CMS MaeloStore Cross-Site Scripting Vulnerability

CMS MaeloStore is a PHP and MySQL based Content Management System CMS for web publishing and product catalogs. A cross-site scripting vulnerability exists in the Telephone field of the admin interface in CMS MaeloStore version 1.5.0. A remote attacker can exploit this vulnerability to inject...

CVE-2018-12992

An issue was discovered CMS MaeloStore V.1.5.0. There is stored XSS in the Telephone field of the admin interface...

Cross site scripting

An issue was discovered CMS MaeloStore V.1.5.0. There is stored XSS in the Telephone field of the admin interface...

CVE-2018-12992

An issue was discovered CMS MaeloStore V.1.5.0. There is stored XSS in the Telephone field of the admin interface...

CVE-2018-12992

An issue was discovered CMS MaeloStore V.1.5.0. There is stored XSS in the Telephone field of the admin interface...

PT-2018-11521

Name of the Vulnerable Software and Affected Versions CMS MaeloStore version 1.5.0 Description An issue was discovered in the admin interface of CMS MaeloStore, where there is a stored XSS in the Telephone field. Recommendations For CMS MaeloStore version 1.5.0, consider restricting access to the...

CVE-2018-12992: Improper Neutralization of Input During Web Page Generation

An issue was discovered CMS MaeloStore V.1.5.0. There is stored XSS in the Telephone field of the admin interface...

AXON PBX 2.02 Cross-Site Scripting Vulnerability

AXON PBX is a suite of virtual telephone exchange software for use in business environments. The software is mainly used to manage telephone call centers and implements the functions of a telephone exchange in a software way. A cross-site scripting vulnerability exists in AXON PBX version 2.02,...

Digium Asterisk Open Source and Certified Asterisk Denial of Service Vulnerabilities (CNVD-2018-19592)

Asterisk Open Source and Certified Asterisk are both open source telephone switch PBX system software from Digium, Inc. in the United States. The software supports voicemail, multi-party voice conferencing, and interactive voice response IVR. Asterisk Open Source and Certified Asterisk have a...

CVE-2018-9010

Intelbras TELEFONE IP TIP200/200 LITE (firmware 60.0.75.29) is affected by an absolute path traversal via the /cgi-bin/cgiServer.exx parameter, allowing remote authenticated admins to read arbitrary files. Some entries note possible authentication via a default admin password. No remediation deta...

A cure for the common cold call: freeze them out

The phone rings and it's a number I don’t recognize. That’s enough to bring my mood down a few degrees. It shouldn’t, but unfortunately experience has taught me that at least 95 percent of the calls from numbers that are “private” or that I don’t have an account name stored for on my phone are...

JVN#87403477: Application and self-extracting archive containing the application of "FLET'S v4 / v6 address selection tool" may insecurely load Dynamic Link Libraries

Application and self-extracting archive containing the application of "FLET'S v4 / v6 address selection tool" provided by NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Impact Arbitra...

JVN#04564808: Installer of ”FLET'S Azukeru Backup Tool” may insecurely load Dynamic Link Libraries

"FLET'S Azukeru Backup Tool" provided by NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION is software to automatically back up files in the user's computer to "FLET'S Azukeru" service. Installer of "FLET'S Azukeru Backup Tool" contains an issue with the DLL search path, which may lead to insecurel...

JVN#26255241: The installer of "FLET'S VIRUS CLEAR Easy Setup & Application Tool" and "FLET'S VIRUS CLEAR v6 Easy Setup & Application Tool" may insecurely load Dynamic Link Libraries

The installer of "FLET'S VIRUS CLEAR Easy Setup & Application Tool" and "FLET'S VIRUS CLEAR v6 Easy Setup & Application Tool" provided by NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. Impact...

Good News from Singapore

The IETF had its 100th meeting the week of November 13. It was held in Singapore. I want to report on two pieces of good news. The first is that it seems like TLS 1.3 is ready to advance through the IETF process. As I wrote last month, the problem was that outdated or buggy network devices betwee...

JVN#73141967: PWR-Q200 vulnerable to DNS cache poisoning attacks

PWR-Q200 provided by NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION is a mobile WiFi router. PWR-Q200 is vulnerable to DNS cache poisoning attacks as DNS queries are done with a fixed source port CWE-330. Impact The DNS responses spoofed by a remote attacker may result in any device on the LAN...

JVN#97243511: Installer of ”Flets Easy Setup Tool" may insecurely load Dynamic Link Libraries

Installer of "Flets Easy Setup Tool" provided by NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Impact Arbitrary code may be executed with the privilege of the user invoking the...

Security Setup Tool Untrusted Search Path Vulnerability

Security Setup Tool is a security setup tool from NIPPON TELEGRAPH AND TELEPHONE WEST, Japan. An untrusted search path vulnerability exists in Security Setup Tool. The vulnerability can be exploited by a remote attacker to gain privileges via a malicious DLL file in a directory...

DEBIAN-CVE-2017-14098

In the pjsip channel driver respjsip in Asterisk 13.x before 13.17.1 and 14.x before 14.6.1, a carefully crafted tel URI in a From, To, or Contact header could cause Asterisk to crash...

JVN#26115441: Installer of ”Remote Support Tool (Enkaku Support Tool)” may insecurely load Dynamic Link Libraries

Installer of ”Remote Support Tool Enkaku Support Tool” provided by NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION and NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Impact Arbitrary...