157 matches found
3CX Phone System VAD_Deploy.aspx Arbitrary File Upload
An arbitrary file upload vulnerability exists in 3CX VoIP Phone System Manager. The vulnerability is due to failure to restrict file uploads in VADDeploy.aspx. A remote unauthenticated attacker can exploit this vulnerability by sending maliciously crafted requests to the target server...
WP Live Chat Support < 6.2.04 - Stored Cross-Site Scripting (XSS)
The 3CX Live Chat WordPress plugin was affected by a Stored Cross-Site Scripting XSS security vulnerability...
WP Live Chat Support < 6.2.02 - Stored Cross-Site Scripting
The 3CX Live Chat WordPress plugin was affected by a Stored Cross-Site Scripting security vulnerability...
WP Live Chat Support < 4.4.0 - Unauthenticated Blind SQL Injection
The 3CX Live Chat WordPress plugin was affected by an Unauthenticated Blind SQL Injection security vulnerability...
VULNERABLE and COMPLETELY outdated 3rd-party libraries/components used in 3CX Phone 6
Hi @ll, the current 3CXPhone6.msi for Windows, available from http://www.3cx.com/VOIP/sip-phone/, digitally signed on 2012-07-30, installs the following outdated and vulnerable 3rd-party libraries: libeay32.dll and ssleay32.dll version 0.9.8h from 2008-05-28 of OpenSSL. The current version of...
3CX Phone outdated libraries
Outdated versions of OpenSSL and FFmpeg/FFdshow are used...
3CX Phone System login.php Multiple Parameter XSS
3CX Phone System for Windows, a software-based IP PBX, is installed on the remote host. The installed version fails to sanitize input to the 'fName' and 'fPassword' parameters in 'login.php' before using it to generate an HTML response dynamically. An unauthenticated remote attacker may be able t...
CVE-2008-6896
login.php in 3CX Phone System 6.0.806.0, when 100% disk capacity is reached, allows remote attackers to gain sensitive information via unspecified vectors that reveal the installation path...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in login.php in 3CX Phone System Free Edition 6.1793 and 6.0.806.0 allow remote attackers to inject arbitrary web script or HTML via the 1 fName and 2 fPassword parameters...
Path traversal
login.php in 3CX Phone System 6.0.806.0, when 100% disk capacity is reached, allows remote attackers to gain sensitive information via unspecified vectors that reveal the installation path...
CVE-2008-6895
3CX Phone System 6.0.806.0 allows remote attackers to cause a denial of service unstable service or crash via unspecified vectors, as demonstrated by vulnerability scans from Nessus or SAINT...
CVE-2008-6894
3CX Phone System for Windows (Free Edition) versions 6.1793 and 6.0.806.0 are affected by multiple XSS in login.php, exploitable via the fName and fPassword parameters. The underlying issue is insufficient input sanitization that allows an unauthenticated remote attacker to inject arbitrary HTML/...
CVE-2008-6895
CVE-2008-6895 affects 3CX Phone System 6.0.806.0. The vulnerability enables remote attackers to cause a denial of service (unstable service or crash) via unspecified vectors, as demonstrated by Nessus/SAINT scans. The NVD metrics show a CVSSv2 base score of 7.8 (HIGH) with network access, no auth...
CVE-2008-6895
3CX Phone System 6.0.806.0 allows remote attackers to cause a denial of service unstable service or crash via unspecified vectors, as demonstrated by vulnerability scans from Nessus or SAINT...
CVE-2008-6896
CVE-2008-6896 affects the 3CX Phone System (version 6.0.806.0). When disk usage reaches 100%, remote attackers can obtain sensitive information that reveals the installation path through unspecified vectors. The exact root cause is not detailed in the provided documents. Impact is described as pa...
CVE-2008-6894
Multiple cross-site scripting XSS vulnerabilities in login.php in 3CX Phone System Free Edition 6.1793 and 6.0.806.0 allow remote attackers to inject arbitrary web script or HTML via the 1 fName and 2 fPassword parameters...