Browse CVEs

HIGH 7.8 CVE-2023-29059 3CX DesktopApp through 18.12.416 has embedded malicious code, as exploited in the wild in March 2023. This affects versions 18.12.407 and 18.12.416 o… 3cx No fix yet Fix from $1,9502023-03-30 HIGH 7.8 CVE-2019-14935 3CX Phone 15 on Windows has insecure permissions on the "%PROGRAMDATA%\3CXPhone for Windows\PhoneApp" installation directory, allowing Full Control a… 3cx No fix yet Fix from $1,9502019-08-12 HIGH 7.5 CVE-2019-13176 An issue was discovered in the 3CX Phone system (web) management console 12.5.44178.1002 through 12.5 SP2. The Content.MainForm.wgx component is affe… 3cx No fix yet Fix from $1,9502019-08-08 MEDIUM 6.1 CVE-2018-18460 XSS exists in the wp-live-chat-support v8.0.15 plugin for WordPress via the modules/gdpr.php term parameter in a wp-admin/admin.php wplivechat-menu-g… Live Chat No fix yet Fix from $1,6002018-10-18 MEDIUM 6.1 CVE-2018-14905 The Web server in 3CX version 15.5.8801.3 is vulnerable to Reflected XSS on the api/CallLog TimeZoneName parameter. 3cx Web Server No fix yet Fix from $1,6002018-08-03 MEDIUM 6.1 CVE-2018-14906 The Web server in 3CX version 15.5.8801.3 is vulnerable to Reflected XSS on all stack traces' propertyPath parameters. 3cx Web Server No fix yet Fix from $1,6002018-08-03 MEDIUM 5.3 CVE-2018-14907 The Web server in 3CX version 15.5.8801.3 is vulnerable to Information Leakage, because of improper error handling in Stack traces, as demonstrated b… 3cx Web Server No fix yet Fix from $1,6002018-08-03 MEDIUM 6.5 CVE-2018-7654 On 3CX 15.5.6354.2 devices, the parameter "file" in the request "/api/RecordingList/download?file=" allows full access to files on the server via pat… 3cx Mitigation only Fix from $1,6002018-03-04 MEDIUM 6.5 CVE-2017-15359EPSS 6% In the 3CX Phone System 15.5.3554.1, the Management Console typically listens to port 5001 and is prone to a directory traversal attack: "/api/Record… 3cx No fix yet Fix from $1,6002017-10-18 HIGH 7.8 CVE-2008-6895 3CX Phone System 6.0.806.0 allows remote attackers to cause a denial of service (unstable service or crash) via unspecified vectors, as demonstrated … Phone System Mitigation only Fix from $1,9502009-08-03 MEDIUM 5.0 CVE-2008-6896 login.php in 3CX Phone System 6.0.806.0, when 100% disk capacity is reached, allows remote attackers to gain sensitive information via unspecified ve… Phone System Mitigation only Fix from $1,6002009-08-03