TI-2018-11330 CVE-2018-15891 · GHSA-f4fj-pg4q-w4qw
An issue was discovered in FreePBX core before 3.0.122.43, 14.0.18.34, and 5.0.1beta4.
Priority LOW 23
An issue was discovered in FreePBX core before 3.0.122.43, 14.0.18.34, and 5.0.1beta4.
Vulnerabilities
9 records
TI-2014-06023 CVE-2014-7235 · GHSA-7pc8-wp58-mr3p
htdocs_ari/includes/login.php in the ARI Framework module/Asterisk Recording Interface…
Priority HIGH 72
htdocs_ari/includes/login.php in the ARI Framework module/Asterisk Recording Interface (ARI) in FreePBX before 2.9.0.9, 2.10.x, and 2.11 before 2.11.1.5 allows remote attackers to execute arbitrary code via the ari_auth…
TI-2014-01484 CVE-2014-1903 · GHSA-xvg7-pm76-82w3
admin/libraries/view.functions.php in FreePBX 2.9 before 2.9.0.14, 2.10 before 2.10.1.15…
Priority HIGH 65
admin/libraries/view.functions.php in FreePBX 2.9 before 2.9.0.14, 2.10 before 2.10.1.15, 2.11 before 2.11.0.23, and 12 before 12.0.1alpha22 does not restrict the set of functions accessible to the API handler, which all…
TI-2009-04221 CVE-2009-4458 · GHSA-vwv7-gc7p-gr26
Multiple cross-site scripting (XSS) vulnerabilities in FreePBX 2.5.2 and 2.6.0rc2, and…
Priority LOW 24
Multiple cross-site scripting (XSS) vulnerabilities in FreePBX 2.5.2 and 2.6.0rc2, and possibly other versions, allow remote attackers to inject arbitrary web script or HTML via the (1) tech parameter to admin/admin/conf…
TI-2009-01715 CVE-2009-1803 · GHSA-9cjw-w6mr-f53c
FreePBX 2.5.1, and other 2.4.x, 2.5.x, and pre-release 2.6.x versions, generates…
Priority LOW 25
FreePBX 2.5.1, and other 2.4.x, 2.5.x, and pre-release 2.6.x versions, generates different error messages for a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerat…
TI-2009-01714 CVE-2009-1802 · GHSA-qf4q-pcx7-r6cj
Multiple cross-site request forgery (CSRF) vulnerabilities in FreePBX 2.5.1, and other…
Priority LOW 31
Multiple cross-site request forgery (CSRF) vulnerabilities in FreePBX 2.5.1, and other 2.4.x, 2.5.x, and pre-release 2.6.x versions, allow remote attackers to hijack the authentication of admins for requests that create…
TI-2009-01713 CVE-2009-1801 · GHSA-h7gp-pf2c-cm42
Multiple cross-site scripting (XSS) vulnerabilities in FreePBX 2.5.1, and other 2.4.x…
Priority LOW 23
Multiple cross-site scripting (XSS) vulnerabilities in FreePBX 2.5.1, and other 2.4.x, 2.5.x, and pre-release 2.6.x versions, allow remote attackers to inject arbitrary web script or HTML via the (1) display parameter to…
TI-2007-02268 CVE-2007-2350 · GHSA-pvp3-v3gm-wmv4
admin/config.php in the music-on-hold module in freePBX 2.2.x allows remote authenticated…
Priority LOW 33
admin/config.php in the music-on-hold module in freePBX 2.2.x allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the del parameter.
TI-2007-02112 CVE-2007-2191 · GHSA-jj7h-7pwq-mjvc
Multiple cross-site scripting (XSS) vulnerabilities in freePBX 2.2.x allow remote…
Priority LOW 37
Multiple cross-site scripting (XSS) vulnerabilities in freePBX 2.2.x allow remote attackers to inject arbitrary web script or HTML via the (1) From, (2) To, (3) Call-ID, (4) User-Agent, and unspecified other SIP protocol…