Unisys vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-39907 Unisys WebPerfect Image Suite versions 3.0.3960.22810 and 3.0.3960.22604 expose an unauthenticated WCF SOAP endpoint on TCP port 1208 that accepts unsanitized fHigh 7 · Apr 14, 2026
• CVE-2026-39906 Unisys WebPerfect Image Suite versions 3.0.3960.22810 and 3.0.3960.22604 expose a deprecated .NET Remoting TCP channel that allows remote unauthenticated attackHigh 7 · Apr 14, 2026
• CVE-2024-23758 An issue discovered in Unisys Stealth 5.3.062.0 allows attackers to view sensitive information via the Enterprise ManagementInstaller_msi.log file.High 7.5 · Feb 20, 2024
• CVE-2022-32555 Unisys Data Exchange Management Studio before 6.0.IC2 and 7.x before 7.0.IC1 doesn't have an Anti-CSRF token to authenticate the POST request.High 8.8 · Sep 13, 2022
• CVE-2021-43394 Unisys OS 2200 Messaging Integration Services (NTSI) 7R3B IC3 and IC4, 7R3C, and 7R3D has an Incorrect Implementation of an Authentication Algorithm.Critical 9.8 · Jan 24, 2022
• CVE-2021-45445 Unisys ClearPath MCP TCP/IP Networking Services 59.1, 60.0, and 62.0 has an Infinite Loop.High 7.5 · Jan 12, 2022
• CVE-2021-43388 Unisys Cargo Mobile Application before 1.2.29 uses cleartext to store sensitive information, which might be revealed in a backup.High 7.5 · Dec 14, 2021
• CVE-2021-3141 In Unisys Stealth (core) before 6.0.025.0, the Keycloak password is stored in a recoverable format that might be accessible by a local attacker, who could gain High 7.8 · Mar 18, 2021
• CVE-2020-24620 Unisys Stealth(core) before 4.0.134 stores passwords in a recoverable format.High 7.8 · Oct 1, 2020
• CVE-2020-12053 In Unisys Stealth 3.4.x, 4.x and 5.x before 5.0.026, if certificate-based authorization is used without HTTPS, an endpoint could be authorized without a privateCritical 9.8 · Jun 22, 2020
• CVE-2020-12647 Unisys ALGOL Compiler 58.1 before 58.1a.15, 59.1 before 59.1a.9, and 60.0 before 60.0a.5 can emit invalid code sequences under rare circumstances related to synHigh 8.8 · May 20, 2020
• CVE-2019-18193 In Unisys Stealth (core) 3.4.108.0, 3.4.209.x, 4.0.027.x and 4.0.114, key material inadvertently logged under certain conditions.High 7.5 · Feb 3, 2020
• CVE-2019-18386 Systems management on Unisys ClearPath Forward Libra and ClearPath MCP Software Series can fault and have other unspecified impact when receiving specifically cHigh 8.7 · Jan 7, 2020
• CVE-2018-8049 The Stealth endpoint in Unisys Stealth SVG 2.8.x, 3.0.x before 3.0.1999, 3.1.x, 3.2.x before 3.2.030, and 3.3.x before 3.3.016, when running on Linux and AIX, aHigh 7.5 · Apr 3, 2018
• CVE-2018-8802 SQL injection vulnerability in the management interface in ePortal Manager allows remote attackers to execute arbitrary SQL commands via unspecified parameterHigh 8.1 · Mar 26, 2018
• CVE-2018-6592 Unisys Stealth 3.3 Windows endpoints before 3.3.016.1 allow local users to gain access to Stealth-enabled devices by leveraging improper cleanup of memory used High 7.8 · Feb 19, 2018
• CVE-2017-13684 Unisys Libra 64xx and 84xx and FS601 class systems with MCP-FIRMWARE before 43.211 allow remote authenticated users to cause a denial of service (program crash)High 7.8 · Sep 29, 2017
• CVE-2017-5872 The TCP/IP networking module in Unisys ClearPath MCP systems with TCP-IP-SW 57.1 before 57.152, 58.1 before 58.142, or 59.1 before 59.172, when running a TLS 1.High 7.5 · Mar 9, 2017
• CVE-2009-1628 Stack-based buffer overflow in mnet.exe in Unisys Business Information Server (BIS) 10 and 10.1 on Windows allows remote attackers to execute arbitrary code viaHigh 10 · Jun 26, 2009
• CVE-2002-2179 The dynamic initialization feature of the ClearPath MCP environment allows remote attackers to cause a denial of service (crash) via a TCP port scan using a tooHigh 7.8 · Dec 31, 2002