trixbox maint Web Interface Default Credentials

The remote web server hosts the web interface for trixbox or Asterisk@Home, as it was formerly known, a PBX application based on Asterisk. The remote installation of this web interface has at least one account configured using default credentials. With this information, an attacker can gain...

trixbox Cisco Phone Services PhoneDirectory.php ID Parameter SQL Injection

The version of the Cisco Phone Services phone directory script 'cisco/services/PhoneDirectory.php' installed as part of the web interface for trixbox or Asterisk@Home, as it was formerly known and hosted on the remote web server fails to sanitize input to the 'ID' parameter before using it in a...

CVE-2006-2021

Absolute path traversal vulnerability in recordings/misc/audio.php in the Asterisk Recording Interface ARI web interface in Asterisk@Home before 2.8 allows remote attackers to read arbitrary MP3, WAV, and GSM files via a full pathname in the recording parameter. NOTE: this issue can also be used ...

Path traversal

Absolute path traversal vulnerability in recordings/misc/audio.php in the Asterisk Recording Interface ARI web interface in Asterisk@Home before 2.8 allows remote attackers to read arbitrary MP3, WAV, and GSM files via a full pathname in the recording parameter. NOTE: this issue can also be used ...

CVE-2006-2020

Asterisk Recording Interface ARI in Asterisk@Home before 2.8 stores recordings/includes/main.conf under the web document root with insufficient access control, which allows remote attackers to obtain password information...

CVE-2006-2020

Asterisk Recording Interface ARI in Asterisk@Home before 2.8 stores recordings/includes/main.conf under the web document root with insufficient access control, which allows remote attackers to obtain password information...

CVE-2006-2021

CVE-2006-2021 is an absolute path traversal vulnerability in the Asterisk Recording Interface (ARI) web UI, specifically in recordings/misc/audio.php of Asterisk@Home before 2.8. An unauthenticated attacker can supply a full pathname in the recording parameter to read arbitrary MP3, WAV, and GSM ...

CVE-2006-2021: Undefined Security Weakness

Absolute path traversal vulnerability in recordings/misc/audio.php in the Asterisk Recording Interface ARI web interface in Asterisk@Home before 2.8 allows remote attackers to read arbitrary MP3, WAV, and GSM files via a full pathname in the recording parameter. NOTE: this issue can also be used ...

CVE-2006-2020: Undefined Security Weakness

Asterisk Recording Interface ARI in Asterisk@Home before 2.8 stores recordings/includes/main.conf under the web document root with insufficient access control, which allows remote attackers to obtain password information...