sangoma Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/sangoma/ Sun, 26 Feb 2023 09:11:36 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png sangoma Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/sangoma/ 32 32 CVE-2008-6598 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-6598/ Sun, 26 Feb 2023 09:11:36 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-6598/ Multiple race conditions in WANPIPE before 3.3.6 have unknown impact and attack vectors related to “bri restart logic.”

The post CVE-2008-6598 appeared first on CVE Vulnerability.

]]> Multiple race conditions in WANPIPE before 3.3.6 have unknown impact and attack vectors related to “bri restart logic.”

The post CVE-2008-6598 appeared first on CVE Vulnerability.

]]> CVE-2018-6393 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-6393/ Sun, 26 Feb 2023 06:50:42 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-6393/ ** DISPUTED ** FreePBX 10.13.66-32bit and 14.0.1.24 (SNG7-PBX-64bit-1712-2) allow post-authentication SQL injection via the order parameter. NOTE: the vendor disputes this issue because it is intentional that a user can “directly modify SQL tables … [or] run shell scripts … once … logged in to the administration interface; there is no need to try to […]

The post CVE-2018-6393 appeared first on CVE Vulnerability.

]]> ** DISPUTED ** FreePBX 10.13.66-32bit and 14.0.1.24 (SNG7-PBX-64bit-1712-2) allow post-authentication SQL injection via the order parameter. NOTE: the vendor disputes this issue because it is intentional that a user can “directly modify SQL tables … [or] run shell scripts … once … logged in to the administration interface; there is no need to try to find input validation errors.”

The post CVE-2018-6393 appeared first on CVE Vulnerability.

]]> CVE-2018-15891 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-15891/ Sun, 26 Feb 2023 06:46:49 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-15891/ An issue was discovered in FreePBX core before 3.0.122.43, 14.0.18.34, and 5.0.1beta4. By crafting a request for adding Asterisk modules, an attacker is able to store JavaScript commands in a module name.

The post CVE-2018-15891 appeared first on CVE Vulnerability.

]]> An issue was discovered in FreePBX core before 3.0.122.43, 14.0.18.34, and 5.0.1beta4. By crafting a request for adding Asterisk modules, an attacker is able to store JavaScript commands in a module name.

The post CVE-2018-15891 appeared first on CVE Vulnerability.

]]> CVE-2020-36630 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-36630/ Sun, 26 Feb 2023 06:41:43 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-36630/ A vulnerability was found in FreePBX cdr 14.0. It has been classified as critical. This affects the function ajaxHandler of the file ucp/Cdr.class.php. The manipulation of the argument limit/offset leads to sql injection. Upgrading to version 14.0.5.21 is able to address this issue. The name of the patch is f1a9eea2dfff30fb99d825bac194a676a82b9ec8. It is recommended to upgrade […]

The post CVE-2020-36630 appeared first on CVE Vulnerability.

]]> A vulnerability was found in FreePBX cdr 14.0. It has been classified as critical. This affects the function ajaxHandler of the file ucp/Cdr.class.php. The manipulation of the argument limit/offset leads to sql injection. Upgrading to version 14.0.5.21 is able to address this issue. The name of the patch is f1a9eea2dfff30fb99d825bac194a676a82b9ec8. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216771.

The post CVE-2020-36630 appeared first on CVE Vulnerability.

]]> CVE-2020-10666 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-10666/ Sun, 26 Feb 2023 06:35:54 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-10666/ The restapps (aka Rest Phone apps) module for Sangoma FreePBX and PBXact 13, 14, and 15 through 15.0.19.2 allows remote code execution via a URL variable to an AMI command.

The post CVE-2020-10666 appeared first on CVE Vulnerability.

]]> The restapps (aka Rest Phone apps) module for Sangoma FreePBX and PBXact 13, 14, and 15 through 15.0.19.2 allows remote code execution via a URL variable to an AMI command.

The post CVE-2020-10666 appeared first on CVE Vulnerability.

]]> CVE-2019-25090 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-25090/ Sun, 26 Feb 2023 06:32:51 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-25090/ A vulnerability was found in FreePBX arimanager up to 13.0.5.3 and classified as problematic. Affected by this issue is some unknown functionality of the component Views Handler. The manipulation of the argument dataurl leads to cross site scripting. The attack may be launched remotely. Upgrading to version 13.0.5.4 is able to address this issue. The […]

The post CVE-2019-25090 appeared first on CVE Vulnerability.

