CVE-2018-17563

The CVE-2018-17563 vulnerability affects Grandstream GXP16xx VoIP phones (example 1.0.4.128). A malformed input string to /cgi-bin/api-get_line_status allows an attacker to dump the device configuration in plaintext, constituting an information disclosure issue. The root cause is a malformed inpu...

CVE-2018-17563

A Malformed Input String to /cgi-bin/api-getlinestatus on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to dump the device's configuration in cleartext...

CVE-2019-10655

Grandstream GAC2500 1.0.3.35, GXP2200 1.0.3.27, GVC3202 1.0.3.51, GXV3275 before 1.0.3.219 Beta, and GXV3240 before 1.0.3.219 Beta devices allow unauthenticated remote code execution via shell metacharacters in a /manager?action=getlogcat priority field, in conjunction with a buffer overflow via...

Debian DSA-4402-1 : mumble - security update

It was discovered that insufficient restrictions in the connection handling of Mumble, a low latency encrypted VoIP client, could result in denial of service. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory...

Debian: Security Advisory (DSA-4402-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 1671-1] coturn security update

Package : coturn Version : 4.2.1.2-1+deb8u1 CVE ID : CVE-2018-4056 CVE-2018-4058 CVE-2018-4059 Multiple vulnerabilities were discovered in coTURN, a TURN and STUN server for VoIP. CVE-2018-4056 An SQL injection vulnerability was discovered in the coTURN administrator web portal. As the...

[SECURITY] Fedora 29 Update: matrix-synapse-0.34.0.1-1.fc29

Matrix is an ambitious new ecosystem for open federated Instant Messaging a nd VoIP. Synapse is a reference "homeserver" implementation of Matrix from the core development team at matrix.org, written in Python/Twisted. It is inten ded to showcase the concept of Matrix and let folks see the spec i...

Unprotected VOIP Server Exposed Millions of SMS Messages, Call Logs

A California-based Voice-Over-IP VoIP services provider VOIPO has accidentally left tens of gigabytes of its customer data, containing millions of call logs, SMS/MMS messages, and plaintext internal system credentials, publicly accessible to anyone without authentication. VOIPo is one of a leadin...

Cisco VoIP Script Insertion / Weak Passwords / Undocumented Functionality

Cisco VoIP phone such as models 88XX suffer from script insertion, weak and hard-coded passwords, undocumented debug functionality, and various outdated components with known vulnerabilities. ======================================================================= title: Multiple Vulnerabilities...

Cisco VoIP Script Insertion / Weak Passwords / Undocumented Functionality

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple Vulnerabilities product: Cisco VoIP Phones, e.g. models 88XX vulnerable version: See list of vulnerable devices/firmwares below fixed version: 12.5.1 MN CVE...

CVE-2018-18871

Missing password verification in the web interface on Gigaset Maxwell Basic VoIP phones with firmware 2.22.7 would allow a remote attacker in the same network as the device to change the admin password without authentication and without knowing the original password...

Default credentials

Missing password verification in the web interface on Gigaset Maxwell Basic VoIP phones with firmware 2.22.7 would allow a remote attacker in the same network as the device to change the admin password without authentication and without knowing the original password...

CVE-2018-18871

CVE-2018-18871 affects Gigaset Maxwell Basic VoIP phones (firmware 2.22.7). The web interface lacks password verification, allowing a remote attacker on the same network to change the admin password without authentication. This is a network-accessible issue with high impact to confidentiality and...

Delivering Softphones with Virtual Apps and Desktops

This article describes a generic approach to delivering softphones and voice chat applications with Citrix Virtual Apps and Desktops CVAD7.x. 1. Alternatives for Delivering Softphones CVADsupport several alternatives for delivering softphones. Control mode , where the hosted published softphone i...

SolarWinds VoIP and Network Quality Manager (VNQM) Detection (Windows SMB Login)

SMB login-based detection of SolarWinds VoIP and Network Quality Manager VNQM. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Cloud communication firm exposes millions of sensitive text messages to public access

By Waqas There’s bad news for those who rely upon SMS-based 2FA authentication. A Berlin-based security researcher Sébastien Kaul has revealed that Voxox exposed a huge database containing tens of millions of text messages by storing it on an unprotected server. The VOIP and Cloud communication f...

CVE-2018-15497

The Mitel MiVoice 5330e VoIP device is affected by memory corruption flaws in the SIP/SDP packet handling functionality. An attacker can exploit this issue remotely, by sending a particular pattern of SIP/SDP packets, to cause a denial of service state in the affected devices and probably remote...

Remote code execution

The Mitel MiVoice 5330e VoIP device is affected by memory corruption flaws in the SIP/SDP packet handling functionality. An attacker can exploit this issue remotely, by sending a particular pattern of SIP/SDP packets, to cause a denial of service state in the affected devices and probably remote...

CVE-2018-15497

The Mitel MiVoice 5330e VoIP device is affected by memory corruption flaws in the SIP/SDP packet handling functionality. An attacker can exploit this issue remotely, by sending a particular pattern of SIP/SDP packets, to cause a denial of service state in the affected devices and probably remote...

CVE-2018-15497

Mitel MiVoice 5330e VoIP device is affected by memory corruption in the SIP/SDP packet handling. A remote attacker can trigger this by sending specially crafted SIP/SDP packets, leading to a denial of service state and likely remote code execution. Supported details indicate the issue resides in ...