Vulnerabilities > Sangoma > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-12-14 | CVE-2023-49786 | Race Condition vulnerability in multiple products Asterisk is an open source private branch exchange and telephony toolkit. | 5.9 |
| 2022-12-27 | CVE-2019-25090 | Cross-site Scripting vulnerability in Sangoma Freepbx A vulnerability was found in FreePBX arimanager up to 13.0.5.3 and classified as problematic. | 6.1 |
| 2022-12-27 | CVE-2021-4282 | Cross-site Scripting vulnerability in Sangoma Voicemail A vulnerability was found in FreePBX voicemail. | 6.1 |
| 2022-12-27 | CVE-2021-4283 | Cross-site Scripting vulnerability in Sangoma Voicemail A vulnerability was found in FreeBPX voicemail. | 5.4 |
| 2022-12-05 | CVE-2022-42705 | Use After Free vulnerability in Sangoma Asterisk and Certified Asterisk A use-after-free in res_pjsip_pubsub.c in Sangoma Asterisk 16.28, 18.14, 19.6, and certified/18.9-cert2 may allow a remote authenticated attacker to crash Asterisk (denial of service) by performing activity on a subscription via a reliable transport at the same time that Asterisk is also performing activity on that subscription. | 6.5 |
| 2022-12-05 | CVE-2022-42706 | Path Traversal vulnerability in Sangoma Asterisk and Certified Asterisk An issue was discovered in Sangoma Asterisk through 16.28, 17 and 18 through 18.14, 19 through 19.6, and certified through 18.9-cert1. | 4.9 |
| 2022-02-14 | CVE-2021-45310 | Information Exposure vulnerability in Sangoma Switchvox 102409 Sangoma Technologies Corporation Switchvox Version 102409 is affected by an information disclosure vulnerability due to an improper access restriction. | 5.3 |
| 2020-11-06 | CVE-2020-28327 | Improper Resource Shutdown or Release vulnerability in multiple products A res_pjsip_session crash was discovered in Asterisk Open Source 13.x before 13.37.1, 16.x before 16.14.1, 17.x before 17.8.1, and 18.x before 18.0.1. | 5.3 |
| 2020-11-06 | CVE-2020-28242 | Uncontrolled Recursion vulnerability in multiple products An issue was discovered in Asterisk Open Source 13.x before 13.37.1, 16.x before 16.14.1, 17.x before 17.8.1, and 18.x before 18.0.1 and Certified Asterisk before 16.8-cert5. | 6.5 |
| 2020-03-16 | CVE-2019-19852 | Cross-site Scripting vulnerability in Sangoma Freepbx An XSS Injection vulnerability exists in Sangoma FreePBX and PBXact 13, 14, and 15 within the Call Event Logging report screen in the cel module at the admin/config.php?display=cel URI via date fields. | 4.8 |