180 matches found
CVE-2021-35377
Cross Site Scripting vulnerability found in VICIdial v2.14-610c and v.2.10-415c allows attackers execute arbitrary code via the /agc/vicidial.php, agc/vicidial-greay.php, and /vicidial/KHOMPadmin.php parameters...
CVE-2021-35377: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting vulnerability found in VICIdial v2.14-610c and v.2.10-415c allows attackers execute arbitrary code via the /agc/vicidial.php, agc/vicidial-greay.php, and /vicidial/KHOMPadmin.php parameters...
PT-2023-12261
Name of the Vulnerable Software and Affected Versions VICIdial versions 2.10-415c through 2.14-610c Description A Cross Site Scripting issue allows attackers to execute arbitrary code via the "/agc/vicidial.php", "agc/vicidial-greay.php", and "/vicidial/KHOMP admin.php" API endpoints. The...
CVE-2021-35377
CVE-2021-35377 affects VICIdial versions v2.14-610c and v2.10-415c. It is described as a cross-site scripting vulnerability that enables an attacker to execute arbitrary code via parameters in /agc/vicidial.php, /agc/vicidial-greay.php, and /vicidial/KHOMP_admin.php. The provided sources do not s...
support.vicidial.de Cross Site Scripting vulnerability OBB-3106396
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Vicidial 2.14-783a Cross Site Scripting
Document Title: =============== Vicidial v2.14-783a - Multiple XSS Web Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2311 Release Date: ============= 2022-10-11 Vulnerability Laboratory ID VL-ID: ==================================== 23...
Vicidial v2.14-783a - Multiple XSS Web Vulnerabilities
Document Title: =============== Vicidial v2.14-783a - Multiple XSS Web Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2311 Release Date: ============= 2022-10-10 Vulnerability Laboratory ID VL-ID: ==================================== 23...
Metasploit Weekly Wrap-Up
Have you built out that awesome media room? If your guilty pleasures include using a mobile device to make your home entertainment system WOW your guests, you might be using Unified Remote. I hope you are extra cautious about what devices you let on that WiFi network. A prolific community member...
VICIdial Cross-Site Scripting Vulnerability
Vicidial is a software suite from Vicidial, Inc. Designed to interact with the Asterisk open source Pbx phone system as a complete inbound/outbound contact center suite with inbound email support. A cross-site scripting vulnerability exists in VICIdial versions prior to 2.14b0.5, which stems from...
CVE-2022-34878
SQL Injection vulnerability in User Stats interface /vicidial/userstats.php of VICIdial via the filedownload parameter allows attacker to spoof identity, tamper with existing data, allow the complete disclosure of all data on the system, destroy the data or make it otherwise unavailable, and beco...
CVE-2022-34877
SQL Injection vulnerability in AST Agent Time Sheet interface /vicidial/ASTagenttimesheet.php of VICIdial via the agent parameter allows attacker to spoof identity, tamper with existing data, allow the complete disclosure of all data on the system, destroy the data or make it otherwise unavailabl...
CVE-2022-34879
Reflected Cross Site Scripting XSS vulnerabilities in AST Agent Time Sheet interface /vicidial/ASTagenttimesheet.php of VICIdial via agent, and searcharchiveddata parameters. This issue affects: VICIdial 2.14b0.5 versions prior to 3555...
CVE-2022-34876
SQL Injection vulnerability in admin interface /vicidial/admin.php of VICIdial via modifyemailaccounts, accessrecordings, and agentcallemail parameters allows attacker to spoof identity, tamper with existing data, allow the complete disclosure of all data on the system, destroy the data or make i...
CVE-2022-34878
SQL Injection vulnerability in User Stats interface /vicidial/userstats.php of VICIdial via the filedownload parameter allows attacker to spoof identity, tamper with existing data, allow the complete disclosure of all data on the system, destroy the data or make it otherwise unavailable, and beco...
CVE-2022-34876
SQL Injection vulnerability in admin interface /vicidial/admin.php of VICIdial via modifyemailaccounts, accessrecordings, and agentcallemail parameters allows attacker to spoof identity, tamper with existing data, allow the complete disclosure of all data on the system, destroy the data or make i...
CVE-2022-34877
SQL Injection vulnerability in AST Agent Time Sheet interface /vicidial/ASTagenttimesheet.php of VICIdial via the agent parameter allows attacker to spoof identity, tamper with existing data, allow the complete disclosure of all data on the system, destroy the data or make it otherwise unavailabl...
CVE-2022-34879
Reflected Cross Site Scripting XSS vulnerabilities in AST Agent Time Sheet interface /vicidial/ASTagenttimesheet.php of VICIdial via agent, and searcharchiveddata parameters. This issue affects: VICIdial 2.14b0.5 versions prior to 3555...
Sql injection
SQL Injection vulnerability in admin interface /vicidial/admin.php of VICIdial via modifyemailaccounts, accessrecordings, and agentcallemail parameters allows attacker to spoof identity, tamper with existing data, allow the complete disclosure of all data on the system, destroy the data or make i...
Cross site scripting
Reflected Cross Site Scripting XSS vulnerabilities in AST Agent Time Sheet interface /vicidial/ASTagenttimesheet.php of VICIdial via agent, and searcharchiveddata parameters. This issue affects: VICIdial 2.14b0.5 versions prior to 3555...
Sql injection
SQL Injection vulnerability in AST Agent Time Sheet interface /vicidial/ASTagenttimesheet.php of VICIdial via the agent parameter allows attacker to spoof identity, tamper with existing data, allow the complete disclosure of all data on the system, destroy the data or make it otherwise unavailabl...