CVE-2020-7351

CVE-2020-7351 describes an authenticated OS command injection in Fonality Trixbox Community Edition, affecting the endpoint_devicemap.php component. The vulnerability allows execution of arbitrary OS commands as the user asterisk via the network POST parameter in /maint/modules/endpointcfg/endpoi...

CVE-2017-14537

Affected software: Trixbox 2.8.0.4. Vulnerability: Path traversal via the xajaxargs array parameter to /maint/index.php?packages or the lang parameter to /maint/modules/home/index.php. Root cause / details: Inadequate validation of user-supplied parameters leads to path traversal. Impact: Could a...

CVE-2017-14535

CVE-2017-14535 affects Trixbox 2.8.0.4, vulnerable to an OS command-injection via shell metacharacters in the lang parameter of /maint/modules/home/index.php. The root cause is improper handling of input in this parameter, enabling remote command execution. Documented impact states successful exp...

CVE-2014-5111

Fonality trixbox is affected by multiple Local File Inclusion (LFI) vulnerabilities that allow an attacker to read arbitrary files via a .. in the lang parameter in maint/modules/ pages (home/index.php, asterisk_info/asterisk_info.php, repo/repo.php, endpointcfg/endpointcfg.php). The underlying i...

CVE-2010-0702

CVE-2010-0702 affects Fonality Trixbox 2.2.4, via cisco/services/PhoneDirectory.php (PhoneDirectory.php) where the ID parameter is not sanitized, enabling SQL injection. Public sources (NVD, CVE lists, PRION/Nessus plugin) describe remote attacker ability to manipulate queries and potentially dis...

CVE-2014-5110

The CVE-2014-5110 entry describes a Cross-site scripting (XSS) vulnerability in Fonality trixbox, specifically affecting the file user/help/html/index.php and exploitable via the id_nodo parameter. Connected documents confirm the vulnerability type and affected component, with CVSS metrics indica...

CVE-2014-5109

CVE-2014-5109 describes a SQL injection in Fonality trixbox: vulnerable in maint/modules/endpointcfg/endpoint_generic.php, where the mac parameter in a Submit action can be exploited remotely to execute arbitrary SQL commands. Affected software is Fonality trixbox (Trixbox), with the vulnerabilit...

CVE-2017-14536

CVE-2017-14536 affects the trixbox 2.8.0.4 release and is a cross-site scripting (XSS) vulnerability triggered via PATH_INFO to /maint/index.php or /user/includes/language/langChooser.php. The available data describe the vulnerability as an XSS flaw without details on exploitation steps, affected...

CVE-2007-6424

CVE-2007-6424 affects Fonality Trixbox 2.0 PBX; the registry.pl script reads commands from a remote site without proper origin validation, enabling a DNS spoofing vector that lets remote attackers disable Trixbox and execute arbitrary commands. Affected component: registry.pl; root cause: insuffi...

CVE-2014-5112

CVE-2014-5112 affects Fonality trixbox (maint/modules/home/index.php) and allows remote attackers to execute arbitrary commands via shell metacharacters in the lang parameter. Exploitation status is evidenced by multiple feeds, including an exploit note on CIRCL’s sighting pointing to Exploit-DB ...