PT-2023-12763 · Audiocodes · Audiocodes Device Manager Express

Name of the Vulnerable Software and Affected Versions: AudioCodes Device Manager Express versions through 7.8.20002.47752 Description: The issue is related to stored XSS via the desc parameter in the "ajaxTenants.php" endpoint. Recommendations: For AudioCodes Device Manager Express versions throu...

CVE-2022-24628

AudioCodes Device Manager Express (up to version 7.8.20002.47752) is affected by an authenticated SQL injection in the id parameter of IPPhoneFirmwareEdit.php. The CVE is CVE-2022-24628. Impacted component: IPPhoneFirmwareEdit.php; attacker must be authenticated; vulnerability enables potentially...

PT-2023-12764 · Audiocodes · Audiocodes Device Manager Express

Name of the Vulnerable Software and Affected Versions: AudioCodes Device Manager Express versions through 7.8.20002.47752 Description: The issue concerns directory traversal during file download. This occurs via the view parameter in the "BrowseFiles.php" endpoint. Recommendations: For versions...

CVE-2022-24628

An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is authenticated SQL injection in the id parameter of IPPhoneFirmwareEdit.php...

CVE-2022-24631

AudioCodes Device Manager Express (versions up to 7.8.20002.47752) contains a stored XSS vulnerability in the ajaxTenants.php desc parameter. This is documented across multiple sources (CVE-2022-24631 and member metadata) as a cross-site scripting issue in that endpoint. PT-2023-12763 notes recom...

PT-2023-12761 · Audiocodes · Audiocodes Device Manager Express

Name of the Vulnerable Software and Affected Versions: AudioCodes Device Manager Express versions through 7.8.20002.47752 Description: An issue allows remote code execution via directory traversal in the dir parameter of the file upload functionality of "BrowseFiles.php". An attacker can upload a...

CVE-2022-24632

An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is directory traversal during file download via the BrowseFiles.php view parameter...

CVE-2022-24627

Summary: CVE-2022-24627 affects AudioCodes Device Manager Express (versions up to 7.8.20002.47752). It is an unauthenticated SQL injection in the parameter p of the login form process_login.php. The underlying cause is improper input handling, enabling attackers to bypass authentication and poten...

AudioCodes Device Manager Express SQL注入漏洞

AudioCodes Device Manager Express is a powerful lifecycle management tool for AudioCodes IP phones, EPOS and Jabra headsets and speakers from AudioCodes Israel. A SQL injection vulnerability exists in AudioCodes Device Manager Express 7.8.20002.47752 and prior versions, which originates from an...

AudioCodes Device Manager Express 命令注入漏洞

AudioCodes Device Manager Express is a powerful lifecycle management tool for AudioCodes IP Phones, EPOS and Jabra headsets and speakers from AudioCodes Israel. A command injection vulnerability exists in AudioCodes Device Manager Express 7.8.20002.47752 and prior versions, which stems from remot...

AudioCodes Device Manager Express SQL注入漏洞

AudioCodes Device Manager Express is a powerful lifecycle management tool for AudioCodes IP Phones, EPOS and Jabra headsets and speakers from AudioCodes Israel. A SQL injection vulnerability exists in AudioCodes Device Manager Express 7.8.20002.47752 and prior versions, which stems from an...

AudioCodes Device Manager Express 路径遍历漏洞

AudioCodes Device Manager Express is a powerful lifecycle management tool for AudioCodes IP phones, EPOS and Jabra headsets and speakers from AudioCodes Israel. A path traversal vulnerability exists in AudioCodes Device Manager Express 7.8.20002.47752 and prior versions, which stems from a path...

AudioCodes Device Manager Express 跨站脚本漏洞

AudioCodes Device Manager Express is a powerful lifecycle management tool for AudioCodes IP Phones, EPOS and Jabra headsets and speakers from AudioCodes Israel. A cross-site scripting vulnerability exists in AudioCodes Device Manager Express 7.8.20002.47752 and prior versions, which originates fr...

Device Manager Express 7.8.20002.47752 SQL Injection / XSS / Code Execution / Traversal

Product Name: Device Manager Express Vendor Homepage: https://www.audiocodes.com Software Link: https://www.audiocodes.com/solutions-products/products/management-products-solutions/device-manager Version: = 7.8.20002.47752 Tested on: Windows 10 / Server 2019 Default credentials: admin/admin...