HIPAA Compliance and Call Centers

In a previous post titled Is It Safe to Speak? Protection for Telephone-Based Payment Card Data, I commented on the PCI SSC new requirements for call center operations and recording systems. Call center security has been a hot topic for a long time. How safe is the information that is given over...

Six ways your phone can be illegally tapped !

Phone tapping in India has become a national concern with a leading operator revealing that at peak there are upto 100 phone tapping requests a day. In India there are ten major operators, at a conservative average of 50 taps a day per operator, there would be 182,000 authorized phone taps each...

FreePBX Recording Interface File Upload Code Execution (CVE-2010-3490)

FreePBX is an open source software implementation of a telephone Private Branch eXchange PBX. It allows a number of attached telephones to make calls to one another, and to connect to other telephone services including the public switched telephone network. A code execution vulnerability exists i...

CVE-2010-2718

Multiple cross-site scripting XSS vulnerabilities in CruxSoftware CruxPA 2.00, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the 1 txtusername parameter to login.php, 2 todo parameter to newtodo.php, and unspecified vectors to 3 newtelephone.php and 4...

Buffer overflow

Cisco Unified Communications Manager aka CUCM, formerly CallManager 6.x before 6.15, 7.x before 7.13bSU2, and 8.x before 8.01 allows remote attackers to cause a denial of service process failure via a malformed SIP REG message, related to an overflow of the Telephone-URL field, aka Bug ID...

CVE-2010-0591

Cisco Unified Communications Manager aka CUCM, formerly CallManager 6.x before 6.15, 7.x before 7.13bSU2, and 8.x before 8.01 allows remote attackers to cause a denial of service process failure via a malformed SIP REG message, related to an overflow of the Telephone-URL field, aka Bug ID...

CVE-2010-0591: Undefined Security Weakness

Cisco Unified Communications Manager aka CUCM, formerly CallManager 6.x before 6.15, 7.x before 7.13bSU2, and 8.x before 8.01 allows remote attackers to cause a denial of service process failure via a malformed SIP REG message, related to an overflow of the Telephone-URL field, aka Bug ID...

CVE-2009-4196

Multiple cross-site scripting XSS vulnerabilities in multiple scripts in Forms/ in Huawei MT882 V100R002B020 ARG-T running firmware 3.7.9.98 allow remote attackers to inject arbitrary web script or HTML via the 1 BackButton parameter to error1; 2 wzConnFlag parameter to freshpppoe1; 3...

CVE-2008-7180

CVE-2008-7180 affects Telephone Directory 2008 due to a flaw in del_query1.php that allows remote attackers to delete arbitrary contacts by sending a direct request with a modified id value. This leads to unauthorized modification of data (partial integrity impact) without authentication, as indi...

CVE-2008-7180: Improper Input Validation

delquery1.php in Telephone Directory 2008 allows remote attackers to delete arbitrary contacts via a direct request with a modified id variable...

Absolute Software Computrace LoJack for Laptops安全绕过漏洞

Bugraq ID: 35889 Absolute Software Computrace LoJack for Laptop是一款笔记本防盗解决方案，笔记本被偷后可向监听中心提供笔记本的IP地址或者电话号码。 程序存在安全绕过问题，攻击者可以方便的修改配置，控制应用程序的通信到恶意IP或URL，导致未授权的负载直接定向到笔记本电脑上。 目前没有详细的漏洞细节提供。 Absolute Software Computrace LoJack for Laptops 目前没有详细解决方案提供： http://www.absolute.com/...

Exploiting Skype: Building a telephone botnet

From the Industry Standard Robert McMillan Flaws in popular Internet-based telephony systems could be exploited to create a network of hacked phone accounts, somewhat like the botnets that have been wreaking havoc with PCs for the past few years. Researchers at Secure Science recently discovered...

CVE-2008-2677

Cross-site scripting XSS vulnerability in edit1.php in Telephone Directory 2008 allows remote attackers to inject arbitrary web script or HTML via the action parameter...

Sql injection

Multiple SQL injection vulnerabilities in Telephone Directory 2008, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 code parameter in a confirmdata action to edit1.php and the 2 id parameter to viewmore.php...

Cross site scripting

Cross-site scripting XSS vulnerability in edit1.php in Telephone Directory 2008 allows remote attackers to inject arbitrary web script or HTML via the action parameter...

CVE-2008-2678

Multiple SQL injection vulnerabilities in Telephone Directory 2008, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 code parameter in a confirmdata action to edit1.php and the 2 id parameter to viewmore.php...

CVE-2008-2677

CVE-2008-2677 describes a cross-site scripting (XSS) vulnerability in the Telephone Directory 2008 product, specifically in edit1.php where the action parameter can be abused to inject arbitrary web script or HTML. The included sources consistently state that remote attackers can leverage this fl...

CVE-2008-2677

Cross-site scripting XSS vulnerability in edit1.php in Telephone Directory 2008 allows remote attackers to inject arbitrary web script or HTML via the action parameter...

CVE-2008-2678

The CVE-2008-2678 issue affects Telephone Directory 2008. It exposes multiple SQL injection vulnerabilities when magic_quotes_gpc is disabled, allowing remote attackers to modify the database via the (1) code parameter in edit1.php (confirm_data action) and (2) id parameter in view_more.php. The ...

CVE-2008-2678

Multiple SQL injection vulnerabilities in Telephone Directory 2008, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 code parameter in a confirmdata action to edit1.php and the 2 id parameter to viewmore.php...