Posted by Asterisk Security Team on Apr 14
Asterisk Project Security Advisory – AST-2022-003
Product Asterisk
Summary func_odbc: Possible SQL Injection
Nature of Advisory SQL injection
Susceptibility Remote unauthenticated sessions
Severity Low…
Posted by Asterisk Security Team on Apr 14
Asterisk Project Security Advisory – AST-2022-002
Product Asterisk
Summary res_stir_shaken: SSRF vulnerability with Identity
header
Nature of Advisory Server-side request forgery
Susceptibility Remote unauthenticated access…
Posted by Asterisk Security Team on Apr 14
Asterisk Project Security Advisory – AST-2022-001
Product Asterisk
Summary res_stir_shaken: resource exhaustion with large
files
Nature of Advisory Resource exhaustion
Susceptibility Remote unauthenticated access…
Active debug code in the B. Braun Melsungen AG SpaceCom Version L8/U61, and the Data module compactplus Versions A10 and A11 and earlier enables attackers in possession of cryptographic material to access the device as root.
A reflected cross-site scripting (XSS) vulnerability in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows remote attackers to inject arbitrary web script or HTML into various locations.
Improper access controls in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 enables attackers to extract and tamper with the devices network configuration.
A XPath injection vulnerability in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows unauthenticated remote attackers to access sensitive information and escalate privileges.
A vulnerability in the configuration import mechanism of the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows attackers with command line access to the underlying Linux system to escalate privileges to the root user.
A relative path traversal attack in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows attackers with service user privileges to upload arbitrary files. By uploading a specially crafted tar file an attacker can execute arbitrary commands.
A session fixation vulnerability in the B. Braun Melsungen AG SpaceCom administrative interface Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows remote attackers to hijack web sessions and escalate privileges.
