Omarelshopky

**Name of the Vulnerable Software and Affected Versions** Eleveo Call Recording Software version 9.7.0 **Description** A flaw in the `/callrec/roleAddAction.do` endpoint allows remote attackers to perform cross site scripting (XSS), which is a technique used to inject malicious scripts into web pages viewed by other users. This is achieved by manipulating the `name`/`username` argument. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `name`/`username` parameter in the `/callrec/roleAddAction.do` endpoint until the issue is resolved.

A vulnerability was identified in Eleveo Quality Management 9.7.0. The affected element is the function QuestionnaireService.runDataExportNow of the component Questionnaire Service. Such manipulation of the argument file name leads to path traversal. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was determined in Eleveo Quality Management 9.7.0. Impacted is an unknown function of the file /enc-fwk-data/api/v3/conversations/<ID>/events of the component Conversation Handler. This manipulation of the argument createdBy causes dynamically-determined object attributes. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in Eleveo Quality Management 9.7.0. This issue affects some unknown processing of the file /enc-fwk-data/api/v3/conversations/<ID>/events of the component Conversation Handler. The manipulation of the argument labels results in denial of service. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

**Name of the Vulnerable Software and Affected Versions** Eleveo Quality Management version 9.7.0 **Description** A cross site scripting issue exists within the Conversation Review component. This flaw allows remote exploitation through the manipulation of unknown code, enabling an attacker to execute malicious scripts in the context of a user's session. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Eleveo Call Recording Software version 9.7.0 **Description** An issue exists in the `/callrec/composeEmailAction.do` endpoint that allows remote attackers to perform a manipulation leading to improper authorization. Improper authorization occurs when a system fails to properly verify if a user has the necessary permissions to access a resource or perform an action. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the `/callrec/composeEmailAction.do` endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Eleveo Call Recording Software version 9.7.0 **Description** Improper authorization occurs when manipulating the '/callrec/pci dss status.jsp' endpoint, allowing for remote exploitation. **Recommendations** Restrict access to the '/callrec/pci dss status.jsp' file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Eleveo Call Recording Software version 9.7.0 **Description** An issue exists in the Recorded Calls Page component where improper processing of the '/callrec/restoreCallAction.do' endpoint allows for improper authorization. This flaw can be exploited remotely. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Eleveo Call Recording Software version 9.7.0 **Description** An improper authorization issue exists within the Call Recording Handler component. A remote attacker can manipulate the `callId` argument in the '/callrec/audio.jsp' endpoint to bypass authorization controls. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Eleveo Call Recording Software version 9.7.0 **Description** An improper authorization issue exists in the `/callrec/group.jsp` endpoint. This flaw allows a remote attacker to manipulate unknown functionality within the specified file to bypass authorization controls. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the `/callrec/group.jsp` file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Eleveo Call Recording Software version 9.7.0 **Description** A flaw in the Group Interface component allows remote attackers to achieve improper authorization through manipulation of the '/callrec/roleAddAction.do' endpoint. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the '/callrec/roleAddAction.do' endpoint to minimize the risk of exploitation.

A vulnerability was determined in Eleveo Call Recording Software 9.7.0. Affected by this vulnerability is an unknown functionality of the file /callrec/sendlogfile. This manipulation causes improper authorization. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

**Name of the Vulnerable Software and Affected Versions** Eleveo Call Recording Software version 9.7.0 **Description** An improper authorization issue exists in the `/callrec/statisticReportAction.do` endpoint. This flaw allows a remote attacker to manipulate the system, potentially gaining unauthorized access or performing restricted actions. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the `/callrec/statisticReportAction.do` endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Eleveo Call Recording Software version 9.7.0 **Description** An improper authorization issue exists in the `/callrec/userAddAction.do` endpoint. A remote attacker can manipulate the `role` argument to bypass authorization controls. **Recommendations** Avoid using the `role` argument in the `/callrec/userAddAction.do` endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A vulnerability has been found in Eleveo Call Recording Software 9.7.0. This impacts an unknown function of the file /callrec/users ldap.jsp of the component LDAP User Interface. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.