İçeriğe atla
Noroxi

3CX kayıtları

3cx üreticisine ait 34 yayımlanmış kayıt.

Araştırmacı profili

KEV’e giren
0 · %0
Silahlaştırılmış
0 · %0
Pre-auth RCE
3
Düzeltme kaydı olan
%0
Yayından KEV’e ortanca
KEV’e giren kayıt yok

Yıllara göre kayıt

  1. 17
  2. 18
  3. 19
  4. 20
  5. 22
  6. 23
  7. 24

Çubuk: toplam · koyu kısım: CISA KEV.

Tekrar eden sınıflar

Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.

CWE

Saldırı profili

Bug bounty kapsamı

Ürünün üreticisi herkese açık bir programda görünüyor. Eşleşme ad üzerinden yapıldı; kapsam metnini programda doğrulayın.

Tüm kayıtlar

34 kayıt
  • CVE-2022-28005
    41Planlayın

    An issue was discovered in the 3CX Phone System Management Console prior to version 18 Update 3 FINAL.

    KritikCVSS 9,8İstismar yokEPSS %7

    3cx · 3cx6 May 2022

  • CVE-2018-12426
    41Planlayın

    The WP Live Chat Support Pro plugin before 8.0.07 for WordPress is vulnerable to unauthenticated Remote Code Execution due to client-side va

    KritikCVSS 9,8İstismar yokEPSS %5

    3cx · live chat2 Tem 2018

  • CVE-2019-11185
    40Planlayın

    The WP Live Chat Support Pro plugin through 8.0.26 for WordPress contains an arbitrary file upload vulnerability.

    KritikCVSS 9,8İstismar yokEPSS %4

    3cx · live chat3 Haz 2019

  • CVE-2023-49954
    40Planlayın

    The CRM Integration in 3CX before 18.0.9.23 and 20 before 20.0.0.1494 allows SQL Injection via a first name, search string, or email address

    KritikCVSS 9,8Kavram kanıtıEPSS %2

    3cx · 3cx25 Ara 2023

  • CVE-2019-12498
    40Planlayın

    The WP Live Chat Support plugin before 8.0.33 for WordPress accepts certain REST API calls without invoking the wplc_api_permission_check pr

    KritikCVSS 9,8İstismar yokEPSS %2

    3cx · live chat20 Mar 2020

  • CVE-2019-9972
    36İzleyin

    PhoneSystem Terminal in 3CX Phone System (Debian based installation) 16.0.0.1570 allows an authenticated attacker to run arbitrary commands

    YüksekCVSS 8,8İstismar yokEPSS %2

    3cx · phone system firmware7 Haz 2022

  • CVE-2019-9971
    36İzleyin

    PhoneSystem Terminal in 3CX Phone System (Debian based installation) 16.0.0.1570 allows an attacker to gain root privileges by using sudo wi

    YüksekCVSS 8,8İstismar yokEPSS %2

    3cx · phone system firmware7 Haz 2022

  • CVE-2021-45490
    36İzleyin

    The client applications in 3CX on Windows, the 3CX app for iOS, and the 3CX application for Android through 2022-03-17 lack SSL certificate

    KritikCVSS 9,1İstismar yokEPSS %1

    3cx · 3cx27 Mar 2022

  • CVE-2022-27438
    33İzleyin

    Caphyon Ltd Advanced Installer 19.3 and earlier and many products that use the updater from Advanced Installer (Advanced Updater) are affect

    YüksekCVSS 8,1Kavram kanıtıEPSS %2

    caphyon · advanced installer6 Haz 2022

  • CVE-2023-29059
    32İzleyin

    3CX DesktopApp through 18.12.416 has embedded malicious code, as exploited in the wild in March 2023.

    YüksekCVSS 7,8İstismar yokEPSS %4

    3cx · 3cx30 Mar 2023

  • CVE-2019-13176
    31İzleyin

    An issue was discovered in the 3CX Phone system (web) management console 12.5.44178.1002 through 12.5 SP2.

