These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
Asterisk is vulnerable to reflected cross-site scripting in phone provisioning HTTP error pages. An unauthenticated attacker may retrieve an authorized user's AMI session cookie and impersonate that user when res_phoneprov is enabled. The issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3. This vulnerability requires the Asterisk HTTP web server, As [truncated]
Asterisk, a widely-used open-source private branch exchange and telephony toolkit, is vulnerable to LDAP filter injection through a SIP username. This vulnerability allows an unauthenticated attacker to make arbitrary LDAP queries and potentially disclose sensitive information. The res_config_ldap module must be loaded and configured to access an LDAP server, which is not the default configuration. This i [truncated]
Asterisk, an open-source private branch exchange and telephony toolkit, has a vulnerability that can cause a heap-use-after-free in `PJSIP TCP/SDP` handling. This issue occurs when an authenticated attacker sends a `SIP INVITE` over a connection-oriented transport and disconnects before Asterisk responds with the `200 OK`. The vulnerability has been fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and [truncated]
Asterisk is vulnerable to an out-of-bounds read issue in the `chan_ooh323` `Q.931` `information-element parser`. This issue may allow an unauthenticated attacker to crash Asterisk using carefully crafted `setup packets`. The `chan_ooh323` addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable.