Command injection

An Improper Neutralization of Special Elements used in an OS Command issue was discovered in Digium Asterisk GUI 2.1.0 and prior. An OS command injection vulnerability has been identified that may allow the execution of arbitrary code on the system through the inclusion of OS commands in the URL...

CVE-2017-14001

An Improper Neutralization of Special Elements used in an OS Command issue was discovered in Digium Asterisk GUI 2.1.0 and prior. An OS command injection vulnerability has been identified that may allow the execution of arbitrary code on the system through the inclusion of OS commands in the URL...

CVE-2017-14001

CVE-2017-14001 affects Digium Asterisk GUI 2.1.0 and earlier. The vulnerability is an OS command injection due to improper neutralization of special elements in URL requests, enabling an authenticated attacker to execute arbitrary code on the device. According to ICS-CERT, this vulnerability is r...

CVE-2017-14001: Improper Neutralization of Special Elements used in an OS Command

An Improper Neutralization of Special Elements used in an OS Command issue was discovered in Digium Asterisk GUI 2.1.0 and prior. An OS command injection vulnerability has been identified that may allow the execution of arbitrary code on the system through the inclusion of OS commands in the URL...

PT-2017-13194

Name of the Vulnerable Software and Affected Versions Digium Asterisk GUI versions 2.1.0 and prior Description An issue with improper neutralization of special elements used in an OS command was found, which may allow the execution of arbitrary code on the system through the inclusion of OS...

Digium Asterisk GUI OS Command Injection Vulnerability

The Asterisk GUI is a framework for configuring graphical user interfaces. An OS command injection vulnerability exists in Digium Asterisk GUI, which could allow an attacker to execute arbitrary code on a system by injecting OS commands into the program's URL requests...

Digium Asterisk GUI

CVSS v3 8.8 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Digium Equipment: Asterisk GUI Vulnerability: Improper Neutralization of Special Elements used in an OS Command AFFECTED PRODUCTS The following versions of Asterisk GUI, a framework for configuring graphical user...

Digium Asterisk Open Source and Certified Asterisk Session Hijacking Vulnerability

Digium Asterisk Open Source and Certified Asterisk are both open source telephone exchange PBX system software from Digium, Inc. in the United States. The software supports voicemail, multi-party voice conferencing, and interactive voice response IVR. A security vulnerability exists in Asterisk...

CVE-2015-2690

Multiple cross-site scripting XSS vulnerabilities in views/add-license-form.php in the Digium Addons module digiumaddoninstaller before 2.11.0.7 for FreePBX allow remote attackers to inject arbitrary web script or HTML via the 1 addlicensekey, 2 addlicensefirstname, 3 addlicenselastname, 4...

CVE-2015-2690

Multiple cross-site scripting XSS vulnerabilities in views/add-license-form.php in the Digium Addons module digiumaddoninstaller before 2.11.0.7 for FreePBX allow remote attackers to inject arbitrary web script or HTML via the 1 addlicensekey, 2 addlicensefirstname, 3 addlicenselastname, 4...

CVE-2015-2690

CVE-2015-2690 affects FreePBX Digium Addons (digiumaddoninstaller) before 2.11.0.7. Multiple XSS flaws exist in views/add-license-form.php invoked via admin/config.php (type=setup, display=digiumaddons, page=add-license-form, addon=ffa). The attacker can inject script/HTML through any of 12 param...

CVE-2015-2690: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in views/add-license-form.php in the Digium Addons module digiumaddoninstaller before 2.11.0.7 for FreePBX allow remote attackers to inject arbitrary web script or HTML via the 1 addlicensekey, 2 addlicensefirstname, 3 addlicenselastname, 4...

PT-2017-6607

Name of the Vulnerable Software and Affected Versions FreePBX Digium Addons module digiumaddoninstaller versions prior to 2.11.0.7 Description The issue allows remote attackers to inject arbitrary web script or HTML via multiple parameters in an add-license-form page. The vulnerable parameters...

Digium Asterisk pjsip_multipart_parse Denial of Service

A denial of service vulnerability exists in Digium Asterisk. The vulnerability is due to a processing flaw in the pjsipmultipartparse function of sipmultipart.c when the chanpjsip module is used. A remote, unauthenticated attacker could exploit this vulnerability by sending a maliciously crafted...

Digium Asterisk chan_skinny SCCP packet Denial of Service

A denial of service vulnerability exists in Digium Asterisk. The vulnerability is due to a processing flaw in the chanskinny SCCP packet processing module. A remote unauthenticated attacker can exploit this vulnerability by sending a maliciously crafted SCCP packet to a vulnerable Asterisk server...

Digium Asterisk SIP CSeq Heap Buffer Overflow

A heap-based buffer overflow vulnerability exists in Digium Asterisk. The vulnerability is due to a flaw while processing a very long CSeq header in SIP packet where Via header contains no branch parameter. A remote unauthenticated attacker can exploit this vulnerability by sending a crafted...

Denial of Service Vulnerability in Multiple Asterisk Products

Asterisk Certified Asterisk and Asterisk Open Source are products of Digium Corporation, U.S.A. Asterisk Open Source is a suite of open source telephone exchange PBX system software. The software supports voicemail, multi-party voice conferencing, Interactive Voice Response IVR and more. A remote...

Digium Asterisk CDR ast_cdr_setuserfield Buffer Overflow (CVE-2017-16671; CVE-2017-7617)

A buffer overflow exists in the CDR engine of Digium Asterisk. The vulnerability is due to a lack of size checking when setting the user field of a CDR. A remote, authenticated attacker can exploit this vulnerability by sending a crafted message to an affected Asterisk server...

Asterisk Open Source and Certified Asterisk RTP Resource Exhaustion DoS Vulnerability

Asterisk Open Source and Certified Asterisk are prone to a remote denial of service DoS vulnerability. This VT has been deprecated since this check is already covered in SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyrigh...

Asterisk Open Source and Certified Asterisk 'chan_sip' authentication bypass vulnerability

Digium Asterisk Open Source is an open source telephone exchange PBX system software from Digium. The software supports voicemail, multi-party voice conferencing, interactive voice response IVR and so on. A security vulnerability exists in Digium Asterisk Open Source. An attacker could exploit th...