CVE-2015-0670

The default configuration of Cisco Small Business IP phones SPA 300 7.5.5 and SPA 500 7.5.5 does not properly support authentication, which allows remote attackers to read audio-stream data or originate telephone calls via a crafted XML request, aka Bug ID CSCuo52482...

CVE-2015-0670

Cisco Small Business SPA300 and SPA500 IP phones running firmware version 7.5.5 are affected by CVE-2015-0670 due to improper authentication in the default configuration. A crafted XML request can allow an unauthenticated remote attacker to read audio-stream data or originate telephone calls. The...

Cisco Small Business SPA300 and SPA500 Series IP Phones Unauthenticated Remote Dial Vulnerability

A vulnerability in the firmware of the Cisco Small Business SPA 300 and 500 series IP phones could allow an unauthenticated, remote attacker to listen to the audio stream of an IP phone. The vulnerability is due to improper authentication settings in the default configuration. An attacker could...

LG On Screen Phone authentication bypass (CVE-2014-8757)

LG On Screen Phone authentication bypass vulnerability ------------------------------------------------------ SEARCH-LAB Ltd. discovered a serious security vulnerability in the On Screen Phone protocol used by LG Smart Phones. A malicious attacker is able to bypass the authentication phase of the...

Code injection

The mobility extension on Cisco Unified IP 9900 phones with firmware 9.4.1 and earlier allows remote attackers to obtain sensitive information by sniffing the network, aka Bug ID CSCuq12117...

CVE-2015-0601

Cisco Unified IP 9900 phones with firmware 9.4.1 and earlier allow local users to cause a denial of service device reload via crafted commands, aka Bug ID CSCup92790...

CVE-2015-0601

CVE-2015-0601 affects Cisco Unified IP Phone 9900 Series, with firmware 9.4(.1) and earlier. The vulnerability stems from insufficient input validation in processing crafted commands, allowing an authenticated local attacker to cause a denial of service (device reload). Impact is restricted to lo...

Cisco Unified IP Phones 9900 Series Local Denial of Service Vulnerability (CNVD-2015-00921)

Cisco Unified IP Phone 9900 is a 9900 series IP phone terminal equipment from Cisco USA. The device provides voice, video, and other features. A local denial of service vulnerability exists in the Cisco Unified IP Phones 9900 Series, which can be exploited by a local attacker to reload the affect...

Cisco Unified IP Phones 9900 Series Local Denial of Service Vulnerability (CNVD-2015-00920)

Cisco Unified IP Phone 9900 is a 9900 series IP phone terminal equipment from Cisco USA. The device provides voice, video, and other features. A security vulnerability exists in the Cisco Unified IP Phone 9900 Series. A local attacker could exploit this vulnerability to cause a denial of service...

Cisco Unified IP Phones 9900 Series Arbitrary File Upload Vulnerability

Cisco Unified IP Phone 9900 is a 9900 series IP phone terminal equipment from Cisco USA. The device provides voice, video, and other features. An arbitrary file upload vulnerability exists in the Cisco Unified IP Phones 9900 Series, which could be exploited by an attacker to upload arbitrary file...

Snom IP Phones has multiple vulnerabilities

Snom IP Phones is an IP phone system. Snom IP Phones suffers from multiple cross-site scripting vulnerabilities, HTML injection vulnerabilities, directory traversal vulnerabilities, command execution vulnerabilities, authentication bypass vulnerabilities, multiple cross-site request forgery...

Snom IP Phones - Multiple Vulnerabilities

Snom IP phones with firmware versions prior to 8.7.5.15 suffer from authentication bypass, command execution, cross site request forgery, cross site scripting, privilege escalation, and directory traversal vulnerabilities. title: Multiple critical vulnerabilities product: snom IP phones vulnerabl...

Multiple snom IP phones vulnerabilities

Crossite scripting, CSRF, directory traversal, authentication bypass, privilege escalation, code execution, backdoor access...

SEC Consult SA-20150113-0 :: Multiple critical vulnerabilities in all snom desktop IP phones

SEC Consult Vulnerability Lab Security Advisory 20150113-0 ======================================================================= title: Multiple critical vulnerabilities product: snom IP phones vulnerable version: all firmware versions 8.7.5.15, all firmware branches of all snom desktop IP phon...

Snom IP Phones XSS / CSRF / Traversal / Escalation / Command Execution

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple critical vulnerabilities product: snom IP phones vulnerable version: all firmware versions 8.7.5.15, all firmware branches of all snom desktop IP phones 3xx, 7xx...

AirHopper Steals Data From Air-Gapped Computers

Air-gapped computers are generally the home of sacrosanct data. The lack of a connection between these machines and others on a network, or the Internet, means in theory that data stored on those devices is kept away from the harm of web-based threats and hackers moving laterally on a network...

CVE-2012-1417

Multiple cross-site scripting XSS vulnerabilities in Local Phone book and Blacklist form in Yealink VOIP Phones allow remote authenticated users to inject arbitrary web script or HTML via the user field to cgi-bin/ConfigManApp.com...

CVE-2012-1417

CVE-2012-1417 maps to multiple cross-site scripting vulnerabilities in Yealink VOIP Phones (Local Phone Book and Blacklist form). Root cause: unsanitized or improperly neutralized user input via the CGI path (ConfigManApp.com) allows injected scripts to be executed in the target user’s browser. I...

Android Browser Same Origin Policy Bypass Vulnerability

A SOP bypass occurs when a sitea.com is some how able to access the properties of siteb.com such as cookies, location, response etc. Due to the nature of the issue and potential impact, this is very rarely found in modern browsers. However, they are found once in a while. Vulnerability: Android...

Crlf injection

CRLF injection vulnerability in Yealink VoIP Phones with firmware 28.72.0.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the model parameter to servlet...