Cross site scripting

Cross-site scripting XSS vulnerability in user/help/html/index.php in Fonality trixbox allows remote attackers to inject arbitrary web script or HTML via the idnodo parameter...

Directory traversal

Multiple directory traversal vulnerabilities in Fonality trixbox allow remote attackers to read arbitrary files via a .. dot dot in the lang parameter to 1 home/index.php, 2 asteriskinfo/asteriskinfo.php, 3 repo/repo.php, or 4 endpointcfg/endpointcfg.php in maint/modules/...

Code injection

maint/modules/home/index.php in Fonality trixbox allows remote attackers to execute arbitrary commands via shell metacharacters in the lang parameter...

Sql injection

SQL injection vulnerability in maint/modules/endpointcfg/endpointgeneric.php in Fonality trixbox allows remote attackers to execute arbitrary SQL commands via the mac parameter in a Submit action...

CVE-2014-5112

CVE-2014-5112 affects Fonality trixbox (maint/modules/home/index.php) and allows remote attackers to execute arbitrary commands via shell metacharacters in the lang parameter. Exploitation status is evidenced by multiple feeds, including an exploit note on CIRCL’s sighting pointing to Exploit-DB ...

CVE-2014-5109

CVE-2014-5109 describes a SQL injection in Fonality trixbox: vulnerable in maint/modules/endpointcfg/endpoint_generic.php, where the mac parameter in a Submit action can be exploited remotely to execute arbitrary SQL commands. Affected software is Fonality trixbox (Trixbox), with the vulnerabilit...

CVE-2014-5110

The CVE-2014-5110 entry describes a Cross-site scripting (XSS) vulnerability in Fonality trixbox, specifically affecting the file user/help/html/index.php and exploitable via the id_nodo parameter. Connected documents confirm the vulnerability type and affected component, with CVSS metrics indica...

CVE-2014-5111

Multiple directory traversal vulnerabilities in Fonality trixbox allow remote attackers to read arbitrary files via a .. dot dot in the lang parameter to 1 home/index.php, 2 asteriskinfo/asteriskinfo.php, 3 repo/repo.php, or 4 endpointcfg/endpointcfg.php in maint/modules/...

CVE-2014-5110

Cross-site scripting XSS vulnerability in user/help/html/index.php in Fonality trixbox allows remote attackers to inject arbitrary web script or HTML via the idnodo parameter...

CVE-2014-5109

SQL injection vulnerability in maint/modules/endpointcfg/endpointgeneric.php in Fonality trixbox allows remote attackers to execute arbitrary SQL commands via the mac parameter in a Submit action...

CVE-2014-5111

Fonality trixbox is affected by multiple Local File Inclusion (LFI) vulnerabilities that allow an attacker to read arbitrary files via a .. in the lang parameter in maint/modules/ pages (home/index.php, asterisk_info/asterisk_info.php, repo/repo.php, endpointcfg/endpointcfg.php). The underlying i...

CVE-2014-5112

maint/modules/home/index.php in Fonality trixbox allows remote attackers to execute arbitrary commands via shell metacharacters in the lang parameter...

Fonality trixbox - index.php Directory Traversal

Fonality trixbox - index.php Directory Traversal source: https://www.securityfocus.com/bid/68719/info ol-commerce is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input. Exploiting these...

Fonality trixbox - repo.php Directory Traversal

Fonality trixbox - repo.php Directory Traversal source: https://www.securityfocus.com/bid/68719/info ol-commerce is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input. Exploiting these...

Fonality trixbox - 'asterisk_info.php' Directory Traversal

source: https://www.securityfocus.com/bid/68719/info ol-commerce is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input. Exploiting these vulnerabilities could allow an attacker to steal...

Fonality trixbox - 'repo.php' Directory Traversal

source: https://www.securityfocus.com/bid/68719/info ol-commerce is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input. Exploiting these vulnerabilities could allow an attacker to steal...

Fonality trixbox - 'mac' Remote Code Injection

App : Trixbox all versions vendor : trixbox.com Author : i-Hmx mail : [email protected] Home : security arrays inc , sec4ever.com ,exploit4arab.net Well well well , we decided to give schmoozecom a break and have a look @ fonality products do you think they have better product than the Award...

Fonality trixbox - mac Remote Code Injection

Fonality trixbox - mac Remote Code Injection App : Trixbox all versions vendor : trixbox.com Author : i-Hmx mail : [email protected] Home : security arrays inc , sec4ever.com ,exploit4arab.net Well well well , we decided to give schmoozecom a break and have a look @ fonality products do you think...

Sql injection

SQL injection vulnerability in cisco/services/PhonecDirectory.php in Fonality Trixbox 2.2.4 allows remote attackers to execute arbitrary SQL commands via the ID parameter...

CVE-2010-0702

CVE-2010-0702 affects Fonality Trixbox 2.2.4, via cisco/services/PhoneDirectory.php (PhoneDirectory.php) where the ID parameter is not sanitized, enabling SQL injection. Public sources (NVD, CVE lists, PRION/Nessus plugin) describe remote attacker ability to manipulate queries and potentially dis...