2017 and Prior Historical Security Advisories

May 22nd 2017 | Security Advisory
The following security advisory has been released for all versions of uniFLOW:

Sniffing network packages to webcall.asp possible

December 09th 2014 | Security Advisory
The following security advisory has been released for all versions of uniFLOW:

"POODLE" exploit (SSL 3.0 vulnerability)

April 11th 2014 | Security Advisory
The following security advisory has been released for uniFLOW V5.1 and V5.2:

Heartbleed Bug (OpenSSL vulnerability)

December 4th 2013 | Security Advisory
The following security advisories have been released by NT-ware for uniFLOW V5.2 SR1 and older:

Stored and reflected Cross Site Scripting (XSS)

Arbitrary command execution

Inadequate Access Control

Potential credential stealing on IG

Use of dangerous functions in the IG code

Arbitrary file write on IG

SQL Injection

Information disclosure through the header response of the IG server

Weak CAPTCHA security

Passwords stored in plain text in the IG database

Arbitrary file delete on uniFLOW server

Cross site request forgery (uniFLOW server)

May 8th 2013 | Security Advisory
The following four security advisories has been released for uniFLOW V5.1.0 – V5.1.6 and uniFLOW V5.2

Authentication with user name and PIN-code on PWCLIENT and PWRQM

December 8th 2011 | Security Advisory
The following four security advisories have been released for uniFLOW V5.0.5 and uniFLOW V5.1.1

Password in HTML Source

SQL Injection

Persistent/Stored XSS

Unencrypted communication between MEAP Module and RPS