CVE-2024-24386

VitalPBX - CVE-2024-24386 漏洞标题：命令注入 作者：Erick Duarte 版本： 3.2.5-2 该漏洞出现在使用任务管理器模块结合Cron Profile时。要利用此漏洞，我们需要在操作系统中的特定文件夹中放置一个脚本。该文件夹为"/var/lib/vitalpbx/scripts"。 出于好奇，我开始使用Burp分析发送到服务器的内容。为此，我创建了一个Cron Profile，使其每分钟执行一次。 接下来，我继续创建任务管理器。...

EUVD-2023-12536

Malicious code in bioql PyPI...

EUVD-2023-12532

Malicious code in bioql PyPI...

EUVD-2022-33672

Malicious code in bioql PyPI...

CVE-2024-24386

An issue in VitalPBX v.3.2.4-5 allows an attacker to execute arbitrary code via a crafted payload to the /var/lib/vitalpbx/scripts folder...

CVE-2023-0486

VitalPBX version 3.2.3-8 allows an unauthenticated external attacker to obtain the instance's administrator account via a malicious link. This is possible because the application is vulnerable to XSS...

CVE-2023-0480

VitalPBX version 3.2.3-8 allows an unauthenticated external attacker to obtain the instance administrator's account. This is possible because the application is vulnerable to CSRF...

CVE-2022-29330

Missing access control in the backup system of Telesoft VitalPBX before 3.2.1 allows attackers to access the PJSIP and SIP extension credentials, cryptographic keys and voicemails files via unspecified vectors...

The vulnerability of the Task Manager module of the VitalPBX unified communication system allows a hacker to execute arbitrary commands.

The vulnerability of the Task Manager module of the VitalPBX unified communication system is related to errors in access control due to insufficient protection of service data during script processing from the /var/lib/vitalpbx directory. Exploiting this vulnerability allows a remote attacker to...

CVE-2024-24386

An issue in VitalPBX v.3.2.4-5 allows an attacker to execute arbitrary code via a crafted payload to the /var/lib/vitalpbx/scripts folder...

CVE-2024-24386

An issue in VitalPBX v.3.2.4-5 allows an attacker to execute arbitrary code via a crafted payload to the /var/lib/vitalpbx/scripts folder...

Design/Logic Flaw

An issue in VitalPBX v.3.2.4-5 allows an attacker to execute arbitrary code via a crafted payload to the /var/lib/vitalpbx/scripts folder...

CVE-2024-24386

An issue in VitalPBX v.3.2.4-5 allows an attacker to execute arbitrary code via a crafted payload to the /var/lib/vitalpbx/scripts folder...

VitalPBX Security Breach

VitalPBX is an Asterisk-based unified communications PBX system. A security vulnerability exists in VitalPBX version v.3.2.4-5 that originates from a vulnerability that allows an attacker to execute arbitrary code via a crafted payload...

CVE-2024-24386

An issue in VitalPBX v.3.2.4-5 allows an attacker to execute arbitrary code via a crafted payload to the /var/lib/vitalpbx/scripts folder...

CVE-2024-24386

The VitalPBX unified communications system (versions

CVE-2024-24386: Improper Access Control

An issue in VitalPBX v.3.2.4-5 allows an attacker to execute arbitrary code via a crafted payload to the /var/lib/vitalpbx/scripts folder...

Exploit for Improper Access Control in Vitalpbx

VitalPBX - CVE-2024-24386 Vulnerability Title: Command Inject...

PT-2024-1831

Name of the Vulnerable Software and Affected Versions VitalPBX versions 3.2.4 through 3.2.5 Description The issue is related to insufficient protection of service data when processing a script from the /var/lib/vitalpbx directory, allowing an attacker to execute arbitrary code via a crafted...

CVE-2023-0480

VitalPBX version 3.2.3-8 allows an unauthenticated external attacker to obtain the instance administrator's account. This is possible because the application is vulnerable to CSRF...