PatchTheCVEdialogic vulnerabilities
Recent CVEs affecting dialogic products. 10 tracked.
dialogic has 10 tracked vulnerabilities, 3 critical. A fixed release or vendor patch exists for 10. Most recent: 2018-07-03. Highest priority: CVE-2018-11641 (score 64/100).
- CVE-2018-11643 HIGH 8.8 UPGRADE SQL injection vulnerability in the administrative console in Dialogic PowerMedia XMS through 3.5 allows remote
- CVE-2018-11642 HIGH 7.8 UPGRADE Incorrect Permission Assignment on the /var/www/xms/cleanzip.sh shell script run periodically in Dialogic Powe
- CVE-2018-11641 CRITICAL 9.8 UPGRADE Use of Hard-coded Credentials in /var/www/xms/application/controllers/gatherLogs.php in the administrative con
- CVE-2018-11640 CRITICAL 9.1 UPGRADE XML External Entity (XXE) vulnerability in the web service in Dialogic PowerMedia XMS before 3.5 SU2 allows re
- CVE-2018-11639 HIGH 8.1 UPGRADE Plaintext Storage of Passwords within Cookies in /var/www/xms/application/controllers/verifyLogin.php in the a
- CVE-2018-11638 HIGH 7.2 UPGRADE Unrestricted Upload of a File with a Dangerous Type in the administrative console in Dialogic PowerMedia XMS t
- CVE-2018-11637 HIGH 7.5 UPGRADE Information leakage vulnerability in the administrative console in Dialogic PowerMedia XMS through 3.5 allows
- CVE-2018-11636 HIGH 8.8 UPGRADE Cross-site request forgery (CSRF) vulnerability in the administrative console in Dialogic PowerMedia XMS throu
- CVE-2018-11635 CRITICAL 9.8 UPGRADE Use of a Hard-coded Cryptographic Key used to protect cookie session data in /var/www/xms/application/config/c
- CVE-2018-11634 HIGH 7.8 UPGRADE Plaintext Storage of Passwords in the administrative console in Dialogic PowerMedia XMS before 3.5 SU2 allows
FAQ
How do I fix dialogic vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is dialogic being exploited right now?
None of the tracked dialogic CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which dialogic CVE should I patch first?
CVE-2018-11641 currently ranks highest (64/100): Use of Hard-coded Credentials in /var/www/xms/application/controllers/gatherLogs.php in the administrative con.