5 results · Clear filters · Feed
-
Medium 6.9
Zenitel Connect web interface serves production JavaScript source maps without authentication
The web interface in Zenitel Connect before 1.11.0 serves production JavaScript source maps without authentication, which allows remote attackers to obtain the complete front-end source code, including API usage and internal client logic, via requests for the…
-
Medium 6.9
Zenitel Connect login allows account-lockout denial of service
The login flow in Zenitel Connect before 1.11.0 applies per-account lockout on repeated failed login attempts, which allows remote attackers to cause a denial of service (temporary lockout of targeted user accounts from the web interface, repeatable for as lo…
-
Medium 6.3
Zenitel Connect missing lockout and rate limiting on the WAMP-CRA authentication channel
Improper restriction of excessive authentication attempts in the WAMP-CRA (challenge-response) authentication path in Zenitel Connect before 1.11.0 allows remote attackers to guess user passwords via unlimited authentication attempts, because the path, in whi…
-
Medium 5.1
Zenitel Connect web interface loads integration iframe without sandboxing or origin restriction
The web interface in Zenitel Connect before 1.11.0 loads an integration iframe without sandboxing or origin restrictions, which allows remote attackers to present phishing content to authenticated users via a crafted frame source.
-
Medium 6.9
Zenitel Connect login allows username enumeration via verbose error responses
The login flow in Zenitel Connect before 1.11.0 returns different error responses depending on whether a submitted username exists, which allows remote attackers to enumerate valid user accounts via crafted login requests.