PT-2019-15749

Name of the Vulnerable Software and Affected Versions Sangoma FreePBX versions 15.0.16.26 and below Sangoma FreePBX versions 14.0.13.11 and below Sangoma FreePBX versions 13.0.197.13 and below Description The issue concerns Incorrect Access Control in Sangoma FreePBX, which has been exploited by...

FreePBX Contactmanager Cross-Site Scripting Vulnerability

FreePBX formerly known as Asterisk Management Portal is the FreePBX project's set of tools for configuring Asterisk IP telephony system through a GUI web-based graphical interface. contactmanager is one of the contact management components used in it. A cross-site scripting vulnerability exists i...

FreePBX Cross-Site Scripting Vulnerability (CNVD-2019-37883)

FreePBX formerly known as Asterisk Management Portal is a set of tools from the FreePBX project for configuring Asterisk IP telephony system through a GUI web-based graphical interface. A cross-site scripting vulnerability exists in Manager in FreePBX, versions 13.x prior to 13.0.2.6 and 15.x pri...

CVE-2019-16967

An issue was discovered in Manager 13.x before 13.0.2.6 and 15.x before 15.0.6 before FreePBX 14.0.10.3. In the Manager module form html\admin\modules\manager\views\form.php, an unsanitized managerdisplay variable coming from the URL is reflected in HTML, leading to XSS. It can be requested via G...

CVE-2019-16967

An issue was discovered in Manager 13.x before 13.0.2.6 and 15.x before 15.0.6 before FreePBX 14.0.10.3. In the Manager module form html\admin\modules\manager\views\form.php, an unsanitized managerdisplay variable coming from the URL is reflected in HTML, leading to XSS. It can be requested via G...

Hardcoded credentials

An issue was discovered in Manager 13.x before 13.0.2.6 and 15.x before 15.0.6 before FreePBX 14.0.10.3. In the Manager module form html\admin\modules\manager\views\form.php, an unsanitized managerdisplay variable coming from the URL is reflected in HTML, leading to XSS. It can be requested via G...

CVE-2019-16966

An issue was discovered in Contactmanager 13.x before 13.0.45.3, 14.x before 14.0.5.12, and 15.x before 15.0.8.21 for FreePBX 14.0.10.3. In the Contactmanager class html\admin\modules\contactmanager\Contactmanager.class.php, an unsanitized group variable coming from the URL is reflected in HTML o...

CVE-2019-16966

An issue was discovered in Contactmanager 13.x before 13.0.45.3, 14.x before 14.0.5.12, and 15.x before 15.0.8.21 for FreePBX 14.0.10.3. In the Contactmanager class html\admin\modules\contactmanager\Contactmanager.class.php, an unsanitized group variable coming from the URL is reflected in HTML o...

Cross site scripting

An issue was discovered in Contactmanager 13.x before 13.0.45.3, 14.x before 14.0.5.12, and 15.x before 15.0.8.21 for FreePBX 14.0.10.3. In the Contactmanager class html\admin\modules\contactmanager\Contactmanager.class.php, an unsanitized group variable coming from the URL is reflected in HTML o...

CVE-2019-16967

The CVE affects FreePBX Manager: versions 13.x before 13.0.2.6 and 15.x before 15.0.6 (prior to FreePBX 14.0.10.3). The vulnerability is a reflected XSS in the Manager module form (html/admin/modules/manager/views/form.php) due to an unsanitized managerdisplay value from the URL, exposed via GET ...

CVE-2019-16966

CVE-2019-16966 affects FreePBX Contactmanager components prior to specific fixed versions: Contactmanager 13.x before 13.0.45.3, 14.x before 14.0.5.12, and 15.x before 15.0.8.21. The vulnerability arises from an unsanitized group variable from the URL reflected in HTML in two places within Contac...

CVE-2019-16966

An issue was discovered in Contactmanager 13.x before 13.0.45.3, 14.x before 14.0.5.12, and 15.x before 15.0.8.21 for FreePBX 14.0.10.3. In the Contactmanager class html\admin\modules\contactmanager\Contactmanager.class.php, an unsanitized group variable coming from the URL is reflected in HTML o...

FreePBX < 13.0.122.43, < 14.0.18.34 XSS Vulnerability

FreePBX is prone to a stored cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

FreePBX Cross-Site Scripting Vulnerability

FreePBX formerly known as Asterisk Management Portal is a set of tools from the FreePBX project for configuring Asterisk IP telephony system through a GUI web-based graphical interface. A cross-site scripting vulnerability exists in FreePBX versions prior to 3.0.122.43, 14.0.18.34 and 5.0.1beta4...

CVE-2018-15891

An issue was discovered in FreePBX core before 3.0.122.43, 14.0.18.34, and 5.0.1beta4. By crafting a request for adding Asterisk modules, an attacker is able to store JavaScript commands in a module name...

CVE-2018-15892

FreePBX 13 and 14 has SQL Injection in the DISA module via the hangup variable on the /admin/config.php?display=disa&view=form page...

CVE-2018-15892

FreePBX 13 and 14 has SQL Injection in the DISA module via the hangup variable on the /admin/config.php?display=disa&view=form page...

CVE-2018-15891

An issue was discovered in FreePBX core before 3.0.122.43, 14.0.18.34, and 5.0.1beta4. By crafting a request for adding Asterisk modules, an attacker is able to store JavaScript commands in a module name...

Sql injection

FreePBX 13 and 14 has SQL Injection in the DISA module via the hangup variable on the /admin/config.php?display=disa&view=form page...

Design/Logic Flaw

An issue was discovered in FreePBX core before 3.0.122.43, 14.0.18.34, and 5.0.1beta4. By crafting a request for adding Asterisk modules, an attacker is able to store JavaScript commands in a module name...