Vulnerabilities

TI-2016-02125 CVE-2016-2364 · GHSA-cwhh-p654-4p5p

The Chrome HUDweb plugin before 2016-05-05 for Fonality (previously trixbox Pro) 12.6…

LOW 37

The Chrome HUDweb plugin before 2016-05-05 for Fonality (previously trixbox Pro) 12.6 through 14.1i uses the same hardcoded private key across different customers' installations, which allows remote attackers to defeat c…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.02283 Published 2016-06-20 No fix listed CWE-310

TI-2016-02124 CVE-2016-2363 · GHSA-8qhv-pgj9-3529

Fonality (previously trixbox Pro) 12.6 through 14.1i before 2016-06-01 uses weak…

LOW 35

Fonality (previously trixbox Pro) 12.6 through 14.1i before 2016-06-01 uses weak permissions for the /var/www/rpc/surun script, which allows local users to obtain root access for unspecified command execution by leveragi…

CVSS 3.0HIGH 7.8 Local Low privileges No interaction EPSS 0.00584 Published 2016-06-20 No fix listed CWE-264

TI-2016-02123 CVE-2016-2362 · GHSA-m9hq-6jrr-f23g

Fonality (previously trixbox Pro) 12.6 through 14.1i before 2016-06-01 has a hardcoded…

MEDIUM 47

Fonality (previously trixbox Pro) 12.6 through 14.1i before 2016-06-01 has a hardcoded password for the FTP account, which allows remote attackers to obtain access via a (1) FTP or (2) SSH connection.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02465 Published 2016-06-20 No fix listed

Vulnerabilities

Filters

The Chrome HUDweb plugin before 2016-05-05 for Fonality (previously trixbox Pro) 12.6…

Fonality (previously trixbox Pro) 12.6 through 14.1i before 2016-06-01 uses weak…

Fonality (previously trixbox Pro) 12.6 through 14.1i before 2016-06-01 has a hardcoded…