256 matches found
CVE-2019-9229
The CVE-2019-9229 issue affects AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices running firmware F7.20A to F7.20A.251. An internal interface on the link-local 169.254.254.253 is exposed to the local network and allows access to multiple quagga VTYs. Attackers can authenti...
CVE-2019-9228
The CVE-2019-9228 issue affects AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR, and 800C-MSBR devices with firmware versions F7.20A up to 7.20A.252.062. The vulnerability is in the (1) management SSH and (2) management TELNET features, where remote attackers can cause a denial of service by e...
CVE-2019-9228
An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions F7.20A at least to 7.20A.252.062. The 1 management SSH and 2 management TELNET features allow remote attackers to cause a denial of service connection slot exhaustion via 5...
CVE-2019-9228
An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions F7.20A at least to 7.20A.252.062. The 1 management SSH and 2 management TELNET features allow remote attackers to cause a denial of service connection slot exhaustion via 5...
CVE-2019-9231
An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions before 7.20A.202.307. A Cross-Site Request Forgery CSRF vulnerability in the management web interface allows remote attackers to execute malicious and unauthorized actions,...
CVE-2019-9231
An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions before 7.20A.202.307. A Cross-Site Request Forgery CSRF vulnerability in the management web interface allows remote attackers to execute malicious and unauthorized actions,...
Cross site request forgery (csrf)
An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions before 7.20A.202.307. A Cross-Site Request Forgery CSRF vulnerability in the management web interface allows remote attackers to execute malicious and unauthorized actions,...
CVE-2019-9231
CVE-2019-9231 affects AudioCodes Mediant devices (500L-MSBR, 500-MBSR, M800B-MSBR, 800C-MSBR) with firmware versions older than 7.20A.202.307. A cross-site request forgery (CSRF) vulnerability exists in the management web interface, allowing remote attackers to perform malicious and unauthorized ...
CVE-2019-9231
An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions before 7.20A.202.307. A Cross-Site Request Forgery CSRF vulnerability in the management web interface allows remote attackers to execute malicious and unauthorized actions,...
CVE-2019-9230
An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions F7.20A to F7.20A.253. A cross-site scripting XSS vulnerability in the search function of the management web interface allows remote attackers to inject arbitrary web script o...
CVE-2019-9230
An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions F7.20A to F7.20A.253. A cross-site scripting XSS vulnerability in the search function of the management web interface allows remote attackers to inject arbitrary web script o...
Cross site scripting
An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions F7.20A to F7.20A.253. A cross-site scripting XSS vulnerability in the search function of the management web interface allows remote attackers to inject arbitrary web script o...
CVE-2019-9230
An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions F7.20A to F7.20A.253. A cross-site scripting XSS vulnerability in the search function of the management web interface allows remote attackers to inject arbitrary web script o...
CVE-2019-9230
CVE-2019-9230 affects AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware F7.20A–F7.20A.253. A cross-site scripting (XSS) flaw in the management web interface’s search function allows remote attackers to inject arbitrary web script or HTML via the keyword parame...
CVE-2018-16216
A command injection missing input validation, escaping in the monitoring or memory status web interface in AudioCodes 405HD firmware 2.2.12 VoIP phone allows an authenticated remote attacker in the same network as the device to trigger OS commands like starting telnetd or opening a reverse shell...
CVE-2018-16216
A command injection missing input validation, escaping in the monitoring or memory status web interface in AudioCodes 405HD firmware 2.2.12 VoIP phone allows an authenticated remote attacker in the same network as the device to trigger OS commands like starting telnetd or opening a reverse shell...
CVE-2018-16219
A missing password verification in the web interface in AudioCodes 405HD VoIP phone with firmware 2.2.12 allows an remote attacker in the same network as the device to change the admin password without authentication via a POST request...
CVE-2018-16220
Cross Site Scripting in different input fields domain field and personal settings in AudioCodes 405HD VoIP phone with firmware 2.2.12 allows an attacker local or remote to inject JavaScript into the web interface of the device by manipulating the phone book entries or manipulating the domain name...
CVE-2018-16219
A missing password verification in the web interface in AudioCodes 405HD VoIP phone with firmware 2.2.12 allows an remote attacker in the same network as the device to change the admin password without authentication via a POST request...
Cross site scripting
Cross Site Scripting in different input fields domain field and personal settings in AudioCodes 405HD VoIP phone with firmware 2.2.12 allows an attacker local or remote to inject JavaScript into the web interface of the device by manipulating the phone book entries or manipulating the domain name...