FreePBX 2.5.x 2.6.0 - Persistent Cross-Site Scripting

FreePBX 2.5.x 2.6.0 - Persistent Cross-Site Scripting Advisory Name: Permanent Cross-Site Scripting XSS in FreePBX 2.5.x – 2.6.0 Internal Cybsec Advisory Id: 2010-0102 Vulnerability Class: Permanent Cross-Site Scripting XSS Release Date: 15/01/2010 Affected Applications: Confirmed in FreePBX 2.5....

FreePBX 2.5.x < 2.6.0 - Persistent Cross-Site Scripting

Advisory Name: Permanent Cross-Site Scripting XSS in FreePBX 2.5.x – 2.6.0 Internal Cybsec Advisory Id: 2010-0102 Vulnerability Class: Permanent Cross-Site Scripting XSS Release Date: 15/01/2010 Affected Applications: Confirmed in FreePBX 2.5.x and 2.6.0 - Other versions may also be affected...

FreePBX 2.5.x - Information Disclosure

Advisory Name: Information disclosure in FreePBX 2.5.x Internal Cybsec Advisory Id: 2010-0101 Vulnerability Class: Information disclosure Release Date: 15/01/2010 Affected Applications: Confirmed in FreePBX 2.5.x Other versions may also be affected Affected Platforms: Any running FreePBX2.5.x Loc...

FreePBX 2.5.x - Information Disclosure

FreePBX 2.5.x - Information Disclosure Advisory Name: Information disclosure in FreePBX 2.5.x Internal Cybsec Advisory Id: 2010-0101 Vulnerability Class: Information disclosure Release Date: 15/01/2010 Affected Applications: Confirmed in FreePBX 2.5.x Other versions may also be affected Affected...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in FreePBX 2.5.2 and 2.6.0rc2, and possibly other versions, allow remote attackers to inject arbitrary web script or HTML via the 1 tech parameter to admin/admin/config.php during a trunks display action, the 2 description parameter during an Add...

CVE-2009-4458

Multiple cross-site scripting XSS vulnerabilities in FreePBX 2.5.2 and 2.6.0rc2, and possibly other versions, allow remote attackers to inject arbitrary web script or HTML via the 1 tech parameter to admin/admin/config.php during a trunks display action, the 2 description parameter during an Add...

CVE-2009-4458

CVE-2009-4458 corresponds to multiple XSS vulnerabilities in FreePBX 2.5.2 and 2.6.0rc2 (and possibly other versions). The documented vectors are: (1) the tech parameter to admin/admin/config.php during a trunks display action, (2) the description parameter during an Add Zap Channel action, and (...

CVE-2009-4458

Multiple cross-site scripting XSS vulnerabilities in FreePBX 2.5.2 and 2.6.0rc2, and possibly other versions, allow remote attackers to inject arbitrary web script or HTML via the 1 tech parameter to admin/admin/config.php during a trunks display action, the 2 description parameter during an Add...

PBX Business Phone Application Cross Site Scripting

PenTest Information: ==================== Global-Evolution Security Team remove discover multiple Vulnerabilities on PBX Phone System Application. An attacker can get sensitive customer/admin session-data over multiple Cross-Site-Scripting vulnerabilities. Details ======= Tested on OS: Windows 7...

FreePBX 2.5.2 - adminconfig.php?tech Cross-Site Scripting

FreePBX 2.5.2 - adminconfig.php?tech Cross-Site Scripting source: https://www.securityfocus.com/bid/37482/info FreePBX is prone to a cross-site scripting vulnerability and multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in...

FreePBX 2.5.2 - '/admin/config.php?tech' Cross-Site Scripting

source: https://www.securityfocus.com/bid/37482/info FreePBX is prone to a cross-site scripting vulnerability and multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and script...

FreePBX 2.5.2 - Zap Channel Addition Description Parameter Cross-Site Scripting

source: https://www.securityfocus.com/bid/37482/info FreePBX is prone to a cross-site scripting vulnerability and multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and script...

FreePBX 2.5.2 - Zap Channel Addition Description Parameter Cross-Site Scripting

FreePBX 2.5.2 - Zap Channel Addition Description Parameter Cross-Site Scripting source: https://www.securityfocus.com/bid/37482/info FreePBX is prone to a cross-site scripting vulnerability and multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input befor...

PBX Phone System 2.x - Multiple Vulnerabilities

PBX Phone System 2.x - Multiple Vulnerabilities PenTest Information: ==================== Global-Evolution Security Team remove discover multiple Vulnerabilities on PBX Phone System Application. An attacker can get sensitive customer/admin session-data over multiple Cross-Site-Scripting...

PBX Phone System v2.x - Multiple Vulnerabilities

Exploit for unknown platform in category web applications ================================================ PBX Phone System v2.x - Multiple Vulnerabilities ================================================ PenTest Information: ==================== Global-Evolution Security Team remove discover...

PBX Phone System 2.x - Multiple Vulnerabilities

PenTest Information: ==================== Global-Evolution Security Team remove discover multiple Vulnerabilities on PBX Phone System Application. An attacker can get sensitive customer/admin session-data over multiple Cross-Site-Scripting vulnerabilities. Details ======= Tested on OS: Windows 7...

PBX Phone System v2.x - Multiple Vulnerabilities

No description provided by source. PenTest Information: ==================== Global-Evolution Security Team remove discover multiple Vulnerabilities on PBX Phone System Application. An attacker can get sensitive customer/admin session-data over multiple Cross-Site-Scripting vulnerabilities. Detai...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in FreePBX 2.5.1, and other 2.4.x, 2.5.x, and pre-release 2.6.x versions, allow remote attackers to inject arbitrary web script or HTML via the 1 display parameter to reports.php, the 2 order and 3 extdisplay parameters to config.php, and the 4 so...

CVE-2009-1802

Multiple cross-site request forgery CSRF vulnerabilities in FreePBX 2.5.1, and other 2.4.x, 2.5.x, and pre-release 2.6.x versions, allow remote attackers to hijack the authentication of admins for requests that create a new admin account or have unspecified other impact...

CVE-2009-1803

FreePBX 2.5.1, and other 2.4.x, 2.5.x, and pre-release 2.6.x versions, generates different error messages for a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames...