CVE-2020-10576

CVE-2020-10576 affects Meetecho Janus WebRTC Server up to version 0.9.1. The vulnerability is a race condition in plugins/janus_voicemail.c (VoiceMail plugin) that can cause the server to crash. The issue is documented across multiple sources (NVD, Red Hat, CNVD, OSV, UBUNTU, Debian, etc.). The a...

CVE-2020-10576

An issue was discovered in Janus through 0.9.1. plugins/janusvoicemail.c in the VoiceMail plugin has a race condition that could cause a server crash...

PT-2020-12216

Name of the Vulnerable Software and Affected Versions Janus versions through 0.9.1 Description A race condition in the VoiceMail plugin, specifically in plugins/janus voicemail.c, could cause a server crash. Recommendations For versions through 0.9.1, as a temporary workaround, consider disabling...

CVE-2020-10576: Concurrent Execution using Shared Resource with Improper Synchronization

An issue was discovered in Janus through 0.9.1. plugins/janusvoicemail.c in the VoiceMail plugin has a race condition that could cause a server crash...

FusionPBX Cross-Site Scripting Vulnerability (CNVD-2019-43410)

FusionPBX is an open source enterprise IPPBX interface management system based on FreeSWITHC. A cross-site scripting vulnerability exists in app/voicemailgreetings/voicemailgreetingedit.php in FusionPBX 4.4.1. An attacker can exploit this vulnerability to inject arbitrary web script or HTML via t...

PT-2019-15833 · Fusionpbx · Fusionpbx

Name of the Vulnerable Software and Affected Versions: FusionPBX version 4.4.1 Description: A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the id and/or voicemail id parameters in the voicemail greeting edit.php file. Recommendations: For FusionPBX...

Fake Voicemail/Office 365 Attack Targets Enterprise Execs

A phishing campaign is making the rounds that uses fake voicemail messages to lure victims into revealing their Office 365 email credentials. The targets are “high-profile companies,” according to researchers, mainly in the tourism, entertainment and real-estate industries. A wide range of...

The Fully Remote Attack Surface of the iPhone

Posted by Natalie Silvanovich, Project Zero While there have been several rumours and reports of fully remote vulnerabilities affecting the iPhone being used by attackers in the last couple of years, limited information is available about the technical details of these vulnerabilities, as well as...

Visual Voicemail for iPhone - IMAP NAMESPACE Processing Use-After-Free Exploit

Visual Voicemail VVM is a feature of mobile devices that allows voicemail to be read in an email-like format. Carriers set up a Visual Voicemail server that supports IMAP, and the device queries this server for new email. Visual Voicemail is configured over SMS, and carriers inform devices of the...

Visual Voicemail for iPhone - IMAP NAMESPACE Processing Use-After-Free

Visual Voicemail for iPhone - IMAP NAMESPACE Processing Use-After-Free Visual Voicemail VVM is a feature of mobile devices that allows voicemail to be read in an email-like format. Carriers set up a Visual Voicemail server that supports IMAP, and the device queries this server for new email. Visu...

Visual Voicemail for iPhone - IMAP NAMESPACE Processing Use-After-Free

Visual Voicemail VVM is a feature of mobile devices that allows voicemail to be read in an email-like format. Carriers set up a Visual Voicemail server that supports IMAP, and the device queries this server for new email. Visual Voicemail is configured over SMS, and carriers inform devices of the...

Android Messaging: A Few Bugs Short of a Chain

Posted by Natalie Silvanovich, Project Zero About a year and a half ago, I did some research into Android messaging and mail clients. At the time, I didn’t blog about it, because though I found bugs, I wasn’t able to assemble them into a credible attack. However, in the spirit of writing about...

Hijacking Online Accounts Via Hacked Voicemail Systems

LEIPZIG, GERMANY – Voicemail systems are vulnerable to compromise via brute-force attacks against the four-digit personal identification numbers PINs that protect them. Researchers say a malicious user can thus access the voicemail system to then take over online accounts for services like...

From Now On, Only Default Android Apps Can Access Call Log and SMS Data

A few hours ago the company announced its "non-shocking" plans to shut down Google+ social media network following a "shocking" data breach incident. Now to prevent abuse and potential leakage of sensitive data to third-party app developers, Google has made several significant changes giving user...

Microsoft Exchange Server Voicemail Transcription Improper Access Control Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Exchange. Authentication is required to exploit this vulnerability. The specific flaw exists within the conversion of voicemails to text. Due to improper access control, an attacker who h...

Allworx Server Manager 6x / 6x12 / 48x Cross Site Scripting Vulnerability

Allworx Server Manager versions 6x, 6x12, and 48x suffer from multiple cross site scripting vulnerabilities. Allworx Server Manager Multiple Cross-Site Scripting Vulnerabilities history.pushState'', '', '/' ::: default.asp ::: input type="hidden" name="Tab" v...

InTerCyber company in the message in the system discovered a serious vulnerability-a vulnerability warning-the black bar safety net

According to foreign media the latest report, information security company InTheCyber Security Studies experts discovered a serious vulnerability, this vulnerability or can affect the message system security. Note that this vulnerability using the method is not difficult, an attacker can easily...

ZYCOO IP Phone System - Remote Command Execution

ZYCOO IP Phone System - Remote Command Execution Vulnerable hardware : ZYCOO IP phone system Vendor : zycoo.com Author : Ahmed sultan @0x4148 Email : [email protected] Summary : According to the vendor's site , CooVox Series IP Phone System is the most innovative solution for VoIP telecommunicatio...

Cisco WebEx for Android Security Patch

Cisco has been busy the last two days pushing out a patch and security advisories for a number of its products, including a fix for a remotely exploitable vulnerability in its WebEx Meetings mobile application for Android. Cisco said the vulnerability affects versions prior to 8.5.1 of the app, a...

Asterisk 0.x/1.0/1.2 Voicemail Unauthorized Access Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/15336/info Asterisk is prone to an unauthorized-access vulnerability. This issue is due to a failure in the application to properly verify user-supplied input. Successful exploitation will grant an attacker access to a...