CVE-2018-19927

Zenitel Norway IP-StationWeb before 4.2.3.9 allows stored XSS via the Display Name for Station Status or Account Settings, related to the goform/zFormsavechanges sipnick parameter. The password of alphaadmin for the admin account may be used for authentication in some cases...

PT-2018-15171

Name of the Vulnerable Software and Affected Versions Zenitel Norway IP-StationWeb versions prior to 4.2.3.9 Description The issue allows for stored XSS via the Display Name for Station Status or Account Settings, related to the goform/zForm save changes sip nick parameter. In some cases, the...