CVE-2018-19926

Zenitel Norway IP-StationWeb

CVE-2018-19927

Zenitel Norway IP-StationWeb before 4.2.3.9 is affected by a stored XSS vulnerability in the Display Name fields for Station Status or Account Settings, triggered via the goform/zForm_save_changes sip_nick parameter. The issue can be compounded by the potential use of the admin account password (...