CVSS: 6.1EPSS: 2%CPEs: 2EXPL: 5CVE-2009-4458 – FreePBX 2.5.2 - '/admin/config.php?tech' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2009-4458
30 Dec 2009 — Multiple cross-site scripting (XSS) vulnerabilities in FreePBX 2.5.2 and 2.6.0rc2, and possibly other versions, allow remote attackers to inject arbitrary web script or HTML via the (1) tech parameter to admin/admin/config.php during a trunks display action, the (2) description parameter during an Add Zap Channel action, and (3) unspecified vectors during an Add Recordings action. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en FreePBX v2.5.2 y v2.6.0rc2, y probablemente otr... • https://www.exploit-db.com/exploits/33442 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 11EXPL: 0CVE-2009-1801
https://notcve.org/view.php?id=CVE-2009-1801
28 May 2009 — Multiple cross-site scripting (XSS) vulnerabilities in FreePBX 2.5.1, and other 2.4.x, 2.5.x, and pre-release 2.6.x versions, allow remote attackers to inject arbitrary web script or HTML via the (1) display parameter to reports.php, the (2) order and (3) extdisplay parameters to config.php, and the (4) sort parameter to recordings/index.php. NOTE: some of these details are obtained from third party information. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados(XSS) en Fre... • http://freepbx.org/trac/ticket/3660 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 12EXPL: 0CVE-2009-1802
https://notcve.org/view.php?id=CVE-2009-1802
28 May 2009 — Multiple cross-site request forgery (CSRF) vulnerabilities in FreePBX 2.5.1, and other 2.4.x, 2.5.x, and pre-release 2.6.x versions, allow remote attackers to hijack the authentication of admins for requests that create a new admin account or have unspecified other impact. Múltiples vulnerabilidades de falsificación de petición en sitios cruzados (CSRF) en FreePBX 2.5.1, y otros 2.4.x, 2.5.x, y versiones pre-lanzamiento 2.6.x, permiten a atacantes remotos secuestrar la autenticación de administradores en pe... • http://freepbx.org/trac/ticket/3660 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.3EPSS: 0%CPEs: 12EXPL: 0CVE-2009-1803
https://notcve.org/view.php?id=CVE-2009-1803
28 May 2009 — FreePBX 2.5.1, and other 2.4.x, 2.5.x, and pre-release 2.6.x versions, generates different error messages for a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. FreePBX v2.5.1, v2.4.x, v2.5.x, y pre-release v2.6.x, genera distintos errores tras intentos de login fallidos dependiendo de si la cuenta de usuario existe o no, lo que permite a atacantes remotos listar nombres de usuarios váalidos. • http://freepbx.org/trac/ticket/3660 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 1CVE-2007-2350
https://notcve.org/view.php?id=CVE-2007-2350
30 Apr 2007 — admin/config.php in the music-on-hold module in freePBX 2.2.x allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the del parameter. admin/config.php en el módulo music-on-hold de freePBX 2.2.x permite a administradores remotos autenticados ejecutar comandos de su elección mediante meta-caracteres de consola de comandos en el parámetro del. • http://lists.grok.org.uk/pipermail/full-disclosure/2007-April/053915.html •
CVSS: 6.8EPSS: 8%CPEs: 9EXPL: 2CVE-2007-2191 – FreePBX 2.2 - SIP Packet Multiple HTML Injection Vulnerabilities
https://notcve.org/view.php?id=CVE-2007-2191
24 Apr 2007 — Multiple cross-site scripting (XSS) vulnerabilities in freePBX 2.2.x allow remote attackers to inject arbitrary web script or HTML via the (1) From, (2) To, (3) Call-ID, (4) User-Agent, and unspecified other SIP protocol fields, which are stored in /var/log/asterisk/full and displayed by admin/modules/logfiles/asterisk-full-log.php. Múltiples vulnerabilidades de secuencia de comandos en sitios cruzados (XSS) en freePBX 2.2.x permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de ... • https://www.exploit-db.com/exploits/29873 •
CVSS: 9.8EPSS: 3%CPEs: 1EXPL: 2CVE-2006-7107 – FreePBX 2.1.3 - 'upgrade.php' Remote File Inclusion
https://notcve.org/view.php?id=CVE-2006-7107
03 Mar 2007 — PHP remote file inclusion vulnerability in upgrade.php in Coalescent Systems freePBX 2.1.3 allows remote attackers to execute arbitrary PHP code via a URL in the amp_conf[AMPWEBROOT] parameter. Vulnerabilidad PHP de inclusión remota de archivo en upgrade.php en Coalescent Systems freePBX 2.1.3 permite a atacantes remotos ejecutar código PHP de su elección a través de una URL en el parámetro amp_conf[AMPWEBROOT]. • https://www.exploit-db.com/exploits/2665 •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2006-6244
https://notcve.org/view.php?id=CVE-2006-6244
04 Dec 2006 — Coalescent Systems freePBX (formerly Asterisk Management Portal) before 2.2.0rc1 allows attackers to execute arbitrary commands via shell metacharacters in (1) CALLERID(name) or (2) CALLERID(number). Coalescent Systems freePBX (anteriormente Asterisk Management Portal) anterior a 2.2.0rc1 permite a atacantes remotos ejecutar comandos de su elección mediante metacaracteres de línea de comandos en (1) CALLERID(nombre) o (2) CALLERID(número). • http://secunia.com/advisories/23124 •