dialogic powermedia xms vulnerabilities and exploits

(subscribe to this query)

2.1

CVSSv2

Plaintext Storage of Passwords in the administrative console in Dialogic PowerMedia XMS prior to 3.5 SU2 allows local users to access the web application's user passwords in cleartext by reading /var/www/xms/xmsdb/default.db.

Dialogic Powermedia Xms Dialogic Powermedia Xms 3.5

4.3

CVSSv2

Plaintext Storage of Passwords within Cookies in /var/www/xms/application/controllers/verifyLogin.php in the administrative console in Dialogic PowerMedia XMS prior to 3.5 SU2 allows remote malicious users to access a user's password in cleartext.

Dialogic Powermedia Xms Dialogic Powermedia Xms 3.5

5

CVSSv2

Information leakage vulnerability in the administrative console in Dialogic PowerMedia XMS up to and including 3.5 allows remote malicious users to read arbitrary files from the /var/ directory because a symlink exists under the web root.

Dialogic Powermedia Xms

9

CVSSv2

Unrestricted Upload of a File with a Dangerous Type in the administrative console in Dialogic PowerMedia XMS up to and including 3.5 allows remote authenticated users to upload malicious code to the web root to gain code execution.

Dialogic Powermedia Xms

7.5

CVSSv2

Use of Hard-coded Credentials in /var/www/xms/application/controllers/gatherLogs.php in the administrative console in Dialogic PowerMedia XMS up to and including 3.5 allows remote malicious users to interact with a web service.

Dialogic Powermedia Xms

6.5

CVSSv2

SQL injection vulnerability in the administrative console in Dialogic PowerMedia XMS up to and including 3.5 allows remote authenticated users to execute arbitrary SQL commands via the filterPattern parameter.

Dialogic Powermedia Xms

7.5

CVSSv2

Use of a Hard-coded Cryptographic Key used to protect cookie session data in /var/www/xms/application/config/config.php in the administrative console in Dialogic PowerMedia XMS up to and including 3.5 allows remote malicious users to bypass authentication.

Dialogic Powermedia Xms

6.8

CVSSv2

Cross-site request forgery (CSRF) vulnerability in the administrative console in Dialogic PowerMedia XMS up to and including 3.5 allows remote malicious users to execute malicious and unauthorized actions.

Dialogic Powermedia Xms

6.4

CVSSv2

XML External Entity (XXE) vulnerability in the web service in Dialogic PowerMedia XMS prior to 3.5 SU2 allows remote malicious users to read arbitrary files or cause a denial of service (resource consumption).

Dialogic Powermedia Xms

7.2

CVSSv2

Incorrect Permission Assignment on the /var/www/xms/cleanzip.sh shell script run periodically in Dialogic PowerMedia XMS up to and including 3.5 allows local users to execute code as the root user.

Dialogic Powermedia Xms

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook