3558 matches found
CVE-2007-6170
SQL injection vulnerability in the Call Detail Record Postgres logging engine cdrpgsql in Asterisk 1.4.x before 1.4.15, 1.2.x before 1.2.25, B.x before B.2.3.4, and C.x before C.1.0-beta6 allows remote authenticated users to execute arbitrary SQL commands via 1 ANI and 2 DNIS arguments...
CVE-2007-6170
SQL injection vulnerability in the Call Detail Record Postgres logging engine cdrpgsql in Asterisk 1.4.x before 1.4.15, 1.2.x before 1.2.25, B.x before B.2.3.4, and C.x before C.1.0-beta6 allows remote authenticated users to execute arbitrary SQL commands via 1 ANI and 2 DNIS arguments...
DEBIAN-CVE-2007-6171
SQL injection vulnerability in the Postgres Realtime Engine resconfigpgsql in Asterisk 1.4.x before 1.4.15 and C.x before C.1.0-beta6 allows remote attackers to execute arbitrary SQL commands via unknown vectors...
CVE-2007-6170
SQL injection vulnerability in the Call Detail Record Postgres logging engine cdrpgsql in Asterisk 1.4.x before 1.4.15, 1.2.x before 1.2.25, B.x before B.2.3.4, and C.x before C.1.0-beta6 allows remote authenticated users to execute arbitrary SQL commands via 1 ANI and 2 DNIS arguments...
CVE-2007-6170
CVE-2007-6170 affects the Call Detail Record Postgres logging engine (cdr_pgsql) in Asterisk. The vulnerability arises because ANI and DNIS are not properly escaped before SQL execution, enabling remote authenticated users to inject commands. Affected product versions include Asterisk 1.4.x befor...
CVE-2007-6171
Vulnerability: CVE-2007-6171 describes an SQL injection in the Postgres Realtime Engine (res_config_pgsql) of Asterisk 1.4.x (before 1.4.15) and Asterisk C.x (before C.1.0-beta6) . Affected component: Postgres Realtime Engine, res_config_pgsql. Root cause / impact: Remote attackers can exploit un...
CVE-2007-6171
SQL injection vulnerability in the Postgres Realtime Engine resconfigpgsql in Asterisk 1.4.x before 1.4.15 and C.x before C.1.0-beta6 allows remote attackers to execute arbitrary SQL commands via unknown vectors...
CVE-2007-6170
SQL injection vulnerability in the Call Detail Record Postgres logging engine cdrpgsql in Asterisk 1.4.x before 1.4.15, 1.2.x before 1.2.25, B.x before B.2.3.4, and C.x before C.1.0-beta6 allows remote authenticated users to execute arbitrary SQL commands via 1 ANI and 2 DNIS arguments...
CVE-2007-6171
SQL injection vulnerability in the Postgres Realtime Engine resconfigpgsql in Asterisk 1.4.x before 1.4.15 and C.x before C.1.0-beta6 allows remote attackers to execute arbitrary SQL commands via unknown vectors...
Asterisk multiple security vulnerabilities
cdrpgsql and resconfigpgsql SQL injection...
AST-2007-026 - SQL Injection issue in cdr_pgsql
Asterisk Project Security Advisory - AST-2007-026 +------------------------------------------------------------------------+ | Product | Asterisk | |----------------------+-------------------------------------------------| | Summary | SQL Injection issue in cdrpgsql |...
AST-2007-025 - SQL Injection issue in res_config_pgsql
Asterisk Project Security Advisory - AST-2007-025 +------------------------------------------------------------------------+ | Product | Asterisk | |----------------------+-------------------------------------------------| | Summary | SQL Injection issue in resconfigpgsql |...
Buffer overflow
Buffer overflow in sethdlc.c in the Asterisk Zaptel 1.4.5.1 might allow local users to gain privileges via a long device name interface name in the ifrname field. NOTE: the vendor disputes this issue, stating that the application requires root access, so privilege boundaries are not crossed...
CVE-2007-5690
Buffer overflow in sethdlc.c in the Asterisk Zaptel 1.4.5.1 might allow local users to gain privileges via a long device name interface name in the ifrname field. NOTE: the vendor disputes this issue, stating that the application requires root access, so privilege boundaries are not crossed...
CVE-2007-5690
Buffer overflow in sethdlc.c in the Asterisk Zaptel 1.4.5.1 might allow local users to gain privileges via a long device name interface name in the ifrname field. NOTE: the vendor disputes this issue, stating that the application requires root access, so privilege boundaries are not crossed...
CVE-2007-5690
Buffer overflow in sethdlc.c in the Asterisk Zaptel 1.4.5.1 might allow local users to gain privileges via a long device name interface name in the ifrname field. NOTE: the vendor disputes this issue, stating that the application requires root access, so privilege boundaries are not crossed...
CVE-2007-5690
CVE-2007-5690 affects the Asterisk Zaptel component (zaptel 1.4.x). The vulnerability is a buffer overflow in sethdlc.c triggered by a long device name (ifr_name) and could allow local privilege escalation. OpenVAS/Nessus entries indicate affected Fedora packages updated to mitigate this issue (e...
PT-2007-6681 · Digium · Asterisk Zaptel
Name of the Vulnerable Software and Affected Versions: Asterisk Zaptel version 1.4.5.1 Description: The issue is related to a buffer overflow in the sethdlc.c file, potentially allowing local users to gain privileges via a long device name in the ifr name field. However, the vendor disputes this,...
phone-sqlxss.txt
In a previous post http://seclists.org/fulldisclosure/2007/Oct/0174.html , we have seen how XSS injection can be performed over SIP to inject malicious JavaScript into the browser of an user that check the call history of his phone. In this post, we will detail how XSS injection can be performed...