CVE-2018-14905

The Web server in 3CX version 15.5.8801.3 is vulnerable to Reflected XSS on the api/CallLog TimeZoneName parameter...

CVE-2018-14905

The Web server in 3CX version 15.5.8801.3 is vulnerable to Reflected XSS on the api/CallLog TimeZoneName parameter...

CVE-2018-14906

The Web server in 3CX version 15.5.8801.3 is vulnerable to Reflected XSS on all stack traces' propertyPath parameters...

Cross site scripting

The Web server in 3CX version 15.5.8801.3 is vulnerable to Reflected XSS on the api/CallLog TimeZoneName parameter...

CVE-2018-14905

The Web server in 3CX version 15.5.8801.3 is vulnerable to Reflected XSS on the api/CallLog TimeZoneName parameter...

CVE-2018-14907

The Web server in 3CX version 15.5.8801.3 is vulnerable to Information Leakage, because of improper error handling in Stack traces, as demonstrated by discovering a full pathname...

CVE-2018-14905

3CX Web server (version 15.5.8801.3) is affected by a Reflected XSS vulnerability in the api/CallLog TimeZoneName parameter. The connected CNVD/NVD entries confirm the affected product and vulnerability type but do not provide a remediation patch/version in the supplied documents. The exact root ...

CVE-2018-14906

CVE-2018-14906 affects the 3CX Web server. The vulnerability is a reflected XSS in the stack trace generation, specifically the propertyPath parameter, in 3CX version 15.5.8801.3. The root cause is untrusted input reflected in the web interface, enabling an attacker to inject malicious script/HTM...

CVE-2018-14907

The CVE-2018-14907 vulnerability affects the Web server in 3CX version 15.5.8801.3 . It exposes an information leakage issue caused by improper handling of stack traces, which can reveal a full pathname. The NVD entry lists a PARTIAL confidentiality impact with network access and low exploitation...

WP Live Chat Support < 8.0.08 - Cross-Site Scripting (XSS)

The 3CX Live Chat WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

Path traversal

On 3CX 15.5.6354.2 devices, the parameter "file" in the request "/api/RecordingList/download?file=" allows full access to files on the server via path traversal...

CVE-2018-7654

On 3CX 15.5.6354.2 devices, the parameter "file" in the request "/api/RecordingList/download?file=" allows full access to files on the server via path traversal...

CVE-2018-7654

CVE-2018-7654 affects 3CX devices (reported for version 15.5.6354.2). A path traversal flaw in the file parameter of the request /api/RecordingList/download?file= enables full access to server files. Root cause is a path traversal vulnerability in the download endpoint; detailed exploit status is...

CVE-2018-7654

On 3CX 15.5.6354.2 devices, the parameter "file" in the request "/api/RecordingList/download?file=" allows full access to files on the server via path traversal...

CVE-2017-15359

In the 3CX Phone System 15.5.3554.1, the Management Console typically listens to port 5001 and is prone to a directory traversal attack: "/api/RecordingList/DownloadRecord?file=" and "/api/SupportInfo?file=" are the vulnerable parameters. An attacker must be authenticated to exploit this issue to...

Directory traversal

In the 3CX Phone System 15.5.3554.1, the Management Console typically listens to port 5001 and is prone to a directory traversal attack: "/api/RecordingList/DownloadRecord?file=" and "/api/SupportInfo?file=" are the vulnerable parameters. An attacker must be authenticated to exploit this issue to...

CVE-2017-15359

In the 3CX Phone System 15.5.3554.1, the Management Console typically listens to port 5001 and is prone to a directory traversal attack: "/api/RecordingList/DownloadRecord?file=" and "/api/SupportInfo?file=" are the vulnerable parameters. An attacker must be authenticated to exploit this issue to...

CVE-2017-15359

CVE-2017-15359 affects 3CX Phone System 15.5.3554.1, where the Management Console (typically listening on port 5001) is vulnerable to directory traversal via /api/RecordingList/DownloadRecord?file= and /api/SupportInfo?file=, requiring authentication to exploit. The vulnerability enables an attac...

3CX Phone System < 15.5 Update 2 Directory Traversal Vulnerability

3CX Phone System is prone to a directory traversal attack where an authenticated attacker may read arbitrary files. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

3CX Phone System Detection (HTTP)

HTTP based detection of 3CX Phone System. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.140436"...