Skip to content

Vendor

fonality vulnerabilities

4 published CVES affecting fonality, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
4
Critical
1
High
3
Medium
0
Low
0
Unscored
0
CISA KEV
0
Atom feed of fonality alerts

Products

Latest fonality CVEs

Newest publication first

  1. CVE-2020-7351 Fonality Trixbox CE Post-Authentication Command Injection

    Published
    HighCVSS 8.8 EPSS 65.2% Framework module

    An OS Command Injection vulnerability in the endpoint_devicemap.php component of Fonality Trixbox Community Edition allows an attacker to execute commands on the underlying operating system as the "asterisk" user. Note that Trixbox Community Edition has been unsupported by the ve...

  2. CVE-2016-2364 The Chrome HUDweb plugin before 2016-05-05 for Fonality (previously trixbox Pro) 12.6 through 14.1i uses the same hardcoded private key across different customers' installations, which allows remote a...

    Published
    HighCVSS 7.5

    The Chrome HUDweb plugin before 2016-05-05 for Fonality (previously trixbox Pro) 12.6 through 14.1i uses the same hardcoded private key across different customers' installations, which allows remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge o...

  3. CVE-2016-2363 Fonality (previously trixbox Pro) 12.6 through 14.1i before 2016-06-01 uses weak permissions for the /var/www/rpc/surun script, which allows local users to obtain root access for unspecified command e...

    Published
    HighCVSS 7.8

    Fonality (previously trixbox Pro) 12.6 through 14.1i before 2016-06-01 uses weak permissions for the /var/www/rpc/surun script, which allows local users to obtain root access for unspecified command execution by leveraging access to the nobody account.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.