3cx Archives - CVE Vulnerability

CVE-2008-6896

Sun, 26 Feb 2023 09:11:46 +0000

login.php in 3CX Phone System 6.0.806.0, when 100% disk capacity is reached, allows remote attackers to gain sensitive information via unspecified vectors that reveal the installation path.

The post CVE-2008-6896 appeared first on CVE Vulnerability.

CVE-2008-6895

Sun, 26 Feb 2023 09:11:46 +0000

3CX Phone System 6.0.806.0 allows remote attackers to cause a denial of service (unstable service or crash) via unspecified vectors, as demonstrated by vulnerability scans from Nessus or SAINT.

The post CVE-2008-6895 appeared first on CVE Vulnerability.

CVE-2008-6894

Sun, 26 Feb 2023 09:11:45 +0000

Multiple cross-site scripting (XSS) vulnerabilities in login.php in 3CX Phone System Free Edition 6.1793 and 6.0.806.0 allow remote attackers to inject arbitrary web script or HTML via the (1) fName and (2) fPassword parameters.

The post CVE-2008-6894 appeared first on CVE Vulnerability.

CVE-2018-9864

Sun, 26 Feb 2023 06:51:52 +0000

The WP Live Chat Support plugin before 8.0.06 for WordPress has stored XSS via the Name field.

The post CVE-2018-9864 appeared first on CVE Vulnerability.

CVE-2018-18460

Sun, 26 Feb 2023 06:47:47 +0000

XSS exists in the wp-live-chat-support v8.0.15 plugin for WordPress via the modules/gdpr.php term parameter in a wp-admin/admin.php wplivechat-menu-gdpr-page request.

The post CVE-2018-18460 appeared first on CVE Vulnerability.

CVE-2018-14907

Sun, 26 Feb 2023 06:46:30 +0000

The Web server in 3CX version 15.5.8801.3 is vulnerable to Information Leakage, because of improper error handling in Stack traces, as demonstrated by discovering a full pathname.

The post CVE-2018-14907 appeared first on CVE Vulnerability.

CVE-2018-14906

Sun, 26 Feb 2023 06:46:30 +0000

The Web server in 3CX version 15.5.8801.3 is vulnerable to Reflected XSS on all stack traces’ propertyPath parameters.

The post CVE-2018-14906 appeared first on CVE Vulnerability.

CVE-2018-14905

Sun, 26 Feb 2023 06:46:30 +0000

The Web server in 3CX version 15.5.8801.3 is vulnerable to Reflected XSS on the api/CallLog TimeZoneName parameter.

The post CVE-2018-14905 appeared first on CVE Vulnerability.

CVE-2018-12426

Sun, 26 Feb 2023 06:45:39 +0000

The WP Live Chat Support Pro plugin before 8.0.07 for WordPress is vulnerable to unauthenticated Remote Code Execution due to client-side validation of allowed file types, as demonstrated by a v1/remote_upload request with a .php filename and the image/jpeg content type.

The post CVE-2018-12426 appeared first on CVE Vulnerability.

CVE-2018-11105

Sun, 26 Feb 2023 06:45:07 +0000

There is stored cross site scripting in the wp-live-chat-support plugin before 8.0.08 for WordPress via the “name” (aka wplc_name) and “email” (aka wplc_email) input fields to wp-json/wp_live_chat_support/v1/start_chat whenever a malicious attacker would initiate a new chat with an administrator. NOTE: this issue exists because of an incomplete fix for CVE-2018-9864.

The post CVE-2018-11105 appeared first on CVE Vulnerability.