CVE-2021-4282

CVE-2021-4282 affects FreePBX voicemail (page.voicemail.php). Vulnerability arises from an unknown functionality that can be manipulated to perform cross-site scripting, with remote attack possible. Affected versions are prior to 14.0.6.25. Remediation: upgrade to FreePBX voicemail version 14.0.6...

PT-2022-11698 · Freepbx · Freepbx

Name of the Vulnerable Software and Affected Versions: FreePBX versions prior to 14.0.6.25 Description: A vulnerability was found in FreePBX voicemail, affecting an unknown functionality of the file page.voicemail.php. The manipulation leads to cross site scripting. The attack can be launched...

PT-2022-11699 · Freebpx · Freebpx

Name of the Vulnerable Software and Affected Versions: FreeBPX voicemail versions prior to 14.0.6.25 Description: A vulnerability was found in the Settings Handler component of FreeBPX voicemail, specifically in the file views/ssettings.php. The issue is related to the manipulation of the key...

FreePBX 跨站脚本漏洞

FreePBX formerly known as Asterisk Management Portal is a set of tools from the FreePBX project for configuring Asterisk IP telephony system through a GUI web-based graphical interface. A cross-site scripting vulnerability exists in FreePBX voicemail versions prior to 14.0.6.25, which stems from ...

FreePBX 跨站脚本漏洞

FreePBX formerly known as Asterisk Management Portal is a set of tools from the FreePBX project for configuring Asterisk IP telephony system through a GUI web-based graphical interface. A cross-site scripting vulnerability exists in FreePBX voicemail versions prior to 14.0.6.25, which stems from...

CVE-2022-20525

In enforceVisualVoicemailPackage of PhoneInterfaceManager.java, there is a possible leak of visual voicemail package name due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

CVE-2022-20525

In enforceVisualVoicemailPackage of PhoneInterfaceManager.java, there is a possible leak of visual voicemail package name due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

CVE-2022-20525

CVE-2022-20525 affects Android 13 and points to a permissions bypass in enforceVisualVoicemailPackage inside PhoneInterfaceManager.java, causing a leak of the visual voicemail package name. The impact is local elevation of privilege with no extra execution privileges and no user interaction requi...

CVE-2022-20525

In enforceVisualVoicemailPackage of PhoneInterfaceManager.java, there is a possible leak of visual voicemail package name due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

PT-2022-14739 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-13 Description: The issue is related to a permissions bypass in the enforceVisualVoicemailPackage function of PhoneInterfaceManager.java, which could lead to a leak of the visual voicemail package name. This leak may...

CVE-2022-20525: Generation of Error Message Containing Sensitive Information

In enforceVisualVoicemailPackage of PhoneInterfaceManager.java, there is a possible leak of visual voicemail package name due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

Google Pixel 安全漏洞

Google Android is a Linux-based open source operating system from Google. An elevation of privilege vulnerability exists in the enforceVisualVoicemailPackage of PhoneInterfaceManager.java in Google Android version 13.0, which stems from a privilege bypass issue. An attacker can exploit the...

PUB-A-229742768

In enforceVisualVoicemailPackage of PhoneInterfaceManager.java, there is a possible leak of visual voicemail package name due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

Zimbra Collaboration Suite phone cross-site scripting vulnerability

Synacor Zimbra Collaboration Suite ZCS is an open source collaboration suite from Synacor, USA. The product includes WebMail, Calendar, Address Book and more. A cross-site scripting vulnerability exists in Zimbra Collaboration Suite version 8.8.15, which stems from the lack of effective filtering...

CVE-2022-41350

In Zimbra Collaboration Suite ZCS 8.8.15, /h/search?action=voicemail&action=listen accepts a phone parameter that is vulnerable to Reflected XSS. This allows executing arbitrary JavaScript on the victim's machine...

Design/Logic Flaw

In Zimbra Collaboration Suite ZCS 8.8.15, /h/search?action=voicemail&action=listen accepts a phone parameter that is vulnerable to Reflected XSS. This allows executing arbitrary JavaScript on the victim's machine...

CVE-2022-41350

In Zimbra Collaboration Suite ZCS 8.8.15, /h/search?action=voicemail&action=listen accepts a phone parameter that is vulnerable to Reflected XSS. This allows executing arbitrary JavaScript on the victim's machine...

PT-2022-25822 · Zimbra · Zimbra Collaboration Suite

Name of the Vulnerable Software and Affected Versions: Zimbra Collaboration Suite version 8.8.15 Description: The issue allows for the execution of arbitrary JavaScript on the victim's machine due to a Reflected XSS vulnerability. This is caused by the /h/search?action=voicemail&action=listen...

CVE-2022-41350

In Zimbra Collaboration Suite ZCS 8.8.15, /h/search?action=voicemail&action=listen accepts a phone parameter that is vulnerable to Reflected XSS. This allows executing arbitrary JavaScript on the victim's machine...

CVE-2022-41350: Improper Neutralization of Input During Web Page Generation

In Zimbra Collaboration Suite ZCS 8.8.15, /h/search?action=voicemail&action=listen accepts a phone parameter that is vulnerable to Reflected XSS. This allows executing arbitrary JavaScript on the victim's machine...