CVE-2008-4874: Undefined Security Weakness

The web component in Philips Electronics VOIP841 DECT Phone with firmware 1.0.4.50 and 1.0.4.80 has a back door "service" account with "service" as its password, which makes it easier for remote attackers to obtain access...

Avaya IP Office Phone Manager Local Password Disclosure Exploit

No description provided by source. include windows.h include stdio.h include string.h / Filename: exploit.c Title: Avaya IP Office Phone Manager - Cleartext Sensitive Data Vulnerability Exploit v0.01 Author: pagvac Adrian Pastor Date: 24th Feb, 2005 Other info: tested on version 2.013. Compile as...

Hitachi IP Phone Detection

Binary data 4683.prm...

Default Password (000000) for 'admin' on WIP5000 IP Phone

The remote host is a WIP5000 VOIP phone. The remote host has the default password set for the 'admin' user '000000'. An attacker may connect to it and reconfigure it using this account. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid34217; scriptversion"1.15";...

Default Password (0000) for 'user' on WIP5000 IP Phone

The remote host is a WIP5000 VOIP phone. The remote host has the default password set for the 'user' user '0000'. An attacker may connect to it and get useful information about the phone book of the remote phone using this account. C Tenable Network Security, Inc. include"compat.inc"; if...

DEBIAN-CVE-2008-3903

Asterisk Open Source 1.2.x before 1.2.32, 1.4.x before 1.4.24.1, and 1.6.0.x before 1.6.0.8; Asterisk Business Edition A.x.x, B.x.x before B.2.5.8, C.1.x.x before C.1.10.5, and C.2.x.x before C.2.3.3; s800i 1.3.x before 1.3.0.2; and Trixbox PBX 2.6.1, when Digest authentication and authalwaysreje...

false vulnerability report

Hi As the author, I would like to request a removal of one of my vulnerability articles. http://securityvulns.com/Udocument99.html The reason for this is because I've recently tested the "exploit" on other palm centro phones, and the exploit would not work for them. It seems to only work on my...

Yayoi Kaikei improper handling of credential information

Overview Yayoi Kaikei Quick Navigator sends user credentials unencrypted. Yayoi Kaikei Quick Navigator makes the user log into the vendor's server, and sends the user credentials unencrypted. Impact By monitoring the communication between Quick Navigator and the vendor's server, an attacker can...

Code injection

Linksys SPA-2102 Phone Adapter 3.3.6 allows remote attackers to cause a denial of service crash via a long ping packet "ping of death". NOTE: the severity of this issue has been disputed since there are limited attack scenarios...

CVE-2008-2092

The CVE-2008-2092 issue affects the Linksys SPA-2102 Phone Adapter with firmware 3.3.6, where a remote attacker can cause a denial-of-service (crash) by sending a long ping packet (ping of death) over the network. The available records state this is a network-facing flaw with high impact (CVSS v2...

CVE-2008-2092: Undefined Security Weakness

Linksys SPA-2102 Phone Adapter 3.3.6 allows remote attackers to cause a denial of service crash via a long ping packet "ping of death". NOTE: the severity of this issue has been disputed since there are limited attack scenarios...

Linksys SPA-2102 wireless IP phones DoS

Large ICMP packets cause device to crash...

Memory corruption

snomControl.swf in the central phone server for the Snom 320 SIP Phone allows remote attackers to cause a denial of service application crash and corruption of call logs via a "'; double quote, quote, close parenthesis, semicolon sequence in the "Call a number" field...

CVE-2008-1248

The web interface on the central phone server for the Snom 320 SIP Phone allows remote attackers to make arbitrary phone calls via the "Call a number" field. NOTE: this might overlap CVE-2007-3440...

CVE-2008-1249

snomControl.swf in the central phone server for the Snom 320 SIP Phone allows remote attackers to cause a denial of service application crash and corruption of call logs via a "'; double quote, quote, close parenthesis, semicolon sequence in the "Call a number" field...

CVE-2008-1250

Multiple cross-site request forgery CSRF vulnerabilities in the web interface on the central phone server for the Snom 320 SIP Phone allow remote attackers to perform actions as the phone user, as demonstrated by inserting an address-book entry containing an XSS sequence...

CVE-2008-1251

Cross-site scripting XSS vulnerability in the web interface on the central phone server for the Snom 320 SIP Phone allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the web interface on the central phone server for the Snom 320 SIP Phone allow remote attackers to perform actions as the phone user, as demonstrated by inserting an address-book entry containing an XSS sequence...

Cross site scripting

Cross-site scripting XSS vulnerability in the web interface on the central phone server for the Snom 320 SIP Phone allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Design/Logic Flaw

The web interface on the central phone server for the Snom 320 SIP Phone allows remote attackers to make arbitrary phone calls via the "Call a number" field. NOTE: this might overlap CVE-2007-3440...