    YüksekCVSS 7,5İstismar yokEPSS %2

    3cx · 3cx8 Ağu 2019

  • CVE-2022-48482
    31İzleyin

    3CX before 18 Update 2 Security Hotfix build 18.0.2.315 on Windows allows unauthenticated remote attackers to read certain files via /Electr

    YüksekCVSS 7,5İstismar yokEPSS %2

    3cx · 3cx2 May 2023

  • CVE-2022-48483
    31İzleyin

    3CX before 18 Hotfix 1 build 18.0.3.461 on Windows allows unauthenticated remote attackers to read %WINDIR%\system32 files via /Electron/dow

    YüksekCVSS 7,5İstismar yokEPSS %2

    3cx · 3cx2 May 2023

  • CVE-2008-6895
    31İzleyin

    3CX Phone System 6.0.806.0 allows remote attackers to cause a denial of service (unstable service or crash) via unspecified vectors, as demo

    YüksekCVSS 7,8İstismar yokEPSS %1

    3cx · phone system3 Ağu 2009

  • CVE-2023-27362
    31İzleyin

    3CX Uncontrolled Search Path Local Privilege Escalation Vulnerability

    YüksekCVSS 7,8İstismar yokEPSS %0

    3cx · 3cx2 May 2024

  • CVE-2019-14935
    31İzleyin

    3CX Phone 15 on Windows has insecure permissions on the "%PROGRAMDATA%\3CXPhone for Windows\PhoneApp" installation directory, allowing Full

    YüksekCVSS 7,8İstismar yokEPSS %0

    3cx · 3cx11 Ağu 2019

  • CVE-2017-15359
    28İzleyin

    In the 3CX Phone System 15.5.3554.1, the Management Console typically listens to port 5001 and is prone to a directory traversal attack: "/a

    OrtaCVSS 6,5Kavram kanıtıEPSS %6

    3cx · 3cx18 Eki 2017

  • CVE-2018-7654
    27İzleyin

    On 3CX 15.5.6354.2 devices, the parameter "file" in the request "/api/RecordingList/download?file=" allows full access to files on the serve

    OrtaCVSS 6,5İstismar yokEPSS %2

    3cx · 3cx3 Mar 2018

  • CVE-2021-45491
    26İzleyin

    3CX System through 2022-03-17 stores cleartext passwords in a database.

    OrtaCVSS 6,5İstismar yokEPSS %1

    3cx · 3cx27 Mar 2022

  • CVE-2019-9913
    24İzleyin

    The wp-live-chat-support plugin before 8.0.18 for WordPress has wp-admin/admin.php?page=wplivechat-menu-gdpr-page term XSS.

    OrtaCVSS 6,1İstismar yokEPSS %1

    3cx · live chat21 Mar 2019

  • CVE-2018-9864
    24İzleyin

    The WP Live Chat Support plugin before 8.0.06 for WordPress has stored XSS via the Name field.

    OrtaCVSS 6,1İstismar yokEPSS %1

    3cx · live chat9 Nis 2018

  • CVE-2017-2187
    24İzleyin

    Cross-site scripting vulnerability in WP Live Chat Support prior to version 7.0.07 allows remote attackers to inject arbitrary web script or

    OrtaCVSS 6,1İstismar yokEPSS %1

    3cx · live chat9 Haz 2017

  • CVE-2019-14950
    24İzleyin

    The wp-live-chat-support plugin before 8.0.27 for WordPress has XSS via the GDPR page.

    OrtaCVSS 6,1Kavram kanıtıEPSS %1

    3cx · live chat12 Ağu 2019

  • CVE-2018-11105
    24İzleyin

    There is stored cross site scripting in the wp-live-chat-support plugin before 8.0.08 for WordPress via the "name" (aka wplc_name) and "emai

    OrtaCVSS 6,1İstismar yokEPSS %1

    3cx · live chat15 May 2018

  • CVE-2018-18460
    24İzleyin

    XSS exists in the wp-live-chat-support v8.0.15 plugin for WordPress via the modules/gdpr.php term parameter in a wp-admin/admin.php wplivech

    OrtaCVSS 6,1İstismar yokEPSS %1

    3cx · live chat18 Eki 2018