CVSS: 9.0EPSS: 1%CPEs: 19EXPL: 0CVE-2014-8418 – Gentoo Linux Security Advisory 201412-51
https://notcve.org/view.php?id=CVE-2014-8418
24 Nov 2014 — The DB dialplan function in Asterisk Open Source 1.8.x before 1.8.32, 11.x before 11.1.4.1, 12.x before 12.7.1, and 13.x before 13.0.1 and Certified Asterisk 1.8 before 1.8.28-cert8 and 11.6 before 11.6-cert8 allows remote authenticated users to gain privileges via a call from an external protocol, as demonstrated by the AMI protocol. La función DB dialplan en Asterisk Open Source 1.8.x anterior a 1.8.32, 11.x anterior a 11.1.4.1, 12.x anterior a 12.7.1, y 13.x anterior a 13.0.1 y Certified Asterisk 1.8 ant... • http://downloads.asterisk.org/pub/security/AST-2014-018.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.5EPSS: 1%CPEs: 63EXPL: 0CVE-2014-6610 – Mandriva Linux Security Advisory 2014-218
https://notcve.org/view.php?id=CVE-2014-6610
21 Nov 2014 — Asterisk Open Source 11.x before 11.12.1 and 12.x before 12.5.1 and Certified Asterisk 11.6 before 11.6-cert6, when using the res_fax_spandsp module, allows remote authenticated users to cause a denial of service (crash) via an out of call message, which is not properly handled in the ReceiveFax dialplan application. Asterisk Open Source 11.x anterior a 11.12.1 y 12.x anterior a 12.5.1 y Certified Asterisk 11.6 anterior a 11.6-cert6, cuando utilizan el módulo res_fax_spandsp, permiten a usuarios remotos aut... • http://downloads.asterisk.org/pub/security/AST-2014-010.html • CWE-19: Data Processing Errors •
CVSS: 8.8EPSS: 3%CPEs: 54EXPL: 0CVE-2014-4046 – Asterisk Project Security Advisory - AST-2014-006
https://notcve.org/view.php?id=CVE-2014-4046
13 Jun 2014 — Asterisk Open Source 11.x before 11.10.1 and 12.x before 12.3.1 and Certified Asterisk 11.6 before 11.6-cert3 allows remote authenticated Manager users to execute arbitrary shell commands via a MixMonitor action. Asterisk Open Source 11.x anterior a 11.10.1 y 12.x anterior a 12.3.1 y Certified Asterisk 11.6 anterior a 11.6-cert3 permite a usuarios remotos autenticados Manager ejecutar comandos del sistema arbitrarios a través de una acción MixMonitor. Asterisk Open Source 11.x before 11.10.1 and 12.x before... • http://downloads.asterisk.org/pub/security/AST-2014-006.html •
CVSS: 7.5EPSS: 11%CPEs: 217EXPL: 0CVE-2014-4047 – Asterisk Project Security Advisory - AST-2014-007
https://notcve.org/view.php?id=CVE-2014-4047
13 Jun 2014 — Asterisk Open Source 1.8.x before 1.8.28.1, 11.x before 11.10.1, and 12.x before 12.3.1 and Certified Asterisk 1.8.15 before 1.8.15-cert6 and 11.6 before 11.6-cert3 allows remote attackers to cause a denial of service (connection consumption) via a large number of (1) inactive or (2) incomplete HTTP connections. Asterisk Open Source 1.8.x anterior a 1.8.28.1, 11.x anterior a 11.10.1 y 12.x anterior a 12.3.1 y Certified Asterisk 1.8.15 anterior a 1.8.15-cert6 y 11.6 anterior a 11.6-cert3 permiten a atacantes... • http://downloads.asterisk.org/pub/security/AST-2014-007.html •
CVSS: 7.5EPSS: 6%CPEs: 13EXPL: 0CVE-2014-4048 – Asterisk Project Security Advisory - AST-2014-008
https://notcve.org/view.php?id=CVE-2014-4048
13 Jun 2014 — The PJSIP Channel Driver in Asterisk Open Source before 12.3.1 allows remote attackers to cause a denial of service (deadlock) by terminating a subscription request before it is complete, which triggers a SIP transaction timeout. El controlador de canales PJSIP en Asterisk Open Source anterior a 12.3.1 permite a atacantes remotos causar una denegación de servicio (bloqueo) mediante la terminación de una solicitud de suscripción antes de que se haya completado, lo que provoca un timeout de la transacción SIP... • http://downloads.asterisk.org/pub/security/AST-2014-008.html •
CVSS: 9.1EPSS: 46%CPEs: 232EXPL: 0CVE-2014-2286 – Mandriva Linux Security Advisory 2014-078