]]> A vulnerability was found in FreePBX arimanager up to 13.0.5.3 and classified as problematic. Affected by this issue is some unknown functionality of the component Views Handler. The manipulation of the argument dataurl leads to cross site scripting. The attack may be launched remotely. Upgrading to version 13.0.5.4 is able to address this issue. The name of the patch is 199dea7cc7020d3c469a86a39fbd80f5edd3c5ab. It is recommended to upgrade the affected component. VDB-216878 is the identifier assigned to this vulnerability.

The post CVE-2019-25090 appeared first on CVE Vulnerability.

]]> CVE-2019-19852 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-19852/ Sun, 26 Feb 2023 06:32:13 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-19852/ An XSS Injection vulnerability exists in Sangoma FreePBX and PBXact 13, 14, and 15 within the Call Event Logging report screen in the cel module at the admin/config.php?display=cel URI via date fields. This affects cel through 13.0.26.9, 14.x through 14.0.2.14, and 15.x through 15.0.15.4.

The post CVE-2019-19852 appeared first on CVE Vulnerability.

]]> An XSS Injection vulnerability exists in Sangoma FreePBX and PBXact 13, 14, and 15 within the Call Event Logging report screen in the cel module at the admin/config.php?display=cel URI via date fields. This affects cel through 13.0.26.9, 14.x through 14.0.2.14, and 15.x through 15.0.15.4.

The post CVE-2019-19852 appeared first on CVE Vulnerability.

]]> CVE-2019-19851 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-19851/ Sun, 26 Feb 2023 06:32:13 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-19851/ An XSS Injection vulnerability exists in Sangoma FreePBX and PBXact 13, 14, and 15 within the Debug/Test page of the Superfecta module at the admin/config.php?display=superfecta URI. This affects Superfecta through 13.0.4.7, 14.x through 14.0.24, and 15.x through 15.0.2.20.

The post CVE-2019-19851 appeared first on CVE Vulnerability.

]]> An XSS Injection vulnerability exists in Sangoma FreePBX and PBXact 13, 14, and 15 within the Debug/Test page of the Superfecta module at the admin/config.php?display=superfecta URI. This affects Superfecta through 13.0.4.7, 14.x through 14.0.24, and 15.x through 15.0.2.20.

The post CVE-2019-19851 appeared first on CVE Vulnerability.

]]> CVE-2019-19615 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-19615/ Sun, 26 Feb 2023 06:32:08 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-19615/ Multiple XSS vulnerabilities exist in the Backup & Restore module v14.0.10.2 through v14.0.10.7 for FreePBX, as shown at /admin/config.php?display=backup on the FreePBX Administrator web site. An attacker can modify the id parameter of the backup configuration screen and embed malicious XSS code via a link. When another user (such as an admin) clicks the link, […]

The post CVE-2019-19615 appeared first on CVE Vulnerability.

]]> Multiple XSS vulnerabilities exist in the Backup & Restore module v14.0.10.2 through v14.0.10.7 for FreePBX, as shown at /admin/config.php?display=backup on the FreePBX Administrator web site. An attacker can modify the id parameter of the backup configuration screen and embed malicious XSS code via a link. When another user (such as an admin) clicks the link, the XSS payload will render and execute in the context of the victim user’s account.

The post CVE-2019-19615 appeared first on CVE Vulnerability.

]]> CVE-2019-19552 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-19552/ Sun, 26 Feb 2023 06:32:07 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-19552/ In userman 13.0.76.43 through 15.0.20 in Sangoma FreePBX, XSS exists in the user management screen of the Administrator web site, i.e., the/admin/config.php?display=userman URI. An attacker with sufficient privileges can edit the Display Name of a user and embed malicious XSS code. When another user (such as an admin) visits the main User Management screen, the […]

The post CVE-2019-19552 appeared first on CVE Vulnerability.

]]> In userman 13.0.76.43 through 15.0.20 in Sangoma FreePBX, XSS exists in the user management screen of the Administrator web site, i.e., the/admin/config.php?display=userman URI. An attacker with sufficient privileges can edit the Display Name of a user and embed malicious XSS code. When another user (such as an admin) visits the main User Management screen, the XSS payload will render and execute in the context of the victim user’s account.

The post CVE-2019-19552 appeared first on CVE Vulnerability.

]]>