issue exists in AVG AntiVirus (Internet Security Edition) 19.3.3084 build 19.3.4241.440 in the Network Notifica CVE-2019-186559.8File Sharing Wizard version 1.5.0 build 2008 is affected by a Structured Exception Handler based buffer overflow vulnerability. An unauthent CVE-2019-186566.1Pimcore 6.2.3 has XSS in the translations grid because bundles/AdminBundle/Resources/public/js/pimcore/settings/translations.js mishandles c CVE-2019-186575.3ClickHouse before 19.13.5.44 allows HTTP header injection via the url table function.