Browse CVEs

HIGH 7.2 CVE-2024-53564 A vulnerability was discovered in FreePBX 17.0.19.17. It does not verify the type of uploaded (valid FreePBX module) files, allowing high-privilege a… Freepbx Mitigation only Fix from $1,9502024-12-02 MEDIUM 5.7 CVE-2024-42491 Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.24.3, 20.9.3, and 21.4.3 of Asterisk and versions 18.9-cert12 and 20.7… Asterisk 18.9 / 18.24.3+ Fix from $1,6002024-09-05 MEDIUM 5.3 CVE-2024-35190 Asterisk is an open source private branch exchange and telephony toolkit. After upgrade to 18.23.0, ALL unauthorized SIP requests are identified as P… Asterisk Patch available Fix from $1,6002024-05-17 HIGH 8.8 CVE-2023-43336 Sangoma Technologies FreePBX before cdr 15.0.18, 16.0.40, 15.0.16, and 16.0.17 was discovered to contain an access control issue via a modified param… Freepbx 15.0.16 / 15.0.18+ Fix from $1,9502023-11-02 HIGH 8.1 CVE-2023-26567 Sangoma FreePBX 1805 through 2302 (when obtained as a ,.ISO file) places AMPDBUSER, AMPDBPASS, AMPMGRUSER, and AMPMGRPASS in the list of global varia… Freepbx Linux 7 Mitigation only Fix from $1,9502023-04-26 MEDIUM 6.1 CVE-2019-25090 A vulnerability was found in FreePBX arimanager up to 13.0.5.3 and classified as problematic. Affected by this issue is some unknown functionality of… Freepbx 13.0.5.4+ Fix from $1,6002022-12-27 MEDIUM 6.1 CVE-2021-4282 A vulnerability was found in FreePBX voicemail. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of th… Voicemail 14.0.6.25+ Fix from $1,6002022-12-27 MEDIUM 5.4 CVE-2021-4283 A vulnerability was found in FreeBPX voicemail. It has been rated as problematic. Affected by this issue is some unknown functionality of the file vi… Voicemail 14.0.6.25+ Fix from $1,6002022-12-27 CRITICAL 9.8 CVE-2020-36630 A vulnerability was found in FreePBX cdr 14.0. It has been classified as critical. This affects the function ajaxHandler of the file ucp/Cdr.class.ph… Freepbx 14.0.5.21+ Fix from $2,3002022-12-25 HIGH 7.5 CVE-2022-37325 In Sangoma Asterisk through 16.28.0, 17.x and 18.x through 18.14.0, and 19.x through 19.6.0, an incoming Setup message to addons/ooh323c/src/ooq931.c… Asterisk 16.29.1 / 18.15.1+ Fix from $1,9502022-12-05 MEDIUM 6.5 CVE-2022-42705 A use-after-free in res_pjsip_pubsub.c in Sangoma Asterisk 16.28, 18.14, 19.6, and certified/18.9-cert2 may allow a remote authenticated attacker to … Asterisk 16.29.1 / 18.15.1+ Fix from $1,6002022-12-05 MEDIUM 5.3 CVE-2021-45310 Sangoma Technologies Corporation Switchvox Version 102409 is affected by an information disclosure vulnerability due to an improper access restrictio… Switchvox No fix yet Fix from $1,6002022-02-14 CRITICAL 9.8 CVE-2021-45461EPSS 20% FreePBX, when restapps (aka Rest Phone Apps) 15.0.19.87, 15.0.19.88, 16.0.18.40, or 16.0.18.41 is installed, allows remote attackers to execute arbit… Restapps No fix yet Fix from $2,3002021-12-22 CRITICAL 9.8 CVE-2020-10666 The restapps (aka Rest Phone apps) module for Sangoma FreePBX and PBXact 13, 14, and 15 through 15.0.19.2 allows remote code execution via a URL vari… Restapps after 15.0.19.2 Fix from $2,3002021-05-31 HIGH 7.2 CVE-2019-19538 In Sangoma FreePBX 13 through 15 and sysadmin (aka System Admin) 13.0.92 through 15.0.13.6 modules have a Remote Command Execution vulnerability that… Freepbx 13.0.92 / 14.0.38.3+ Fix from $1,9502020-03-16 CRITICAL 9.8 CVE-2019-19006 KEVEPSS 37% Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control. Freepbx after 15.0.16.26 Fix from $2,3002019-11-21 CRITICAL 9.8 CVE-2019-12147 The Sangoma Session Border Controller (SBC) 2.3.23-119 GA web interface is vulnerable to Argument Injection via special characters in the username fi… Session Border Controller Firmware No fix yet Fix from $2,3002019-10-22 CRITICAL 9.8 CVE-2019-12148 The Sangoma Session Border Controller (SBC) 2.3.23-119 GA web interface is vulnerable to an authentication bypass via an argument injection vulnerabi… Session Border Controller Firmware No fix yet Fix from $2,3002019-10-22 MEDIUM 6.5 CVE-2018-12228EPSS 7% An issue was discovered in Asterisk Open Source 15.x before 15.4.1. When connected to Asterisk via TCP/TLS, if the client abruptly disconnects, or se… Asterisk 15.4.1+ Fix from $1,6002018-06-12 HIGH 7.2 CVE-2018-6393 FreePBX 10.13.66-32bit and 14.0.1.24 (SNG7-PBX-64bit-1712-2) allow post-authentication SQL injection via the order parameter. NOTE: the vendor disput… Freepbx No fix yet Fix from $1,9502018-01-29 CRITICAL 9.8 CVE-2017-17430 Sangoma NetBorder / Vega Session Controller before 2.3.12-80-GA allows remote attackers to execute arbitrary commands via the web interface. Netborder\/vega Session Firmware Mitigation only Fix from $2,3002017-12-07 HIGH 7.5 CVE-2017-9358 A memory exhaustion vulnerability exists in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1 and Certified Asterisk 13.13 before 13.13… Asterisk Mitigation only Fix from $1,9502017-06-02 HIGH 7.5 CVE-2012-4869EPSS 70% The callme_startcall function in recordings/misc/callme_page.php in FreePBX 2.9, 2.10, and earlier allows remote attackers to execute arbitrary comma… Freepbx after 2.10 Fix from $1,9502012-09-06 MEDIUM 6.5 CVE-2010-3490EPSS 9% Directory traversal vulnerability in page.recordings.php in the System Recordings component in the configuration interface in FreePBX 2.8.0 and earli… Freepbx after 2.8.0 Fix from $1,6002010-09-28 HIGH 10.0 CVE-2008-6598 Multiple race conditions in WANPIPE before 3.3.6 have unknown impact and attack vectors related to "bri restart logic." Wanpipe No fix yet Fix from $1,9502009-04-03