CVE-2017-14537

trixbox 2.8.0.4 has path traversal via the xajaxargs array parameter to /maint/index.php?packages or the lang parameter to /maint/modules/home/index.php...

Path traversal

trixbox 2.8.0.4 has path traversal via the xajaxargs array parameter to /maint/index.php?packages or the lang parameter to /maint/modules/home/index.php...

Code injection

trixbox 2.8.0.4 has XSS via the PATHINFO to /maint/index.php or /user/includes/language/langChooser.php...

CVE-2017-14536

trixbox 2.8.0.4 has XSS via the PATHINFO to /maint/index.php or /user/includes/language/langChooser.php...

CVE-2017-14535

trixbox 2.8.0.4 has OS command injection via shell metacharacters in the lang parameter to /maint/modules/home/index.php...

CVE-2017-14537

trixbox 2.8.0.4 has path traversal via the xajaxargs array parameter to /maint/index.php?packages or the lang parameter to /maint/modules/home/index.php...

CVE-2017-14535

trixbox 2.8.0.4 has OS command injection via shell metacharacters in the lang parameter to /maint/modules/home/index.php...

CVE-2017-14536

CVE-2017-14536 affects the trixbox 2.8.0.4 release and is a cross-site scripting (XSS) vulnerability triggered via PATH_INFO to /maint/index.php or /user/includes/language/langChooser.php. The available data describe the vulnerability as an XSS flaw without details on exploitation steps, affected...

CVE-2017-14537

Trixbox 2.8.0.4 is vulnerable to a path traversal vulnerability. The issue is triggered via the xajaxargs array parameter directed at /maint/index.php?packages or through the lang parameter directed at /maint/modules/home/index.php. Successful exploitation could allow an attacker to read arbitrar...

CVE-2017-14537

trixbox 2.8.0.4 has path traversal via the xajaxargs array parameter to /maint/index.php?packages or the lang parameter to /maint/modules/home/index.php...

CVE-2017-14535

CVE-2017-14535 affects Trixbox 2.8.0.4, vulnerable to an OS command-injection via shell metacharacters in the lang parameter of /maint/modules/home/index.php. The root cause is improper handling of input in this parameter, enabling remote command execution. Documented impact states successful exp...

CVE-2017-14536

trixbox 2.8.0.4 has XSS via the PATHINFO to /maint/index.php or /user/includes/language/langChooser.php...

CVE-2017-14535

trixbox 2.8.0.4 has OS command injection via shell metacharacters in the lang parameter to /maint/modules/home/index.php...

PT-2018-5681

Name of the Vulnerable Software and Affected Versions: trixbox version 2.8.0.4 Description: The issue is related to a security problem where an attacker can execute malicious scripts in the browser of other users, potentially leading to unauthorized actions. This is achieved by manipulating the...

PT-2018-5680

Name of the Vulnerable Software and Affected Versions: trixbox version 2.8.0.4 Description: The issue is related to OS command injection via shell metacharacters in the lang parameter to the "/maint/modules/home/index.php" API endpoint. This allows for potential exploitation. Recommendations: For...

PT-2018-5682

Name of the Vulnerable Software and Affected Versions: trixbox version 2.8.0.4 Description: The issue concerns path traversal via the xajaxargs array parameter to "/maint/index.php?packages" or the lang parameter to "/maint/modules/home/index.php". Recommendations: For trixbox version 2.8.0.4,...

CVE-2017-14537: Improper Limitation of a Pathname to a Restricted Directory

trixbox 2.8.0.4 has path traversal via the xajaxargs array parameter to /maint/index.php?packages or the lang parameter to /maint/modules/home/index.php...

CVE-2017-14536: Improper Neutralization of Input During Web Page Generation

trixbox 2.8.0.4 has XSS via the PATHINFO to /maint/index.php or /user/includes/language/langChooser.php...

CVE-2017-14535: Improper Neutralization of Special Elements used in an OS Command

trixbox 2.8.0.4 has OS command injection via shell metacharacters in the lang parameter to /maint/modules/home/index.php...

CVE-2016-2364

The Chrome HUDweb plugin before 2016-05-05 for Fonality previously trixbox Pro 12.6 through 14.1i uses the same hardcoded private key across different customers' installations, which allows remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of this key from...