https://notcve.org/view.php?id=CVE-2014-2286
11 Mar 2014 — main/http.c in Asterisk Open Source 1.8.x before 1.8.26.1, 11.8.x before 11.8.1, and 12.1.x before 12.1.1, and Certified Asterisk 1.8.x before 1.8.15-cert5 and 11.6 before 11.6-cert2, allows remote attackers to cause a denial of service (stack consumption) and possibly execute arbitrary code via an HTTP request with a large number of Cookie headers. main/http.c en Asterisk Open Source 1.8.x anterior a 1.8.26.1, 11.8.x anterior a 11.8.1 y 12.1.x anterior a 12.1.1 y Certified Asterisk 1.8.x anterior a 1.8.15-... • http://downloads.asterisk.org/pub/security/AST-2014-001-1.8.diff • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 27%CPEs: 232EXPL: 0CVE-2014-2287 – Mandriva Linux Security Advisory 2014-078
https://notcve.org/view.php?id=CVE-2014-2287
11 Mar 2014 — channels/chan_sip.c in Asterisk Open Source 1.8.x before 1.8.26.1, 11.8.x before 11.8.1, and 12.1.x before 12.1.1, and Certified Asterisk 1.8.15 before 1.8.15-cert5 and 11.6 before 11.6-cert2, when chan_sip has a certain configuration, allows remote authenticated users to cause a denial of service (channel and file descriptor consumption) via an INVITE request with a (1) Session-Expires or (2) Min-SE header with a malformed or invalid value. channels/chan_sip.c en Asterisk Open Source 1.8.x anterior a 1.8.2... • http://downloads.asterisk.org/pub/security/AST-2014-002-1.8.diff • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 2%CPEs: 81EXPL: 1CVE-2013-7100 – Debian Security Advisory 2835-1
https://notcve.org/view.php?id=CVE-2013-7100
19 Dec 2013 — Buffer overflow in the unpacksms16 function in apps/app_sms.c in Asterisk Open Source 1.8.x before 1.8.24.1, 10.x before 10.12.4, and 11.x before 11.6.1; Asterisk with Digiumphones 10.x-digiumphones before 10.12.4-digiumphones; and Certified Asterisk 1.8.x before 1.8.15-cert4 and 11.x before 11.2-cert3 allows remote attackers to cause a denial of service (daemon crash) via a 16-bit SMS message with an odd number of bytes, which triggers an infinite loop. Desbordamiento de búfer en la función unpacksms16 en ... • http://archives.neohapsis.com/archives/bugtraq/2013-12/0089.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 8%CPEs: 57EXPL: 0CVE-2013-5641 – Mandriva Linux Security Advisory 2013-223
https://notcve.org/view.php?id=CVE-2013-5641
30 Aug 2013 — The SIP channel driver (channels/chan_sip.c) in Asterisk Open Source 1.8.17.x through 1.8.22.x, 1.8.23.x before 1.8.23.1, and 11.x before 11.5.1 and Certified Asterisk 1.8.15 before 1.8.15-cert3 and 11.2 before 11.2-cert2 allows remote attackers to cause a denial of service (NULL pointer dereference, segmentation fault, and daemon crash) via an ACK with SDP to a previously terminated channel. NOTE: some of these details are obtained from third party information. El controlador de canal SIP (channel/chan_sip... • http://archives.neohapsis.com/archives/bugtraq/2013-08/0175.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 24%CPEs: 81EXPL: 0CVE-2013-5642 – Mandriva Linux Security Advisory 2013-223
https://notcve.org/view.php?id=CVE-2013-5642
30 Aug 2013 — The SIP channel driver (channels/chan_sip.c) in Asterisk Open Source 1.8.x before 1.8.23.1, 10.x before 10.12.3, and 11.x before 11.5.1; Certified Asterisk 1.8.15 before 1.8.15-cert3 and 11.2 before 11.2-cert2; and Asterisk Digiumphones 10.x-digiumphones before 10.12.3-digiumphones allows remote attackers to cause a denial of service (NULL pointer dereference, segmentation fault, and daemon crash) via an invalid SDP that defines a media description before the connection description in a SIP request. El cont... • http://archives.neohapsis.com/archives/bugtraq/2013-08/0174.html • CWE-20: Improper Input Validation •