CVE-2016-6562: Improper Certificate Validation

On iOS and Android devices, the ShoreTel Mobility Client app version 9.1.3.109 fails to properly validate SSL certificates provided by HTTPS connections, which means that an attacker in the position to perform MITM attacks may be able to obtain sensitive account information such as login...

Exploiting ShoreTel Communicator through Situational Awareness

The post Exploiting ShoreTel Communicator through Situational Awareness appeared first on Rhino Security Labs...

PT-2017-3787 · Mitel · Shoretel Connect Onsite

Name of the Vulnerable Software and Affected Versions: ShoreTel Connect ONSITE version 18.82.2000.0 Description: A reflected Cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the page parameter. This is related to the lack of protection measures for...

ShoreTel Mobility Client mobile application does not verify SSL certificates

Overview ShoreTel Mobility Client for iOS and Android, version 9.1.3.109 and earlier, fails to properly validate SSL certificates provided by HTTPS connections, which may enable an attacker to conduct man-in-the-middle MITM attacks. Description CWE-295: Improper Certificate Validation -...

ShoreTel Connect ONSITE - Blind SQL Injection

ShoreTel Connect ONSITE - Blind SQL Injection Exploit Title: ShoreTel Connect ONSITE Blind SQL Injection Vulnerability Date: 19-09-2016 Software Link: https://www.shoretel.com/resource-center/shoretel-connect-onsite-overview Exploit Author: Iraklis Mathiopoulos Contact: https://twitter.com/imath...

ShoreTel Connect ONSITE Blind SQL Injection

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ShoreTel Connect ONSITE Blind SQL Injection Vulnerability ======================================================================= vulnerability type: Unauthenticated Blind SQL Injection product: ShoreTel Connect ONSITE vulnerable version: 20.xx.xxxx...

ShoreTel Connect ONSITE - Blind SQL Injection

Exploit Title: ShoreTel Connect ONSITE Blind SQL Injection Vulnerability Date: 19-09-2016 Software Link: https://www.shoretel.com/resource-center/shoretel-connect-onsite-overview Exploit Author: Iraklis Mathiopoulos Contact: https://twitter.com/imath Website: https://medium.com/@iraklis Category:...

ShoreTel Connect ONSITE - Blind SQL Injection

Exploit for php platform in category web applications Exploit Title: ShoreTel Connect ONSITE Blind SQL Injection Vulnerability Date: 19-09-2016 Software Link: https://www.shoretel.com/resource-center/shoretel-connect-onsite-overview Exploit Author: Iraklis Mathiopoulos Contact:...

ShoreTel ShoreWare Director Remote Security Bypass Vulnerability

ShoreWare Director is prone to a remote security bypass vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

ShoreTel ShoreWare Director Detection

The script sends a connection request to the server and attempts to extract the version number from the reply. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifie...