1293 matches found
CVE-2023-30024
The MagicJack device, a VoIP solution for internet phone calls, contains a hidden NAND flash memory partition allowing unauthorized read/write access. Attackers can exploit this by replacing the original software with a malicious version, leading to ransomware deployment on the host computer...
CVE-2023-30024
CVE-2023-30024 concerns the MagicJack A921 USB Phone Jack. The vulnerability stems from a hidden NAND flash memory partition that allows unauthorized read/write access, enabling an attacker to replace the firmware with a malicious version and trigger ransomware deployment on the host computer. Af...
CVE-2023-30024
The MagicJack device, a VoIP solution for internet phone calls, contains a hidden NAND flash memory partition allowing unauthorized read/write access. Attackers can exploit this by replacing the original software with a malicious version, leading to ransomware deployment on the host computer...
CVE-2023-30609
matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page. Prior to version 3.71.0, plain text messages containing HTML tags are rendered as HTML in the search results. To exploit this, an attacker needs to trick a user into searching for a specific message...
The Huge 3CX Breach Was Actually 2 Linked Supply Chain Attacks
The mass compromise of the VoIP firm's customers is the first confirmed incident where one software-supply-chain attack enabled another, researchers say...
Lazarus Hacker Group Evolves Tactics, Tools, and Targets in DeathNote Campaign
The North Korean threat actor known as the Lazarus Group has been observed shifting its focus and rapidly evolving its tools and tactics as part of a long-running campaign called DeathNote. While the nation-state adversary is known for persistently singling out the cryptocurrency sector, recent...
3CXDesktopApp Backdoored in a Suspected Lazarus Campaign
Introduction The attack involved a compromised version of the 3CX VoIP desktop client, which was used to target 3CXs customers. The compromised 3CX application is a private automatic branch exchange PABX software and is available for Windows, macOS, Linux, Android, IOS and Chrome. Currently, ther...
Massive 3CX Supply-Chain Hack Targeted Cryptocurrency Firms
North Korean hackers appear to have used the corrupted VoIP software to go after just a handful of crypto firms with “surgical precision.”...
Not just an infostealer: Gopuram backdoor deployed through 3CX supply chain attack
On March 29, Crowdstrike published a report about a supply chain attack conducted via 3CXDesktopApp, a popular VoIP program. Since then, the security community has started analyzing the attack and sharing their findings. The following has been discovered so far: The infection is spread via...
[Updated April 3] 3CX desktop app used in a supply chain attack
Researchers have found that the 3CX desktop app may be compromised and used in supply chain attacks. The 3CX Desktop App is a Voice over Internet Protocol VoIP type of application which is available for Windows, macOS, Linux and mobile. Many large corporations use it internally to make calls, vie...
voip.3c1b.net Cross Site Scripting vulnerability OBB-3214370
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
K00194184: Linux kernel Voice Over IP H.323 vulnerability CVE-2020-14305
Security Advisory Description An out-of-bounds memory write flaw was found in how the Linux kernels Voice Over IP H.323 connection tracking functionality handled connections on ipv6 port 1720. This flaw allows an unauthenticated remote user to crash the system, causing a denial of service. The...
sip1.voip.com.tr Cross Site Scripting vulnerability OBB-3175675
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2022-44236
Beijing Zed-3 Technologies Co.,Ltd VoIP simpliclty ASG 8.5.0.17807 20181130-16:12 has a Weak password vulnerability...
CVE-2022-44236
Beijing Zed-3 Technologies Co.,Ltd VoIP simpliclty ASG 8.5.0.17807 20181130-16:12 has a Weak password vulnerability...
CVE-2022-44235
Beijing Zed-3 Technologies Co.,Ltd VoIP simpliclty ASG 8.5.0.17807 20181130-16:12 is vulnerable to Cross Site Scripting XSS...
CVE-2022-44235
Beijing Zed-3 Technologies Co.,Ltd VoIP simpliclty ASG 8.5.0.17807 20181130-16:12 is vulnerable to Cross Site Scripting XSS...
Spoofing
Beijing Zed-3 Technologies Co.,Ltd VoIP simpliclty ASG 8.5.0.17807 20181130-16:12 has a Weak password vulnerability...