Trixbox Security Vulnerabilities and Issues — Trixbox CVE List

Lucene search

NetfortrisTrixbox

10 matches found

CVE•added 2020/05/01 4:15 p.m.•195 views

CVE-2020-7351

An OS Command Injection vulnerability in the endpoint_devicemap.php component of Fonality Trixbox Community Edition allows an attacker to execute commands on the underlying operating system as the "asterisk" user. Note that Trixbox Community Edition has been unsupported by the vendor since 2012. Th...

9CVSS8.3AI score0.69959EPSS

CVE•added 2018/02/16 4:29 a.m.•94 views

CVE-2017-14535

trixbox 2.8.0.4 has OS command injection via shell metacharacters in the lang parameter to /maint/modules/home/index.php.

9CVSS8.9AI score0.91393EPSS

CVE•added 2018/02/16 4:29 a.m.•94 views

CVE-2017-14537

trixbox 2.8.0.4 has path traversal via the xajaxargs array parameter to /maint/index.php?packages or the lang parameter to /maint/modules/home/index.php.

6.5CVSS6.4AI score0.90885EPSS

CVE•added 2010/02/23 8:30 p.m.•47 views

CVE-2010-0702

SQL injection vulnerability in cisco/services/PhonecDirectory.php in Fonality Trixbox 2.2.4 allows remote attackers to execute arbitrary SQL commands via the ID parameter.

7.5CVSS8.7AI score0.00928EPSS

CVE•added 2014/07/28 3:55 p.m.•42 views

CVE-2014-5110

Cross-site scripting (XSS) vulnerability in user/help/html/index.php in Fonality trixbox allows remote attackers to inject arbitrary web script or HTML via the id_nodo parameter.

4.3CVSS5.9AI score0.00225EPSS

CVE•added 2014/07/28 3:55 p.m.•39 views

CVE-2014-5111

Multiple directory traversal vulnerabilities in Fonality trixbox allow remote attackers to read arbitrary files via a .. (dot dot) in the lang parameter to (1) home/index.php, (2) asterisk_info/asterisk_info.php, (3) repo/repo.php, or (4) endpointcfg/endpointcfg.php in maint/modules/.

5CVSS7AI score0.76797EPSS

CVE•added 2018/02/16 4:29 a.m.•39 views

CVE-2017-14536

trixbox 2.8.0.4 has XSS via the PATH_INFO to /maint/index.php or /user/includes/language/langChooser.php.

5.4CVSS5.2AI score0.00281EPSS

CVE•added 2014/07/28 3:55 p.m.•36 views

CVE-2014-5109

SQL injection vulnerability in maint/modules/endpointcfg/endpoint_generic.php in Fonality trixbox allows remote attackers to execute arbitrary SQL commands via the mac parameter in a Submit action.

7.5CVSS8.6AI score0.00293EPSS

CVE•added 2007/12/18 7:46 p.m.•35 views

CVE-2007-6424

registry.pl in Fonality Trixbox 2.0 PBX products, when running in certain environments, reads and executes a set of commands from a remote web site without sufficiently validating the origin of the commands, which allows remote attackers to disable trixbox and execute arbitrary commands via a DNS s...

4.3CVSS7.4AI score0.00591EPSS

CVE•added 2014/07/28 3:55 p.m.•32 views

CVE-2014-5112

maint/modules/home/index.php in Fonality trixbox allows remote attackers to execute arbitrary commands via shell metacharacters in the lang parameter.

7.5CVSS7.9AI score0.07201EPSS