The vulnerability of the “page parameter” in Mitel Connect OnSite conference call systems allows a intruder to inject any desired web script or HTML code.

The vulnerability of the page parameter in Mitel Connect OnSite communication systems is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary web scripts or HTML code remotely...

ShoreTel Connect ONSITE Cross Site Scripting / Session Fixation

Exploit Title: Shoretel Connect Multiple Vulnerability Google Dork: inurl:/signin.php?ret= Date: 14/06/2017 Author: Ramikan Vendor Homepage: https://www.shoretel.com/ Software Link: https://www.shoretel.com/resource-center/shoretel-connect-onsite-overview Version: Tested on 18.62.2000.0,...

Cross site scripting

A reflected Cross-site scripting XSS vulnerability in ShoreTel Connect ONSITE before 19.49.1500.0 allows remote attackers to inject arbitrary web script or HTML via the brandUrl parameter...

CVE-2019-9592

A reflected Cross-site scripting XSS vulnerability in ShoreTel Connect ONSITE 19.45.1602.0 allows remote attackers to inject arbitrary web script or HTML via the url parameter...

Cross site scripting

A reflected Cross-site scripting XSS vulnerability in ShoreTel Connect ONSITE 19.45.1602.0 allows remote attackers to inject arbitrary web script or HTML via the url parameter...

CVE-2019-9591

A reflected Cross-site scripting XSS vulnerability in ShoreTel Connect ONSITE before 19.49.1500.0 allows remote attackers to inject arbitrary web script or HTML via the brandUrl parameter...

CVE-2019-9591

A reflected Cross-site scripting XSS vulnerability in ShoreTel Connect ONSITE before 19.49.1500.0 allows remote attackers to inject arbitrary web script or HTML via the brandUrl parameter...

CVE-2019-9592

A reflected Cross-site scripting XSS vulnerability in ShoreTel Connect ONSITE 19.45.1602.0 allows remote attackers to inject arbitrary web script or HTML via the url parameter...

CVE-2019-9591

ShoreTel Connect ONSITE prior to 19.49.1500.0 is affected by a reflected XSS via the brandUrl parameter. Impact is arbitrary script injection in the user’s browser. Root cause: unvalidated input reflected into the page. Affected component: signin.php (brandUrl parameter). Remediation: upgrade to ...

CVE-2019-9592

CVE-2019-9592 affects ShoreTel Connect ONSITE 19.45.1602.0 with a reflected XSS via the url parameter in the signin flow. The root cause is improper handling of the url parameter allowing arbitrary script execution in the victim’s browser. Public references consistently cite the affected version ...

CVE-2019-9593

A reflected Cross-site scripting XSS vulnerability in ShoreTel Connect ONSITE 18.82.2000.0 allows remote attackers to inject arbitrary web script or HTML via the page parameter...

CVE-2019-9593

CVE-2019-9593 affects ShoreTel Connect ON SITE 18.82.2000.0. The vulnerability is a reflected XSS via the page parameter on a ShoreTel Connect ONSITE web page, enabling remote attackers to inject arbitrary script/HTML. The issue is documented across multiple sources (NVD and Mitel/OnSite disclosu...

PT-2019-19732 · Shoretel · Shoretel Connect Onsite

Name of the Vulnerable Software and Affected Versions: ShoreTel Connect ONSITE versions prior to 19.49.1500.0 Description: A reflected Cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the brandUrl parameter. Recommendations: For versions prior to...

PT-2019-19733 · Shoretel · Shoretel Connect Onsite

Name of the Vulnerable Software and Affected Versions: ShoreTel Connect ONSITE version 19.45.1602.0 Description: A reflected Cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the url parameter. This enables attackers to potentially execute malicious...

ShoreTel / Mitel Connect ONSITE ST14.2 Remote Code Execution

Exploit Title: ShoreTel / Mitel Connect ONSITE ST14.2 Remote Code Execution Google Dork: +"Public" +"My Conferences" +"Personal Library" +"My Profile" +19.49.5200.0 Date: 01-01-2019 Exploit Author: twosevenzero Vendor Homepage: https://www.mitel.com/ Version: 19.49.5200.0 and very likely many...

ShoreTel Mitel Connect ONSITE 19.49.5200.0 - Remote Code Execution

ShoreTel Mitel Connect ONSITE 19.49.5200.0 - Remote Code Execution Exploit Title: ShoreTel / Mitel Connect ONSITE ST14.2 Remote Code Execution Google Dork: +"Public" +"My Conferences" +"Personal Library" +"My Profile" +19.49.5200.0 Date: 01-01-2019 Exploit Author: twosevenzero Vendor Homepage:...

ShoreTel / Mitel Connect ONSITE 19.49.5200.0 - Remote Code Execution

Exploit Title: ShoreTel / Mitel Connect ONSITE ST14.2 Remote Code Execution Google Dork: +"Public" +"My Conferences" +"Personal Library" +"My Profile" +19.49.5200.0 Date: 01-01-2019 Exploit Author: twosevenzero Vendor Homepage: https://www.mitel.com/ Version: 19.49.5200.0 and very likely many...

The vulnerability of the conference communication component in Telecommunications Systems Mitel Connect OnSite and ST14.2 allows a intruder to execute arbitrary code.

The vulnerability of the conference communication components in Mitel Connect OnSite and ST 14.2 systems relates to improper code generation. Exploiting this vulnerability allows an attacker to inject arbitrary code into the generated PHP file and execute it using specially crafted requests to th...

The vulnerability of the conference communication component in Telecommunications Systems Mitel Connect OnSite and ST14.2 allows a intruder to execute arbitrary code.

The vulnerability of the conference communication components in Mitel Connect OnSite and ST 14.2 systems is related to improper handling of code generation. Exploiting this vulnerability allows an attacker to inject arbitrary code into the generated PHP files and execute it using specially crafte...

The vulnerability of the conference communication component in Telecommunications Systems Mitel Connect OnSite and ST14.2 allows a intruder to execute arbitrary code.

The vulnerability of the conference communication components in Mitel Connect OnSite and ST 14.2 systems relates to improper handling of code generation. Exploiting this vulnerability allows a malicious actor to inject arbitrary code into the generated PHP files and execute it using specially...