157 matches found
trixbox Dashboard user/index.php langChoice Parameter Local File Inclusion
The version of trixbox dashboard installed on the remote host fails to sanitize user-supplied input to the 'langChoice' parameter of the 'user/index.php' script before using it to include PHP code. Regardless of PHP's 'registerglobals' setting, an unauthenticated attacker could leverage this issu...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in trixbox 2.4.2.0 allow remote attackers to inject arbitrary web script or HTML via the query string to index.php in 1 user/ or 2 maint/...
CVE-2008-0540
Multiple cross-site scripting XSS vulnerabilities in trixbox 2.4.2.0 allow remote attackers to inject arbitrary web script or HTML via the query string to index.php in 1 user/ or 2 maint/...
CVE-2008-0540
Multiple cross-site scripting XSS vulnerabilities in trixbox 2.4.2.0 allow remote attackers to inject arbitrary web script or HTML via the query string to index.php in 1 user/ or 2 maint/...
CVE-2008-0540
CVE-2008-0540 affects trixbox 2.4.2.0 and concerns reflected/cross-site scripting in index.php via the query string in (1) user/ and (2) maint/. The root cause is unvalidated input in query parameters leading to injection of arbitrary script/HTML. Public disclosures in NVD and related feeds confi...
Fonality trixbox 2.4.2 - Cross-Site Scripting (1)
source: https://www.securityfocus.com/bid/27460/info The 'trixbox' product is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an...
Fonality trixbox 2.4.2 - Cross-Site Scripting (2)
Fonality trixbox 2.4.2 - Cross-Site Scripting 2 source: https://www.securityfocus.com/bid/27460/info The 'trixbox' product is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker may leverage these issues to...
Fonality trixbox 2.4.2 - Cross-Site Scripting (1)
Fonality trixbox 2.4.2 - Cross-Site Scripting 1 source: https://www.securityfocus.com/bid/27460/info The 'trixbox' product is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker may leverage these issues to...
Fonality trixbox 2.4.2 - Cross-Site Scripting (2)
source: https://www.securityfocus.com/bid/27460/info The 'trixbox' product is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an...
CVE-2007-6424
registry.pl in Fonality Trixbox 2.0 PBX products, when running in certain environments, reads and executes a set of commands from a remote web site without sufficiently validating the origin of the commands, which allows remote attackers to disable trixbox and execute arbitrary commands via a DNS...
Command injection
registry.pl in Fonality Trixbox 2.0 PBX products, when running in certain environments, reads and executes a set of commands from a remote web site without sufficiently validating the origin of the commands, which allows remote attackers to disable trixbox and execute arbitrary commands via a DNS...
CVE-2007-6424
CVE-2007-6424 affects Fonality Trixbox 2.0 PBX; the registry.pl script reads commands from a remote site without proper origin validation, enabling a DNS spoofing vector that lets remote attackers disable Trixbox and execute arbitrary commands. Affected component: registry.pl; root cause: insuffi...
CVE-2007-6424
registry.pl in Fonality Trixbox 2.0 PBX products, when running in certain environments, reads and executes a set of commands from a remote web site without sufficiently validating the origin of the commands, which allows remote attackers to disable trixbox and execute arbitrary commands via a DNS...
PT-2007-7276 · Fonality · Fonality Trixbox
Name of the Vulnerable Software and Affected Versions: Fonality Trixbox version 2.0 Description: The issue allows remote attackers to execute arbitrary commands via a DNS spoofing attack, as the registry.pl script reads and executes commands from a remote web site without proper validation. This...
phone-sqlxss.txt
In a previous post http://seclists.org/fulldisclosure/2007/Oct/0174.html , we have seen how XSS injection can be performed over SIP to inject malicious JavaScript into the browser of an user that check the call history of his phone. In this post, we will detail how XSS injection can be performed...