54 matches found
yealink_tools
Реверс-инжиниринг прошивки Yealink Этот репозиторий содержит несколько скриптовых утилит, использовавшихся при реверс-инжиниринге прошивки VoIP-телефонов Yealink. Для получения дополнительной информации об этом исследовании, пожалуйста, прочитайте статью в блоге...
EUVD-2012-1442
Malware in sbrugna...
EUVD-2013-5593
Malware in sbrugna...
EUVD-2014-3441
Malware in sbrugna...
EUVD-2014-3440
Malware in sbrugna...
EUVD-2013-5592
Malware in sbrugna...
CVE-2012-1417: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in Local Phone book and Blacklist form in Yealink VOIP Phones allow remote authenticated users to inject arbitrary web script or HTML via the user field to cgi-bin/ConfigManApp.com...
CVE-2013-5758
cgi-bin/cgiServer.exx in Yealink VoIP Phone SIP-T38G allows remote authenticated users to execute arbitrary commands by calling the system method in the body of a request, as demonstrated by running unauthorized services, changing directory permissions, and modifying files...
Cross site request forgery (csrf)
cgi-bin/cgiServer.exx in Yealink VoIP Phone SIP-T38G allows remote authenticated users to execute arbitrary commands by calling the system method in the body of a request, as demonstrated by running unauthorized services, changing directory permissions, and modifying files...
Path traversal
Absolute path traversal vulnerability in Yealink VoIP Phone SIP-T38G allows remote authenticated users to read arbitrary files via a full pathname in the dumpConfigFile function in the command parameter to cgi-bin/cgiServer.exx...
Directory traversal
Directory traversal vulnerability in Yealink VoIP Phone SIP-T38G allows remote authenticated users to read arbitrary files via a .. dot dot in the page parameter to cgi-bin/cgiServer.exx...
CVE-2013-5758
cgi-bin/cgiServer.exx in Yealink VoIP Phone SIP-T38G allows remote authenticated users to execute arbitrary commands by calling the system method in the body of a request, as demonstrated by running unauthorized services, changing directory permissions, and modifying files...
CVE-2013-5758: Improper Neutralization of Special Elements used in an OS Command
cgi-bin/cgiServer.exx in Yealink VoIP Phone SIP-T38G allows remote authenticated users to execute arbitrary commands by calling the system method in the body of a request, as demonstrated by running unauthorized services, changing directory permissions, and modifying files...
CVE-2013-5757: Improper Limitation of a Pathname to a Restricted Directory
Absolute path traversal vulnerability in Yealink VoIP Phone SIP-T38G allows remote authenticated users to read arbitrary files via a full pathname in the dumpConfigFile function in the command parameter to cgi-bin/cgiServer.exx...
CVE-2013-5756: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in Yealink VoIP Phone SIP-T38G allows remote authenticated users to read arbitrary files via a .. dot dot in the page parameter to cgi-bin/cgiServer.exx...
PT-2014-2953
Name of the Vulnerable Software and Affected Versions Yealink VoIP Phone SIP-T38G Description The issue allows remote authenticated users to execute arbitrary commands by calling the system method in the body of a request. This can be used to run unauthorized services, change directory permission...
CVE-2014-3427
CRLF injection vulnerability in Yealink VoIP Phones with firmware 28.72.0.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the model parameter to servlet...
Crlf injection
CRLF injection vulnerability in Yealink VoIP Phones with firmware 28.72.0.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the model parameter to servlet...
CVE-2014-3427
CVE-2014-3427 affects Yealink VoIP Phones (validated on firmware 28.72.0.2) and arises from CRLF injection in the servlet handling the model parameter, enabling remote header injection and HTTP response splitting. Impact, as stated: arbitrary HTTP headers can be injected via the model parameter t...
CVE-2014-3427
CRLF injection vulnerability in Yealink VoIP Phones with firmware 28.72.0.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the model parameter to servlet...